Vulnerability intelligence is information about which known security flaws attackers are actually using right now. The industry says that such a flaw is being "exploited in the wild". Vulnerability intelligence is usually a part of a vulnerability scanner, or a feed that the scanner reads.
Why is it needed? Tens of thousands of new flaws are added to the public CVE list every year. Only a small share of them, a few per cent, are ever used in a real attack. A severity score says how much harm a flaw could do if someone used it. It does not say whether anyone is using it. So a security team that patches by severity alone spends weeks on flaws that no attacker touches.
Vulnerability intelligence fills that gap. Its analysts and its software watch several sources. These include security companies' reports of attacks, criminal forums where attack code is sold, public code websites where attack code is shared, and government warnings. In India, CERT-In, the government's cyber security agency, publishes advisories about serious flaws in widely used software, and warns when attackers are already using a flaw. In the United States, the government agency CISA keeps a public list of flaws known to be exploited. Some services also predict the chance that a flaw will be used in the next 30 days, as a percentage.
Take, for example, a co-operative bank in Nagpur. Its scanner reports 1,800 open findings across its servers. The bank's small team cannot fix all of them this month. Vulnerability intelligence marks 22 of them as flaws that attackers are using now. Of those 22, five are on servers that face the internet. The team patches those five servers within 48 hours, through patch management. It fixes the other 17 within the week. The remaining findings go into the normal monthly plan.
Vulnerability intelligence is close to a threat intelligence platform, but the two answer different questions. A threat intelligence platform tracks attackers: their internet addresses, their tools and their targets. Vulnerability intelligence tracks flaws: which ones attackers have started to use. The two share data. When an attacker group starts using a new flaw, both record it.
Some products also combine this intelligence with external attack surface management (EASM). They can then answer one practical question: is a flaw that attackers are using today present on any server that we expose to the internet?