how the threat level is calculated
Every five minutes a scheduled job aggregates the latest cybersecurity signals into a single 0–100 score. The score answers a simple question: how alert should a SOC engineer be right now?
inputs
The score is recalculated continuously from the same data feeds that power the live pcap.post home page:
- CVEs added in the last 24 hours, weighted by severity
- CVEs flagged by CISA's Known Exploited Vulnerabilities (KEV) catalogue or with confirmed in-the-wild exploitation
- Critical and high-severity headlines from curated security news feeds, in the last 24 hours
formula
The score starts from a floor of 5 — even with zero signals it never reads truly quiet, since the absence of data isn't the same as the absence of risk. Four independent bands are then added on top, each saturating so that a single spike can't run away with the score:
| signal | max contribution |
|---|---|
| active KEV-listed / in-the-wild-exploited CVEs | up to +40 |
| critical-CVE volume (last 48h) vs. a 14-day baseline | up to +25 |
| high-CVE volume (last 48h) vs. a 14-day baseline | up to +12 |
| security-news volume (last 24h), critical headlines double-weighted | up to +20 |
The two CVE-volume bands compare today's rate to a rolling 14-day exponential moving average of daily critical/high CVE counts, so the score reacts to an unusually busy patch window rather than to a fixed number — a day with 10 new critical CVEs reads very differently in a quiet month than in one already averaging 10 a day. If that baseline hasn't been established yet (or is unavailable), the bands fall back to fixed reference volumes instead. The KEV/ITW and news bands are each bounded independently of the baseline. The total is clamped to the 0–100 range.
levels
| score | level | meaning |
|---|---|---|
| ≥ 80 | SEVERE | active mass exploitation; treat ITW CVEs as P0 |
| ≥ 55 | ELEVATED | multiple critical signals; review and patch this shift |
| ≥ 25 | GUARDED | routine vigilance; nothing on fire today |
| < 25 | LOW | quiet news cycle; catch up on backlog |
delta
The arrow next to the score (▲ / ▼) shows the day-over-day change: today's score against the score snapshotted once per UTC day, the moment the daily email sends. The home page and the daily/weekly emails all read that same snapshot, so the arrow means the same thing wherever you see it.
caveats
The score is a heuristic, not a predictive model. It tells you whether the last 24 hours have produced more or fewer dangerous signals than usual — it does not assess your specific environment, exposure, or patch posture. It's intended to set the temperature, not to replace threat modelling.
Implementation: functions/_lib/feeds.js · function
fetchThreat.