Container images, cloud storage, and Telegram impersonation
Detection is expanding to Docker Hub, more S3-compatible cloud providers, and fraudulent Telegram channels using your brand.
[Coming Q4] Docker Hub Monitoring
Data Breach Prevention is extending to public container images on Docker Hub. Developers sometimes leave credentials, API keys and sensitive files inside the images they publish. We will detect these secrets and alert you before attackers find them. Docker Hub is one of the sources our customers ask for most.
[Coming Q4] More Cloud Storage Providers
Exposed bucket detection is going beyond AWS, Azure and Google Cloud. We are adding S3-compatible providers, starting with Scaleway, then Linode and IBM Cloud. Your data often sits with more providers than you track. We will find exposed storage wherever it is hosted.
[Coming Q4] Telegram Impersonation Detection
Fraudulent Telegram channels using your brand or your executives’ names will be detected automatically. Each one becomes an actionable report, like impersonation on other social networks. You can act quickly to protect customers and employees from scams run in your name.
Infected machines, vendor exposure, and threat intelligence
Consolidated views of infected machines, live alerts on supplier breaches, and prioritised vulnerability and threat actor intelligence.
[Coming Q4] Infected Machines View
See the infected machines behind your leaked credentials in one consolidated view. For each machine, you get the credentials it exposed and the details you need to trace the leak. No more CSV exports to work out where a leak comes from. Your team can move straight to remediation.
[Coming Q4] Vendor Exposure Monitoring
Get alerted when an attack against one of your suppliers is claimed. We will connect what we see on attacker channels to the vendors you depend on. You can assess the impact and contact the supplier before the incident reaches you. It complements your third-party risk management program with live signals.
[Coming Q4] Unified TI View: Vulnerability Intelligence
The Unified Threat Intelligence view will add a prioritized list of vulnerabilities actively exploited by attackers. Instead of every new CVE, you will see the ones attackers are actually using. Your teams can focus patching on the vulnerabilities that matter for your environment.
Threat actor insights, confirmed threats, and dark web automation
Richer threat actor profiles, automatic threat confirmation across detection feeds, and premium dark web intelligence flowing straight into the platform.
[Coming Q4] Unified TI View: Threat Actor Insights
Threat actor profiles are getting richer: who they are, how they operate and whom they target. We are bringing together intelligence from our sources and our own investigations. You will understand the groups most likely to come after your organization and prepare for them.
[Coming Q4] Confirmed Threats, Faster
New relevance models will confirm genuine threats automatically, across our detection feeds. Less manual triage on our side means fewer irrelevant alerts and reports that reach you sooner. Each report you receive will be one worth acting on.
[Coming Q4] Dark Web Monitoring on Autopilot
Premium dark web intelligence will flow straight into the platform. It will be matched to your keywords continuously, with no manual watch in between. Coverage becomes faster and more consistent, and relevant findings reach you as soon as they appear.
Tiered plans and executive dashboards
The platform adapts depth of analysis, reports and support to your package. Executive dashboards give leadership the answers they ask for.
[Coming Q4] Essential, Core and Elite in the Platform
The platform will adapt depth of analysis, reports and support to your package. Essential runs fully self-service. Core and Elite add more analysis depth and access to our experts. Every team gets what its plan promises, directly in the platform.
[Coming Q4] Custom CISO Dashboard
Executive-ready dashboards, tailored to your organization and the indicators your leadership follows. Share them with brand or legal teams without exposing dark web or credential data. Reporting to your board or executive committee becomes quick and consistent.
Self-service onboarding and a smoother buying journey
Start with a free entry point, then scale when you are ready. The path from website to first scan becomes one continuous journey.
[Coming Q4] CybelAngel Starter, Open to All
Sign up with a business email, with no credit card and no demo. Starter generates your monitoring keywords and shows the real exposure found on cybercriminal channels: passwords, domains, employees. Each finding comes with a plain explanation and the attack scenario behind it. When you want to go further, an expert is one click away.
[Coming Q4] A Smoother Buying Journey
From our website to your first scan, subscription and onboarding, the path becomes one continuous journey. You can start, choose your plan and get set up without waiting for a call. Our team is still there whenever you want to talk.
Richer attack context, actor profiling, and proof of exploitability
Claimed attacks now carry full context. Threat actors can be profiled on request. And exposed WordPress assets are actively tested for exploitable weaknesses.
[Beta] Richer Claimed Attack Details
Each claimed attack now comes with a title, a summary and its source, directly in the attack’s side panel. You can see at a glance what the attacker claims to hold and what they intend to do with it. The source link lets you check the claim at its origin before you escalate. The same fields are now available in the public API, so your own tools get the full context too.
[Beta] Attacker Techniques on Live Attacks
Live attacks now show the tactics, techniques and procedures observed against each target, with a timestamp for every event. You see which methods, ports and paths the attacker is testing, and how their activity builds over time. Recent attacks carry a New badge, so the latest activity stands out in the list. Your team can anticipate an attack instead of discovering it once it hits.
[New] Threat Actor Profiling on Request
Need to go further on a threat actor? You can now request an in-depth profile directly from the actor’s page, in one click. Our threat intelligence experts take it from there, with no email back and forth.
Active testing, wider Telegram coverage, and automated market monitoring
We actively test your exposed assets, monitor more Telegram channels, and automatically build monitoring rules for dark web markets.
[New] Proof of Exploitability on WordPress Assets
Exposed WordPress sites in your attack surface are now actively checked for exploitable weaknesses. Instead of flagging a site as exposed, we test whether the weakness can actually be used against you. Reports show proof of risk, so your teams know which fixes come first. This is the first step of active testing on your exposed assets.
[GA] Wider Telegram Coverage
We extended our in-house monitoring of Telegram to more channels and groups. Telegram is where stolen data, fraud offers and impersonation increasingly circulate. More coverage means we spot mentions of your brand, domains and assets earlier. Findings reach you as reports, like any other source.
[GA] Automated Dark Web Market Monitoring
Monitoring rules for Russian Market are now built automatically from your keywords. Each organization gets its own rules, kept in line with its monitoring scope, with no manual setup. Coverage of stolen data listings, such as credentials and access sold on the market, is more complete and more consistent. Relevant listings reach you faster.
Faster detection, clearer severity, and better screenshots
Smarter filtering, recalibrated severity, and near-complete screenshot coverage on domain reports.
[GA] Screenshots on Nearly Every Domain Report
Domain Protection reports now include a screenshot of the suspicious site in up to 99% of cases where a capture is possible, up from 85%. You see what the site looks like without opening it. You can qualify phishing and brand abuse faster. Each report gives you clear evidence to share with legal or brand teams, or to support a takedown.
[GA] Faster Time to Detect on File Servers
Smarter filtering now sorts file server findings using each organization’s own context. It removes a quarter of irrelevant findings before analyst review, with no rise in missed leaks. Our analysts spend their time on the findings that matter. Confirmed leaks reach you sooner.
[GA] Clearer Dangling Subdomain Severity
Subdomains pointing to trusted third-party services, such as email delivery or load balancing, are now rated Informative instead of Major. This applies to around 40% of the dangling subdomain alerts previously rated Major. The Major alerts that remain point to a real takeover risk. Your team can focus remediation where it counts.
Localized reports, service catalog, and keywords API
Reports in your language, a full service catalog in the platform, and programmatic keyword management at any scale.
[New] Social Media Reports in Your Language
Social Media Impersonation reports are now written in your organization’s language, English or French. Each report reads naturally for the teams who act on it, from security to brand and legal. You no longer need to translate a report before sharing it internally or filing a takedown request.
[New] Service Catalog
Browse all CybelAngel professional services in one place, request one or buy credits directly in the platform. The Credits page shows your real-time balance and the expiry date of each purchase. The history lists every request, with filters by category, service, requester, status and date, and can be exported to CSV. Credits become an asset you manage, not a line in your contract.
[GA] Keywords API
Manage the keywords you monitor directly through the API, at any volume. Add and update hundreds of keywords in one go, without entering them one by one in the platform or asking our team to handle bulk changes for you. Connect your own systems to keep your monitoring scope in sync automatically. Your coverage follows your business, on your schedule.
Navigation and filtering
A reorganized sidebar and standard filters across every list page.
[New] Reorganized Navigation
The sidebar has been reorganized around how you use the platform. Dashboards and general views come first, and features are grouped by capabilities. The platform is quicker to scan and easier to find your way around. The new structure also leaves room for the features coming next.
[New] Simpler Filters
List pages now use standard filter buttons, so you can narrow your data in a few clicks. Pick the values you need for each field instead of typing search queries. Combine several filters to get straight to the alerts, reports or assets that matter to you. The same filters work the same way across the platform, so you don’t have to relearn them from one page to the next.
Social media, AI-generated risks, and your vendor ecosystem
CybelAngel extends detection beyond the perimeter: across the dark web, AI-generated attack surfaces, social media platforms, and your vendor ecosystem. You know before the damage is done.
[New] Dedicated Social Media Impersonation Module
Access your social media reports in a standalone module. Activate it instantly, no extra setup.
[New] Extended Social Media Monitoring
Monitoring now covers accounts, profiles, and posts across YouTube and other platforms. Detect impersonation, leaked data, and threat actors actively targeting your brand and executives.
[New] AI Data Breach Detection
Automatically detect credentials, API keys, and business data exposed by AI-generated applications. Reports are enriched with context and fewer false positives, so your team can act immediately.
Smarter reports, unified threat intelligence, vendor visibility
AI tools move fast. So do the risks they create. CybelAngel enriches your reports with context and fewer false positives, so your team turns raw signals into clear decisions.
[Beta] Smarter Reports on Exposed APIs
Automated, analyst-validated incident reports on your most sensitive exposed API endpoints. Each report prioritises exposures by severity (1 to 4) and includes the detection date, what the API exposes, technical details, and recommended next steps.
[New] Vendor Exposure Monitoring
Continuous monitoring of your supplier ecosystem. Get alerted when a vendor is breached before they tell you. Contact your Customer Success Manager to join the beta.
