Security teams rarely struggle to find another threat feed. The harder part is deciding which signals deserve attention—and understanding how they connect.
The new Cyber Dreigingsradar (CDRv2) from Digiweerbaar brings incidents, vulnerabilities, data leaks and darkweb reporting into a shared intelligence platform, with a focus on the Netherlands and Belgium. Its strongest features address two practical questions: what matters to this organisation, and what is the history behind it?
An intelligence profile that cuts through the noise
A vulnerability affecting software an organisation actually uses deserves a different level of attention from one affecting an unrelated product. CDRv2’s intelligence profile makes that distinction useful.
Users select relevant technologies, platforms and suppliers. The radar matches intelligence against those choices, including information connected through recorded relationships. A matching threshold lets users adjust how much appears in their personal radar, while notification preferences determine whether updates arrive in the dashboard, by email or through a daily or weekly digest.
That gives an IT manager watching an organisation’s technology stack a more focused view, while an analyst can keep the threshold broader for research. Personalisation changes relevance to the user; it does not change the reliability of the underlying source.
The intelligence profile: relevant technologies, matching thresholds and notification preferences.
Darkweb monitoring deserves its own place
The darkweb remains a significant blind spot for organisations. Internal monitoring can show activity inside the network, but an extortion claim or an offer of stolen data may appear elsewhere before it reaches the organisation’s security team.
CDRv2 gives darkweb monitoring a dedicated view, bringing together analyst reporting and automated sources covering leak sites, forums and closed groups. Users can investigate mentions of organisations, the groups behind claims and the supporting information.
The distinction between a criminal claim and a confirmed incident matters here. A leak-site listing is a reason to investigate, not proof that every allegation is accurate. The platform explicitly separates observations from confirmed findings.
For security teams, this adds an external perspective: whether their organisation, a supplier or another company in their sector is appearing in reporting they would otherwise miss.
Darkweb monitoring brings organisation mentions, threat groups and verification status together.
Intelligence with a memory
For threat intelligence analysts, one of the most interesting additions is the ability to search historical information dating back to 2018.
That history supports work a current-news feed cannot do well: finding recurring targeting of a sector, tracing earlier activity around a threat group, examining relationships between incidents and vulnerabilities, or reconstructing what was known at a particular point in time.
Dossiers bring source articles, relationships and timelines together. The relationship graph helps users explore connected records, while the timeline shows how reporting developed—including later corrections. A recorded connection remains something to assess against its sources, rather than automatic proof of causation.
An incident dossier combines a relationship graph, source articles and a timeline of developments.
Vulnerability dossiers apply the same approach, combining technical context with developments over time and indicators such as EPSS and known exploitation. This helps analysts follow how a vulnerability’s significance changes after its initial disclosure.
A vulnerability dossier combines technical context, exploitation indicators and a chronological record.
Next: connecting intelligence to assets
Asset scanning is on the roadmap. The planned capability would bring the external attack surface closer to the intelligence workflow, helping teams investigate how reported threats relate to their internet-facing assets.
That connection needs care: identifying a software version is not the same as confirming a vulnerability. Package fixes, configuration and actual exposure still matter.
CDRv2’s appeal already lies in the investigation it supports: a relevant signal, its sources, its history and its connections, all within reach. For organisations building a more deliberate threat intelligence practice, that is a useful step forward.
