# Platform features | Precursor Intelligence

> Precursor Intelligence is a threat and vulnerability intelligence platform you use in your browser. It finds what your business has open to the internet, watches for lookalike websites using your name, and checks the software you run for known flaws, scoring each one from 0 to 100 so you fix the riskiest first. Nothing to install. Free to start, no card.

Canonical page: https://www.precursorintelligence.com/features
Pricing: https://www.precursorintelligence.com/pricing · Start free: https://www.precursorintelligence.com/register · Book a demo: https://www.precursorintelligence.com/contact

Example data on this page uses the fictional company Acme (acme.co.uk).

## Contents

1. Find what you have online: [Attack surface](#what-do-we-have-open-to-the-internet), [Exposed passwords](#have-any-staff-logins-leaked), [Brand protection](#is-anyone-pretending-to-be-us)
2. Fix the right things first: [Risk ranking](#which-flaws-should-we-fix-first), [AI action plans](#what-exactly-should-we-do), [Software supply chain](#is-there-bad-code-in-what-we-build)
3. Stay ahead: [Threat intelligence](#who-is-targeting-businesses-like-yours), [Alerts and reports](#how-will-we-hear-about-problems), [API and MCP server](#can-i-use-it-from-my-own-tools)
4. [How it works](#how-does-it-work-day-to-day)

## What do we have open to the internet?

**Attack surface.** Give us your domain and we map everything of yours anyone online can reach. Run it again later and we show you exactly what changed in between.

- Subdomains, hosts, IP addresses and network ranges, plus DNS records, open ports and the services running on them.
- Known flaws on those services and SSL certificates, grouped into findings for each host, with a network map.
- Compare any two scans to see what appeared or closed, and export either as a PDF.
- You start each scan, whenever you like. It maps what is exposed; it does not attack anything.

**Cost:** scans come with a paid plan, and running one costs no credits. Unlocking its results uses credits.

## Have any staff logins leaked?

**Exposed passwords.** Each scan checks for email addresses on your domain that appear in other companies' data breaches, so you know which people need a new password.

- Every affected address, with how many leaked records, how many people and which breaches they came from.
- How many leaked passwords are readable, so you can start with the accounts most at risk.
- We never display the passwords themselves.
- Checked each time you run a scan, not continuously.

**Cost:** revealing the credential records on a scan uses credits.

## Is anyone pretending to be us?

**Brand protection.** Scammers register web addresses that look like yours to fool your customers and staff. We keep looking for them and tell you as soon as a new one appears.

- Typos, swapped or lookalike characters and added words, watched continuously for each domain you add.
- Whether each lookalike is registered and can receive email, and how it changes over time.
- Alerts for new lookalikes and for changes to the ones we already know about.
- A warning before your own SSL certificates expire, so you can renew in time.

**Cost:** uses credits for each domain you watch. The first day of your first domain is free.

## Which flaws should we fix first?

**Risk ranking.** Every one of over 400,000 published flaws (CVEs) gets a risk score from 0 to 100, kept up to date as the evidence changes. Yours are the ones in software you told us you use, ranked riskiest first.

The score considers four things, from the one that counts most to the ones that count less:

| Part | How much it counts |
|---|---|
| Evidence it is being exploited | The biggest factor |
| How severe it is | A strong factor |
| How widely exposed it is | A smaller factor |
| Threat activity (groups and industries linked to it, rising likelihood) | A smaller factor |

- Bands: 85 and over Critical, 70 to 84 High, 40 to 69 Medium, 20 to 39 Low, 0 to 19 Info.
- Anything confirmed exploited is always marked "Emergency patch", whatever its score.
- Under 1% of flaws score Critical, and only observed or confirmed exploitation can put one there. A group merely being reported to use a flaw cannot make it Critical on its own.
- Only flaws that affect you: pick your software from a list, or let us read it from your website in about 5 to 30 seconds and review the list before it is saved.

**Cost:** free. Tracking your software and seeing your ranked list costs no credits.

## What exactly should we do?

**AI action plans.** Turn your top risk-ranked flaws into a prioritised fix plan, ready to hand to whoever does the work.

- Built from up to 100 of your riskiest flaws, in the order they should be fixed.
- Written only from verified data in your account. The AI is never given anything typed into a box.
- Each plan is a dated snapshot you can export as a PDF. Your latest 25 plans stay available. It is a plan, not a task tracker.
- Your account data is stored in London.

**Cost:** each plan uses credits. Action plans come with every paid plan.

## Is there bad code in what we build?

**Software supply chain.** Upload or paste a dependency file and we check every package against known supply-chain incidents (hijacked or malicious packages).

- Supported files: package.json, package-lock.json, pnpm-lock.yaml, yarn.lock (npm) and requirements.txt (Python).
- Over 200 known incidents covering more than 5,000 packages.
- Saved files stay under watch, and you hear about it as soon as we spot a new incident affecting a package you use.

