PAGES
← all tools
◆ Attack Surface & Exposure Management

CybelAngel

[Beta] Attacker Techniques on Live Attacks commercial

CybelAngel is a digital risk protection platform that detects and remediates exposed data, credentials, and assets across the internet, dark web, and connected storage.

Summary

CybelAngel is a commercial digital risk protection platform that detects and remediates exposed data, credentials, and assets across the internet, dark web, and connected storage. Since its core functionality is described in the one-liner and no deployment mechanism or specific user group is noted, it operates as a platform for exposure management. The project has seen 15 releases within the tracked window.

CybelAngel is a digital risk protection platform that detects and remediates exposed data, credentials, and assets across the internet, dark web, and connected storage.

How CybelAngel helps

Which of our credentials are exposed on the open or dark web right now?

scans internet, dark web, and connected storage sources for leaked credentials tied to the organization and reports each one found, tying it back to where it surfaced

Which of our sensitive files have leaked onto storage we do not control?

continuously monitors connected storage and open repositories for documents matching the organization's data and flags each exposed file

Is a document we lost track of being traded or discussed on the dark web?

matches content and identifiers from internal files against dark web marketplaces and forums and surfaces any match found there

Which of these exposures actually need action, and which are noise?

classifies each detected exposure by the type of data and asset involved so remediation effort goes to the ones that matter

Has an exposed asset been dealt with, or is it still sitting out there?

tracks each finding through a remediation workflow so its current status is known rather than rediscovered from scratch

Are new leaks tied to us appearing since the last time we checked?

keeps scanning the same sources on an ongoing basis and reports newly surfaced exposures rather than only a one-time snapshot

all 11 features, with the evidence for each →

Languages

Not documented

Features

11 capabilities

Built from CybelAngel's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • CybelAngel covers 1 of the 13 network discovery and scanning capabilities we track.
  • CybelAngel covers 1 of the 8 vulnerability assessment methods capabilities we track.

What CybelAngel offers you

  • REST API1
All capabilities 11 capabilities
Live attack monitoring shipped Displays active attacker activity against targets in real time, including observed TTPs, methods, ports, paths, per-event timestamps, and 'New' badges to highlight the latest events. 3 releases · 1 other source

release

  • Live Attacks view now displays tactics, techniques, and procedures (TTPs) observed against each target, with a per-event timestamp showing how attacker activity builds over time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ [Beta] Attacker Techniques on Live Attacks · seen Oct 2026 · source · release history
  • Recent Live Attacks entries receive a New badge to make the latest attacker activity stand out in the list. [Beta] Attacker Techniques on Live Attacks · seen Oct 2026 · source · release history
  • Live Attacks surface now shows which methods, ports, and paths an attacker is testing against a target. [Beta] Attacker Techniques on Live Attacks · seen Oct 2026 · source · release history

example

  • Review attacker TTPs and the timeline of probing activity against an exposed asset before an attack completes, so your team can respond proactively. In CybelAngel, go to Live Attacks > select a target > review the Attacker Techniques panel showing observed tactics, techniques, procedures, ports, and paths with per-event timestamps. [Beta] Attacker Techniques on Live Attacks · seen Oct 2026 · source
Credential leak and infected machine analysis shipped Maps leaked credentials back to the infected machines that exposed them, providing per-machine credential details and leak-tracing metadata through a consolidated view that replaces manual CSV export workflows. 1 release · 1 other source

release

  • Adds Infected Machines View, a consolidated view that maps leaked credentials back to the infected machines that exposed them, including per-machine credential details and leak-tracing metadata — replacing manual CSV export workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ [Coming Q4] Infected Machines View · seen Oct 2026 · source · release history

example

  • When a new credential leak alert fires, use the Infected Machines View to immediately identify which machines are the source before routing to the remediation team — no CSV download or manual correlation required. In the CybelAngel console, navigate to Infected Machines View, select a leaked credential alert, and review the per-machine breakdown showing which credentials each machine exposed along with the… [Coming Q4] Infected Machines View · seen Oct 2026 · source
Dark web monitoring shipped Continuously ingests dark web intelligence matched to user-defined keywords and automatically surfaces relevant findings — including passwords, domains, and employee data — with plain-language explanations and attack scenario context. 2 releases

release

  • Automatically generates monitoring keywords on sign-up and surfaces findings covering passwords, domains, and employee data with plain-language explanations and attack scenario context. [Coming Q4] CybelAngel Starter, Open to All · seen Oct 2026 · source · release history
  • Adds continuous dark web intelligence ingestion matched to user-defined keywords, delivering relevant findings automatically as they appear.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ [Coming Q4] Dark Web Monitoring on Autopilot · seen Oct 2026 · source · release history
Ransomware and attacker claim tracking shipped Tracks claimed attacks published by threat actors, surfacing title, summary, and source link in the side panel and exposing those fields via the public API for downstream tooling. 2 releases

