Threat-Rank

threat-rank

# ThreatRank

**ThreatRank** is a decentralized, real-time threat intelligence system focused on modern security issues — 
not just software bugs, but SaaS misconfigurations, exposed credentials, and identity-driven exploits.

## Why?

I've been thinking about a more dynamic, more advanced threat database  
that focuses on real-time threats that are not specifically linked to a bug in software,  
but can be linked to SaaS misconfiguration, or other mistakes and vulnerabilities that may not be direct or obvious.

An example is an active phishing exploit going on with a famous email provider — with account takeovers via weak MFA or API keys.

Indicators of compromise are easy enough to build for this one, but CVE is not applicable.  
There are many other examples of various threats.

Having real-time data of what's being exploited — by scanners, industry researchers, and participating defenders — 
would be helpful to everyone.

And then I heard the news that the CVE system itself was on shaky ground.

That led me to the following kernel of an idea:

## The Idea

**Build a decentralized system for submitting, timestamping, and validating real-world threat reports** —  
where researchers and security teams push high-level reports to a distributed backend (via IPFS),  
and the community votes to promote accurate, high-impact threats while suppressing spam or low-signal noise.

## How It Works

Threat submissions are:

- Stored on IPFS and indexed via a public ledger (e.g., Hedera)  
- Timestamped immutably for transparency and attribution  
- Voted on by pseudonymous peers to signal credibility and relevance  
- Scored dynamically, with greater weight from contributors with higher reputation  
- Reports that receive positive validation — especially from reputable participants or marked as actively exploited — rise in visibility  
- Spam reports or low-quality content are downvoted and deprioritized by design  

## The Result

The system becomes a **living, trust-weighted feed of current threats** —  
driven by global collaboration, governed by verifiable reputation, and resistant to noise.