Are n'guard's Cyber Threat Intelligence tools really free?

Yes, with no account and no time limit. With the Dark Web Report, the score and findings are shown immediately, while technical details and measures are unlocked with an email address from the domain being checked.

How do I check whether my company's credentials are being traded on the dark web?

In under a minute, the Dark Web Report checks whether credentials are being traded on the underground and whether the domain appears in data breaches or on ransomware leak sites. It also shows weaknesses that are visible from the outside.

How up to date is the data?

Ransomware and DDoS data is updated hourly, and the catalogue of actively exploited vulnerabilities twice a day. Queries in the IOC Radar and the Dark Web Report run live and are cached for a few hours.

Does a clean result replace a penetration test?

No. A clean result means “nothing known”, not “secure”. The tools say nothing about the internal network, endpoints or cloud configuration.

Are n'guard tools really free?

Yes. All five tools can be used without an account and without a time limit and are based exclusively on publicly accessible data sources. There is an exception with the Dark Web Report: Score and findings appear immediately, the technical details of the findings and the derived measures are activated with an email address for the checked domain.

What tools are there?

The Dark Web Report checks a company domain for leaked access data and exposure. The Ransomware Intelligence shows active groups and their victims in Switzerland and the DACH region. The IOC Radar evaluates individual IP addresses, domains, URLs, file hashes or CVE-IDs. The DDoS Intelligence shows the attack situation at the network and application level. The Threat Reports summarize the situation per month and quarter as a printable report.

Who are the tools intended for?

For management, IT managers and security officers of small and medium-sized companies in Switzerland who do not have their own security operations center and still need a fact-based assessment of their situation.

Will my entries be saved?

No personal data is stored. Checked domains and indicators are cached for a few hours so that repeated queries do not burden the free data sources. Only those who voluntarily request a detailed report leave contact details.

Overview

ENEnglish

LiveWithout registration, without an account

n'guard Cyber Intelligence

Free Cyber Threat Intelligence
for Swiss companies.

Q: What is Cyber Threat Intelligence?

Cyber Threat Intelligence is the collection, analysis and contextualisation of information about current threats, such as active threat groups, exploited vulnerabilities and credentials traded on the underground. Its purpose is to support decisions, for example what to patch first.

Five tools, one interface: leaked credentials, active ransomware groups, suspicious indicators, DDoS situation and the monthly situation report. Everything from public sources, everything free.

Ransomware victims Switzerland, 12 months

actively exploited vulnerabilities

5Tools, no registration

Most used

Dark Web Report

Check in under a minute whether your company’s access data is being traded underground, whether your domain appears in data breaches or on ransomware leak sites and which weaknesses are visible from the outside.

Infostealer infections on employee devices
Known data breaches and leak site mentions
Email security, TLS, open services, subdomains

Last published

The tools

More modules, same interface.

Each tool answers a different question. Together they create the situation: outside, inside, current and over time.

Ransomware Intelligence

Which groups are currently attacking Swiss companies, which sectors are affected, and how is this developing over 24 months. With group profiles including procedures according to MITRE ATT&CK.

IOC Radar

An IP in the firewall, a link in an email, a CVE in an alert: the radar queries nine public sources and delivers a verdict with reasons in English.

CVE Intelligence

Which vulnerabilities are currently being exploited worldwide, and does it affect your manufacturers? Search for CVE-ID or product, with active exploitation, probability and urgency.

Global data

DDoS Intelligence

Attack history at the network and application level with the target of Switzerland, including protocols, duration, bandwidths, affected industries and the origin of the attacks.

Threat Reports

The situation of a month or quarter on one page: ransomware cases, newly exploited vulnerabilities, reported attacks, classification and measures. As a PDF for management.

Crisis simulation

A ransomware attack hits a manufacturing company. Seven decisions, 45 seconds per move, at the end your Cyber Readiness Score with the biggest gaps.

Practise, don’t just read

Cyber Threat Monitor

The Swiss threat situation based on the weekly BACS reports: most common attack types, history and ransomware tracker.

Swiss threat picture

Where the data comes from

No black box, no registration.

n'guard does not collect its own underground data. The tools aggregate publicly available sources, evaluate them and translate the results into measures. Each source is named at the result.

Underground and incidents

ransomware.live for leak sites and reported attacks, Have I Been Pwned for documented data breaches, Hudson Rock for infostealer infections.

Network and attack surface

Shodan InternetDB for open services, RIPEstat for carriers and location, crt.sh for certificate logs, SANS ISC and Spamhaus for reputation.

Vulnerabilities

NVD for CVSS and affected products, CISA KEV for proven exploited vulnerabilities, FIRST EPSS for the likelihood of exploitation.

What the tools can’t do

They show what is visible from outside and from public sources. They do not replace a penetration test or ongoing monitoring of your systems and say nothing about your internal network, your end devices or your cloud configuration. An inconspicuous result is called “nothing known”, not “certain”.

FAQ

Cyber Threat Intelligence, briefly explained.

What is Cyber Threat Intelligence?

The collection, evaluation and classification of information about current threats: which groups of attackers are active, which vulnerabilities are being exploited, which access data is being traded underground and which systems of an organization are vulnerable to attack from the outside. The purpose is not to collect, but to decide: what do we patch first, what access do we additionally secure, and what do we inform management about.

Are the tools really free?

Yes, without an account and without a time limit. They are based on publicly available sources that n'guard prepares. One exception: With the Dark Web Report you can see the score and findings immediately, and you can activate the technical details and measures with an email address from the checked domain. Everything else works anonymously.

Where do I start?

With the Dark Web Report for your own domain. It shows where you stand in under a minute. It is then worth taking a look at the Ransomware Intelligence to see your own industry in comparison, and at the current threat report for the classification vis-à-vis management.

How current is the data?

Ransomware and DDoS data is updated hourly, and the catalog of actively exploited vulnerabilities is updated twice daily. Queries in the IOC Radar and Dark Web Report run live and are then cached for a few hours.

What is the difference to the Cyber Threat Monitor?

The Cyber Threat Monitor shows the overall Swiss situation based on reports to the Federal Cybersecurity Office. The tools here go one level deeper: They answer questions about your domain, a specific indicator or a specific group of attackers.

From information to security

Knowledge is the beginning, not the goal.

The tools show you the situation. n'guard tests your systems in penetration tests and monitors them around the clock in Managed SOC.

Book a call →View Managed SOC

Free Cyber Threat Intelligencefor Swiss companies.