What does the Threat landscape list (beta) in CVD Portal show?
The CVD Portal Threat landscape list (beta) shows public incidents at other organisations from the last 90 days. Incidents that match the company come first, for example a breach at a listed supplier or a CVE from the company SBOM.
Key takeaways
- The Threat landscape list needs the Compliance plan, and only company admins see the list while it is in beta.
- A match uses data that CVD Portal already holds, which is the company name, the supply chain partners, the hardware producers and the open SBOM findings.
- A match puts an incident first and never hides an incident.
- The Threat landscape list opens no review trigger, sends no alert and starts no Article 14 deadline.
Last updated 3 November 2026.
The list is a beta feature and it is still changing.
Open the list
- Select Risk in the sidebar.
- Find the Threat landscape card. It shows the number of incidents in the last 90 days and the number that match your company.
- Select Open the list.
The list updates each day at 09:00 UTC.
Where the incidents come from
An automated feed reads public incident reports each day, for example news and security channels. It maps each report to one risk scenario. A report goes into the list only with evidence.
| Evidence | Meaning |
|---|---|
| Confirmed | The victim or an authority confirmed the incident. |
| Reported | A second source supports the report. Examples are a catalogue of known exploited vulnerabilities, a CVE record, a regulatory filing, or more than one news outlet. |
A claim that only an attacker makes never goes into the list. Each incident shows the date, the victim, the scenario and a one-sentence summary that the feed writes. The list does not copy the text of the source. It links to the source.
How the match works
An incident matches your company for one or more of these reasons. The incident shows each reason as a label.
| Label | Rule |
|---|---|
| Names your company | The victim has the name of your company. |
| Your supplier | The victim has the name of an active partner on the Supply Chain Partners page, or of a producer in the hardware registry. |
| In your SBOM | A CVE of the incident is an open finding in your SBOM. |
The match compares names without the legal form, for example B.V., GmbH or Inc. Another organisation with the same name can therefore match. The match puts an incident first. It never hides an incident.
Filters
You can filter the list by match, scenario, risk category, CRA threat group and evidence. Each filter offers only the values that occur in the last 90 days.
Why this mapping
Open Why this mapping on an incident to see why the feed mapped it to its scenario.
- The scenario, its definition and its fit score from 0 to 100.
- The risk category of the scenario.
- The next closest scenario and its fit score.
- The evidence, as one sentence.
- The CRA threat and its threat group, when the incident is about a product.
- The CVEs and the link to the source.
Some incidents come from one report with two mappings. One is about the victim. The other is about the clients of the victim, when the victim is a service provider. The list shows them as one incident.
What the list does not do
- It does not open review triggers and it does not send alerts. A new SBOM finding or a KEV match still opens a review trigger on the product. See Clause 6.7 risk review.
- It does not start an Article 14 deadline. If an incident names your company and affects the security of your product, check your duty under Article 14 of Regulation (EU) 2024/2847 (CELEX 32024R2847). The Article 14 page shows how CVD Portal helps.
- It does not change your risk assessment. You decide if an incident changes it.
How it differs from Supply Chain Intel
Supply Chain Intel shows vulnerability advisories for the vendors and the SBOM components that you depend on. The Threat landscape list shows incidents, which are attacks and breaches at real organisations.