**Cost:** free. Lockfile checks never cost credits.

## Who is targeting businesses like yours?

**Threat intelligence.** A research library on the criminal and state-backed groups behind attacks: who they are, which industries they go after, how they get in and which flaws they use.

- Threat group profiles (over 900): aliases, origin, motivation, techniques, campaigns, linked flaws and industries. Every claim carries its evidence quote and source link. Each profile exports as a PDF dossier.
- Ransomware tracker: over 400 groups and over 30,000 victim claims from leak sites, by sector and country. Your dashboard shows which groups are hitting your sector.
- Map a threat report: paste a link to an attack write-up and get back the attacker techniques it describes (uses credits).
- Search known-bad IP addresses, domains, links and file fingerprints (over 350,000 indicators) and over a million malware samples.
- A catalogue of over 700 attacker techniques, tests for over 300 of them, and a steady stream of attack attempts recorded by internet sensors.

Much of this is public: browse [threat groups](https://www.precursorintelligence.com/threat-actors) or [search vulnerabilities](https://www.precursorintelligence.com/cve-search) without an account.

## How will we hear about problems?

**Alerts and reports.** We monitor continuously and tell you about anything new that affects you as soon as we spot it: by email, in the app, or into your own systems by webhook.

- We keep watching for newly published flaws, newly exploited ones and flaws whose likelihood of attack is rising, in the software you track.
- Keyword rules, such as a product and a version, catch flaws by name.
- One shared list of recipients for your organisation's alert emails.
- Webhooks send JSON to a web address you choose, with an optional secret header stored encrypted, and a test button.
- PDF reports made on demand: organisation report, risk register, action plan, scan results, scan comparison, threat group dossier and single-flaw report.

**Cost:** free. Alerts, webhooks and PDF exports cost no credits.

## Can I use it from my own tools?

**API and MCP server.** A REST API for scripts and security tools at `https://api.precursorintelligence.com/functions/v1/`, and an MCP server at `https://mcp.precursorintelligence.com` so AI assistants such as Claude and Cursor can answer questions about your estate with real data. One key works for both.

- Scoped keys: public intelligence by default; access to your organisation's own data is opt-in.
- Limit a key to set IP addresses and give it an expiry date. Only a hash of the secret is stored.
- 60 requests a minute per key on every paid plan. Successful calls use credits; checking account status is free.
- 71 MCP tools: 43 for public intelligence and 28 for your own vulnerabilities, scans, alerts and domains.
- Developer docs: https://docs.precursorintelligence.com

## How does it work day to day?

There is nothing to install on your computers or network. We work from public internet data, the software you tell us you use and any files you choose to upload.

1. **Tell us what to watch.** Add your domains and the software you run.
2. **Scan what you have online.** Start an attack surface scan when you choose. Running it is free; you unlock the results with credits.
3. **We watch and score.** We keep every known flaw scored and keep watching for lookalike domains, and we tell you as soon as we spot something that affects you.
4. **You fix what matters.** Work down one ranked list, turn it into an action plan, and share PDF reports.

How we look after your account and data:

- Two-step sign-in is mandatory for every account (authenticator app).
- Your organisation's data is stored in London, UK.
- Stored integration keys and webhook secrets are encrypted.
- Each organisation's data is kept separate from every other in the database.

## Questions

**Do I need to install anything?**
No. Precursor Intelligence runs in your web browser. We work from public internet data, the software you tell us you use and any files you choose to upload, so nothing goes on your computers or network.

**Does it scan my systems automatically?**
Attack surface scans run when you start them, so run one whenever you like. Lookalike domains and the risk score of every known flaw are monitored continuously without you doing anything.

**How quickly will I hear about a new problem?**
We monitor continuously, and as soon as we spot something new that affects you, we tell you by email, in the app and by webhook. Matches are gathered into one clear message rather than a stream of noise, and you hear nothing at all when there is nothing to report.

**Is any feature only on paid plans?**
Yes. Attack-surface scans, brand protection, AI action plans and the API and MCP server need a paid plan. The free plan gives you the full intelligence library, tracking for your own software and alerts about it. Every paid plan includes every feature, with credits that pay for the work.

**What does it connect to?**
A REST API for scripts and security tools, an MCP server for AI assistants such as Claude and Cursor, and webhooks that send JSON to a web address you choose. Brand protection alerts can also be formatted for Slack, Microsoft Teams, Splunk or Microsoft Sentinel. You can sync findings from Tenable Vulnerability Management and upload scan files from Nessus, Qualys, Rapid7, OpenVAS, Nmap, Nikto and OWASP ZAP. There are no ticketing or paging integrations.

**Can you see or show my staff passwords?**
The app never displays leaked passwords. It shows which staff email addresses appear in other companies' data breaches, how many records leaked and whether a password was readable, so those people can change it.

## Get started

- Start free (no card, unlimited team members): https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact