Integrating Threat Intelligence

Vulnerability management cannot occur in a vacuum; it must be informed by the broader threat landscape. Integrating Threat Intelligence feeds into the CVD Portal provides crucial context that helps prioritize remediation efforts based on actual attacker behavior, a key tenet of proactive risk management under the Cyber Resilience Act (CRA).

The Supply Chain Intelligence page (Supply Chain Intel in the sidebar) has two feeds. It requires the Reporting plan or higher.

• Vendor watchlist. You add the vendors that you depend on. The portal shows NVD advisories for each vendor, matched by the CPE vendor name. The page can look back up to 120 days.
• SBOM exposure. The portal matches each component in your uploaded SBOM against OSV.dev by exact version. It shows only the advisories that affect the versions you ship.

On the Enterprise plan, a daily scan sends an email and a webhook when a new advisory first matches an SBOM component.

The portal does not import indicators of compromise or threat actor data, and it does not change the priority of a report automatically.

Exploitation evidence

The portal also enriches each vulnerability with exploitation evidence drawn from the Global CVE Allocation System: multi-catalogue KEV assertions, EPSS probability scores, and real-world sightings. This is what separates "severe in theory" from "being used against people right now". See Exploitation Signals for what each badge means and how it feeds an Article 14 determination.