Method and sources
coldbraid reads threats the way a forecaster reads weather: many instruments, one chart. This page explains each instrument, so you can check the reading yourself.
How to read a station plot
Weather charts compress a station’s whole observation into one glyph. coldbraid does the same for a vulnerability. The circle is the CVSS base score, filled in eighths like cloud cover, in the colour of its severity band. The shaft shows where the attack comes from: up for the network, up-right for an adjacent network, down-right for local, down for physical access. The barbs are the EPSS exploit probability, read like knots: a half barb is 5 %, a full barb 10 %, a pennant 50 %. A filled bolt means the flaw is on CISA’s exploited list; a hollow bolt means public proof-of-concept code exists.
Force
Force is coldbraid’s own heuristic on a 0–12 scale, named after the Beaufort wind scale. It is not an industry standard and it is not a prediction. For one vulnerability it combines the CVSS base score (42 %), the EPSS percentile (23 %), presence on CISA’s exploited list (22 %), news stories in 14 days (8 %), a public proof of concept (3 %) and known ransomware use (2 %). For the day it weighs exploitation (40 %), new critical vulnerabilities (25 %), ransomware claims (25 %) and the SANS Infocon level (10 %), each measured against its own recent normal.
The chart
The letters L on the chart mark countries where ransomware groups claimed victims in the last 30 days. The moving lines are a flow model shaped by those counts. They show no measured traffic and no attack paths.
Sources
| Source | Used for |
|---|---|
| CISA Known Exploited Vulnerabilities | The exploited list, deadlines, ransomware flags |
| NIST NVD | Recent CVEs, CVSS scores, weaknesses |
| CVE Program | Full records and references |
| FIRST EPSS | Exploit probability and percentile |
| MITRE ATT&CK | Actors, techniques, software. © The MITRE Corporation |
| ransomware.live | Leak-site claims and group profiles |
| abuse.ch | Botnet controllers and indicators |
| SANS Internet Storm Center | Infocon and most-probed ports |
| PoC-in-GitHub | Whether public proof-of-concept repositories exist |
Privacy and limits
No accounts, no cookies, no analytics. Tools compute locally. Ransomware entries are criminals’ claims: being listed does not prove a breach. Verify with the original source before you act.