[Beta] Unified Threat Intelligence View
A searchable directory of threat actors with full context: activity status, attack history, top targeted countries and industries, and preferred attack methods. Plus a live feed of ongoing and claimed attack campaigns. Filter by category, industry, country, or threat actor.
Dashboards, API access, and direct feedback loops
Security teams come in all shapes and sizes. CybelAngel adapts to yours: whether you need role-specific views, scoped integrations, or a direct feedback channel back into detection quality.
[New] Custom Dashboard
Tailor your dashboards across your full monitored perimeter, focusing on what matters to your daily work. Build role-specific views for the CISO, the SOC Manager, or your analysts, so each team sees the information most relevant to them.
[New] Reinforced API Access
Generate and manage multiple API keys so you can plug CybelAngel intelligence into your stack on your own terms. Scoped by team or use case.
[New] Native Report Rating
Rate reports directly in the platform. Your ratings feed straight into detection accuracy, closing the loop between your team and our models.
Access controls, audit trails, and usage tracking
Your team, your workflow, your rules. CybelAngel gives you the control to manage access, automate integrations, and track usage, so the platform works the way your organisation does.
[New] Segment Access to Inventory
Identify and control who can view and access your inventory, based on team responsibilities. Give each team or business unit visibility into only the assets relevant to them.
[New] Audit Log Accessibility
Full action traceability across your environment, essential for compliance and team oversight. Access your audit log via the API to review who did what, and when.
[New] Credits Monitoring
See your Professional Services credits: contracted, used, and remaining, directly in the platform. Break down usage by service category and by team member, browse the full catalogue, and top up before you run out.
Self-service entry points and automated reporting
Whether you need a standalone module, a full suite, or a self-service entry point that lets you start immediately and scale on your own terms.
[Beta] Self-Service Plan
Phishing, fraud, and brand abuse reports on Domain Protection are now generated and delivered automatically: fast and continuous, including weekends and non-business days. Your analysts stay at the core of the process for critical incidents, enriched context, and on-demand services. Same detection logic, same SLAs.
[New] CybelAngel at Your Own Pace
Generate an exposure report from a simple keyword to see your external risk for yourself, before committing. A guided way to discover what CybelAngel detects across your perimeter, from day one.
Wider inventory coverage, sharper threats
Enhanced fingerprinting across your perimeter and IoC-driven precision on every domain finding.
-
Extended Assets Inventory [GA]
Shadow IT, cloud, and third-party assets surfaced via enhanced fingerprinting. Exposed credentials auto-generate investigation reports. -
Faster Brand Abuse Detection [GA]
IoC feed cross-referencing at ingestion across Domain Protection. Less manual triage, executive-ready findings. -
Sharper Threat Landscape Intelligence [GA]
IoC enrichment extended across all domain and brand threat categories for richer context and less noise.
Automated reporting and AI-aware research
Automated reports, AI infrastructure exploration, and continuous 24/7 coverage.
-
Exposed APIs to Reports Automatically [Beta]
Sensitive API exposures are now turned into structured, ready-to-use reports without manual triage. Analysts can pick up the report directly and act on it. -
AI Infrastructure Exposure Detection [Research]
Early scanning for exposed AI infrastructure such as LLMs and automation tooling. Broader rollout is planned for Q2 2026. -
Continuous Domain Threat Reporting [Beta]
Domain findings are now generated continuously, including weekends, with analysts staying central for critical incidents.
Vendor visibility, role-based access, audit traceability
The foundations of the Q2 2026 rollouts.
-
Third-Party Risk Monitoring [Beta]
The first beta of vendor exposure tracking, alongside the ransomware claimed attacks newsletter. Platform-native vendor monitoring follows in Q2 2026. -
Role-Based Permissions and Workspaces [GA]
Admin, Contributor, and Viewer roles with dedicated workspaces for each team, subsidiary, or scope your organisation needs. -
Audit Log via API [GA]
Full compliance traceability available programmatically through the new GET /v1/{org_id}/audit-logs endpoint.
Shipped in 2025
Overall we release 11 updates including the TI Dashboard, Claimed Attack API, ADM Threat Status Tracking, Redesigned User Management, and Keyword Optimization.
أسئلة متكررة
The changelog is updated continuously as features ship. Each quarter we publish a structured recap covering everything that moved to Generally Available, entered Beta, started Research, or is planned for the next quarter.
GA (Generally Available): shipped to all customers as part of your subscription. Beta: available to opt-in customers. Contact your Customer Success Manager to join. بحث: early-stage exploration, not yet a committed feature. Coming Q4: confirmed for the current quarter’s roadmap.
Reach out to your Customer Success Manager. They will check eligibility, walk you through what is being tested, and enable the feature on your account. Most betas are available to all subscription tiers.
استخدم اتصال form, or raise it directly with your Customer Success Manager. Customer-submitted ideas are reviewed during each quarterly roadmap planning cycle, and high-impact ones often ship within the same or the following quarter.
The next-quarter roadmap is committed, but priorities can shift based on emerging threats, customer demand, or technical findings during development. We will always communicate scope changes via the changelog and through your Customer Success Manager.