Also counts toward: REST API

release

  • Adds title, summary, and source link directly to the claimed attack side panel for at-a-glance assessment before escalation. [Beta] Richer Claimed Attack Details · seen Oct 2026 · source · release history
  • Exposes title, summary, and source fields for claimed attacks in the public API, giving downstream tools full claim context.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ [Beta] Richer Claimed Attack Details · seen Oct 2026 · source · release history
Brand and executive impersonation monitoring shipped Detects fraudulent social network and Telegram channels impersonating your brand or executives, generating actionable reports consistent with broader social network impersonation coverage. 1 release

release

  • Detects fraudulent Telegram channels impersonating your brand or executives, generating actionable reports consistent with existing social network impersonation coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ [Coming Q4] Telegram Impersonation Detection · seen Oct 2026 · source · release history
CISO executive dashboard shipped Provides a customizable executive view scoped to leadership indicators that can be shared with brand or legal teams while redacting dark web and credential data. 1 release

release

  • Introduces Custom CISO Dashboard with tailored executive views scoped to leadership indicators, shareable with brand or legal teams while redacting dark web and credential data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ [Coming Q4] Custom CISO Dashboard · seen Oct 2026 · source · release history
Cloud storage exposure detection shipped Detects exposed cloud storage buckets across AWS, Azure, Google Cloud, and S3-compatible providers including Scaleway, Linode, and IBM Cloud. 1 release

Shared capability: Attack surface inventory

release

  • Extends exposed cloud storage bucket detection beyond AWS, Azure, and Google Cloud to S3-compatible providers, starting with Scaleway, then Linode and IBM Cloud.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ [Coming Q4] More Cloud Storage Providers · seen Oct 2026 · source · release history
Expert escalation shipped Offers one-click access to a CybelAngel analyst directly from any finding for teams that need to escalate or investigate further. 1 release

release

  • Provides one-click access to a CybelAngel expert directly from any finding for teams that want to escalate or investigate further. [Coming Q4] CybelAngel Starter, Open to All · seen Oct 2026 · source · release history
Self-serve onboarding shipped Provides a Starter tier that lets users sign up with a business email — no credit card or demo required — and immediately see real exposure found on cybercriminal channels. 1 release

release

  • Adds a self-serve Starter tier — sign up with a business email, no credit card and no demo required, to immediately see real exposure found on cybercriminal channels.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ [Coming Q4] CybelAngel Starter, Open to All · seen Oct 2026 · source · release history
Vendor exposure monitoring shipped Surfaces attacker-channel claims targeting your suppliers so teams can assess impact and contact affected vendors before an incident propagates to the organization. 1 release

release

  • Adds Vendor Exposure Monitoring to surface attacker-channel claims targeting your suppliers, enabling impact assessment and supplier contact before an incident propagates to your organization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ [Coming Q4] Vendor Exposure Monitoring · seen Oct 2026 · source · release history
Vulnerability prioritization shipped Surfaces a prioritized list of actively-exploited CVEs in the Unified Threat Intelligence view, filtering out noise so teams can focus patching on vulnerabilities attackers are actually using. 1 release

Shared capability: Vulnerability prioritization

release

  • Adds a prioritized list of actively-exploited vulnerabilities to the Unified Threat Intelligence view, filtering out noise so teams can focus patching on CVEs attackers are actually using in their environment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ [Coming Q4] Unified TI View: Vulnerability Intelligence · seen Oct 2026 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Screenshots

From the release notes, newest first. Click one to see it full size.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface

Five scores for CybelAngel, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail CybelAngel puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Coverage

Missing something? Tell us

What CybelAngel connects to, runs on and detects, read from its release notes and docs. So far: 4 new detections, 1 new integration.

Show

5 changes, tracked since Oct 15, 2026.

  • Seen Oct 152026

    new Cybercriminal channel monitoring for passwords, domains, and employee data

    With employees

    Starter generates your monitoring keywords and shows the real exposure found on cybercriminal channels: passwords, domains, employees.

    [Coming Q4] CybelAngel Starter, Open to All Source ↗

  • Seen Oct 152026

    new Dark Web Monitoring on Autopilot

    Premium dark web intelligence will flow straight into the platform. It will be matched to your keywords continuously, with no manual watch in between. Coverage becomes faster and more consistent, and relevant findings reach you as soon as they appear.

    [Coming Q4] Dark Web Monitoring on Autopilot Source ↗

  • Seen Oct 152026

    new Exposed bucket detection for S3-compatible cloud storage providers

    With Scaleway, Linode, IBM Cloud

    Exposed bucket detection is going beyond AWS, Azure and Google Cloud. We are adding S3-compatible providers, starting with Scaleway, then Linode and IBM Cloud.

    [Coming Q4] More Cloud Storage Providers Source ↗

  • Seen Oct 152026

    new Telegram Impersonation Detection

    Fraudulent Telegram channels using your brand or your executives' names will be detected automatically. Each one becomes an actionable report, like impersonation on other social networks.

    [Coming Q4] Telegram Impersonation Detection Source ↗

  • Seen Oct 152026

    new Vendor Exposure Monitoring — attacker channel signal ingestion for supplier tracking

    With attacker channels

    We will connect what we see on attacker channels to the vendors you depend on.

    [Coming Q4] Vendor Exposure Monitoring Source ↗

How we count

Read from 9 of 10 release notes and docs updates we hold for CybelAngel. "First seen" is the earliest note that names something; "last" is the latest. Our history may start partway through CybelAngel's life, so an old integration can show a recent first-seen date.

Each change counts once: "added 40 checks" is one line, so the numbers measure how often coverage moves, not how big the catalogue is or how well it detects.

Releases

Coverage in all entries

10 entries

  1. October 202610
    Coverage in all entries

    10 entries

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →