What are Smart Alerts?
Smart Alerts is a powerful new feature in Cytidel Recon that helps you cut through the noise and stay on top of what truly matters. With Smart Alerts, you can configure targeted, context-aware monitoring rules that continuously track vulnerabilities, vendors, and threat intelligence aligned to your specific environment.
Instead of being flooded with generic alerts, you’ll only be notified when something emerges that’s relevant to your vendors, (soon products), and priorities.
Why use Smart Alerts?
Smart Alerts is our answer to alert fatigue that results in almost two thirds of security professionals saying they wouldn't recommend a job in the industry due to stress and burnout.
Before Smart Alerts:
- Hundreds of alerts you don’t have time to read
- Hours wasted digging through noise
- Risk of missing the ones that matter
With Smart Alerts, you can:
- Monitor what matters: Track 40,000+ vendors, 300,000+ CVEs, and intelligence from dozens of feeds – automatically.
- Act faster: Get alerts immediately when relevant risks emerge (don’t wait for NVD delays).
- Stay confident: Be sure you’re not missing something critical tied to your tech stack.
- Stay in control: Build highly tailored rules based on vendors, risk ratings, tags (like “CISA KEV” or “Exploit Public”), and more.
How are Smart Alerts different from previous Alerts?
Unlike the older Trending CVE Alerts, Smart Alerts are fully customisable and built to reduce noise. They let you tailor monitoring to your environment - with the ability to filter by vendor (e.g., Microsoft or Fortinet), and soon by specific products - something the old system didn’t support.
Smart Alerts also let you set rules based on contextual intelligence tags like CISA KEV, Potential Public Exploit, or Known Threat Actor. You can fine-tune by risk rating, CVSS, or EPSS scores. This gives you greater control, clarity, and confidence in what you monitor.
Examples of alerts
Here are some alert rule ideas to get you started:
1. Emerging Threats (Exploited in the Wild)
Be notified the moment a vulnerability is confirmed exploited.
- Intel Tags: Potential Public Exploit (PPE)
- Optional: Add Trending in News or Social to catch CVEs gaining momentum before they escalate
💡 PPE is the strongest early-warning signal for emerging exploited threats. Adding Trending gives you visibility into CVEs that are starting to draw attention.
2. Emerging Threats (Cytidel Spotlight)
Track vulnerabilities our CTI team believe are on the verge of becoming significant risks.
- Intel Tags: Cytidel Spotlight
- Optional: Add Proof of Concept (PoC) if you also want to include CVEs with public exploit code available
💡 Spotlight is driven by expert analysis of multiple data points — surfacing vulnerabilities that aren’t yet widely exploited, but carry strong signals they’re about to matter.
3. Threat Actor Activity
Get alerted when a CVE is actively linked to an adversary campaign.
- Intel Tags: Known Threat Actor (KTA)
- Optional: Add PPE if you also want confirmation that the CVE is being exploited in the wild
💡 Helps you prioritise based on who is targeting what, not just abstract severity scores.
4. Vendor-Specific Watch
Be notified when high-risk vulnerabilities appear in your stack.
- Vendors: Select the technologies you rely on most
- Intel Tags: PPE (and optionally CISA KEV for confirmed exploited CVEs)
💡 Cuts through the noise to highlight only the vulnerabilities that matter to your environment.
Retirement of CVE alerts
With the launch of Smart Alerts, we are retiring Trending CVE Alerts in September. These legacy alerts were often noisy, and lacked contextual filtering - such as vendor or exploitability - making them less useful for targeted monitoring based on your tech stack.
If you’re currently using Trending CVE Alerts, don’t worry - we’ll reach out directly to help you migrate your existing alert logic into Smart Alerts. The transition will give you more precision, less noise, and a far more relevant view of what matters most to your environment.