Topic

Sensor-Based Threat Intelligence

Research method that runs large networks of internet-facing sensors and honeypots to observe scanning and exploitation traffic as it happens, rather than after victim reports.

Current clusters

build1 publisher

Exploit development for PaperCut took under four hours from an empty workspace

GreyNoise says a likely Russian-speaking actor built and tested PaperCut exploits in a lab, then ran hundreds of agents on a Codex harness with a DeepSeek model against 440 servers in 48 countries. The sending infrastructure was already on its watchlist.

Publishers:greynoise.io

Reality

Evidence58
Adoption70
Hype gap+12
Incentives68
Confidence55