---
title: "Threat Intelligence"
description: "3 posts about Threat Intelligence, summarised, each linking to the original."
---

# Threat Intelligence
> 3 posts about Threat Intelligence, summarised, each linking to the original.

## Articles

### [Introducing Threat Signals: agentic skills for open-source threat intelligence, free for every Cloudflare account](https://yomu.fyi/post/introducing-threat-signals-agentic-skills-for-open-source-threat-intel.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Jacob Crisp
- Published: Sep 29, 2026
- Type: Announcement

Cloudflare introduced Threat Signals, a free agentic skill layer for open-source threat intelligence available to every account. The product targets the unstructured-reporting problem: converting research posts into indicators that security tools can consume while preserving the context that explains their relevance. A skill encodes detailed instructions that capture how an experienced analyst handles one part of the job, and it runs identically on every report. The agentic skills summarize reports, surface key context, extract and normalize indicators of compromise, and apply tags within a private, account-scoped dataset. This approach standardizes analyst expertise into repeatable, context-preserving processing for threat reports.


### [Building safeguards for Claude](https://yomu.fyi/post/building-safeguards-for-claude.md)
- Company: [Anthropic](https://yomu.fyi/company/anthropic.md)
- Published: Jul 6, 2026
- Type: Explainer

Claude’s Safeguards team describes a lifecycle approach to reducing misuse while keeping the model useful, combining policy, training, evaluation, real-time enforcement, and monitoring. The team uses a Unified Harm Framework spanning physical, psychological, economic, societal, and individual autonomy harms, and policy vulnerability testing with external experts to shape policies and defenses. Before release, Claude undergoes safety, risk, and bias evaluations, including capability uplift testing in high-risk domains; findings can lead to new detection methods or guardrails. After deployment, prompted or fine-tuned Claude classifiers monitor violations for response steering and account actions, while human review and CSAM hash matching support enforcement. Ongoing analysis uses privacy-preserving topic clusters, hierarchical summarization, and threat intelligence to identify aggregate misuse and novel attacks.


### [Bug Bounties and Black Swans: How Heroku Expects the Unexpectable](https://yomu.fyi/post/bug-bounties-and-black-swans-how-heroku-expects-the-unexpectable.md)
- Company: [Heroku](https://yomu.fyi/company/heroku.md)
- Author: Wade
- Published: Mar 26, 2019
- Type: Explainer

Heroku frames security as an engineering discipline that must challenge happy-path assumptions, test continuously, and prepare for low-predictability, high-consequence “black swan” events. Its threat-modeling guidance focuses on challenging defaults, recognizing that attackers have resources and organizational support, and planning for unexpected failures such as a zero-day exploit. A control-plane instrument for Heroku Postgres detected privilege escalation to a superuser role, and the Data team isolated the instance within 17 minutes while investigating the activity. The event was traced to researcher Andrew Krasichkov (“buglloc”), whose testing exposed a vulnerability in the dblink and postgres\_fdw extensions. Through the Bugcrowd bug bounty program, Heroku worked with him to understand the issue, reward the finding, and defend against the previously unknown flaw before a patch was available.