Public Roadmap
Where We Are &
Where We're Going
Threatpedia is being built in the open. This roadmap tracks our progress from foundational content to a full-scale, peer-reviewed cyber threat encyclopedia.
How We Verify
Every article in Threatpedia carries a review status pill that tells you, at a glance, how much human verification has been applied. We publish early and iterate — nothing is hidden behind a certification gate. Here's what each status means:
AI Draft
Generated by an automated pipeline. Not yet reviewed by a human editor. Treat as a lead, not a source.
Human Draft
Written or significantly revised by a human contributor. Awaiting peer review.
Under Review
Actively being verified by an editor or peer reviewer. Facts and attribution may change.
Certified
Reviewed against Threatpedia's data standards: sources verified, attribution rated, MITRE-mapped. Safe to cite.
Disputed
A reviewer has flagged factual or interpretive concerns. Read with scrutiny.
Deprecated
Superseded by a newer article or removed from the active corpus. Kept for audit trail.
Articles also carry a confidence grade (A–F) reflecting source quality, attribution strength, and interpretive completeness. Together, review status and confidence grade let you calibrate trust at the article level without reading the whole archive.
✓ Complete
◉ In Progress
○ Planned
LivePhase 1 — FoundationQ1 2026
✓
Cybersecurity Glossary
1,045 terms with definitions, cross-references, and framework mappings. Searchable and browsable with role-based taxonomy filters.
✓
Threat Actor Registry
64 tracked APT groups and threat actors with attribution, affiliation, motivation, tools, and campaign history. Cross-vendor alias normalization.
✓
Incident Report Archive
110 documented security incidents with threat actor profiles, attack vectors, MITRE ATT&CK mapping, and impact analysis.
✓
Campaign Dossiers
32 ongoing multi-event operations and persistent threat campaigns — tracked with attribution, TTPs, related incidents, and timeline data.
✓
Zero-Day Exploit Registry
89 tracked zero-day vulnerabilities with CVEs, platform details, patch status, and links to related incidents and threat actors.
✓
Universal Site Search
Cross-index search across glossary, threat actors, campaigns, and incidents with keyboard navigation and categorized results.
✓
Live Incident Ticker
Scrolling marquee in the nav bar showing the latest incidents with severity-coded badges.
✓
Astro Static Site
Migrated from vanilla HTML to Astro 6 with content collections, Zod schema validation, and GitHub Pages deployment. Unified layout and component system.
BuildingPhase 2 — Pipeline & Soft LaunchQ2 2026
◉
Spec-Driven Content Pipeline
Rebuilding the article generation pipeline against a ratified spec suite — ingestion, source schema, editorial workflow, scraper contract, and coordination rules. Ensures every new article meets the DATA-STANDARDS v1.0 schema before publication.
◉
Automated Discovery Pipeline
High-trust feed ingestion and task creation across CISA KEV, NVD/CVE, CISA advisories, NCSC UK, vendor PSIRTs, and VulnCheck KEV prefills. Source packets and review gates remain the publication boundary; VulnCheck is first-class evidence but not official CISA KEV truth or a standalone drafting authority.
✓
Supply Chain Graph Surface
Static, corpus-driven Supply Chain section with 35 curated incidents, 227 validated relationships, a persistent graph hero, technique focus, dive-and-bloom, page-to-graph binding, incident propagation timelines, and graph search.
◉
MITRE ATT&CK v19 Refresh
ATT&CK Enterprise v19.0 data, schema checks, and validators are released. Corpus migration is still in progress; Defense Evasion split cases require article-supported review before reclassification.
◉
Framework Mapping Expansion
MITRE ATLAS is available as optional, evidence-gated framework mapping for adversarial AI/ML behavior. NIST CSF and Lockheed Martin Cyber Kill Chain are planned future integrations.
◉
Glossary-to-Report Auto-linking
Inline tooltips surfacing glossary definitions on hover throughout incident, campaign, and actor pages. Candidate-term pipeline already active; tooltip UI pending deployment.
◉
X/Twitter Syndication
Post-deploy share drafting for newly published incidents, campaigns, threat actors, and zero-days to @threatpedia. Live posting remains explicitly gated behind repository secrets and operator configuration.
○
Collection Index Filtering
Filter chips (sector, geography, attack type, severity), column sorting, and URL-parameter state across all collection index pages. Enables geography and sector-based navigation across the corpus.
○
Soft Launch
Public milestone: reliable article generation + X syndication live. Threatpedia begins publishing new threat intelligence at cadence, syndicated to the security community via X.
PlannedPhase 3 — Visualization & IntelligenceQ3 2026
○
Global Threat Map
Interactive world map showing threat actor origins, targets, and active campaigns. Real-time incident overlay with drill-down.
○
MITRE ATT&CK Navigator Integration
Visual technique heatmaps per threat actor and per incident, overlaid on the ATT&CK framework matrix.
○
Trend Analytics Dashboard
Time-series analysis of attack types, sectors targeted, geographies, and threat actor activity. Exportable charts and reports.
○
Threat Actor Lineage Graphs
Visual succession and heritage tracking for threat actors — e.g. Wizard Spider → Conti → Royal → Black Basta. Captures soft and hard splits, shared infrastructure, and tool inheritance.
○
Malware Family Registry
First-class entity type for malware families with variant tracking, hash storage (SHA-256), lineage/fork trees, and attribution chains to APTs and incidents. Seeded from Malpedia with curator enrichment.
○
Exploit & Zero-Day Visualization Layer
Interactive visualizations for exploit and zero-day intelligence: ATT&CK heatmaps per exploit family, timeline graphs, weaponization funnel charts, and patch adoption tracking.
○
Community Intelligence Aggregation
Inbound monitoring of threat intelligence from X/Twitter, RSS, and cybersecurity community channels — feeding leads into the discovery pipeline's scoring engine. Complements Phase 2's outbound X syndication.
FuturePhase 4 — Community & Hard LaunchQ4 2026 +
○
Contributor Portal
Submission interface for new incidents, corrections, and lead intake. GitHub OAuth login with MFA enforcement and role-based access. Contributors can claim articles from the review queue or submit leads (URLs, tips, observations) into the discovery pipeline.
○
Peer Review Workflow
Structured review and approval pipeline for AI-generated articles. Contributor accepts an article from the queue (72-hour claim window), submits structured verification, and signs off as reviewer of record. Multi-reviewer thresholds for certified status; full audit trail and version history.
○
Founding Member Program
Small cohort of vetted security professionals, researchers, and analysts — initially 2-3 trusted collaborators, growing to a broader editorial board. Contributor roles, recognition, and reviewed-by attribution on articles they certify.
○
API & Data Exports
Public REST API for programmatic access to threat intelligence data. Structured exports in STIX 2.1, CSV, and JSON formats. Rate-limited free tier plus programmatic bulk access for research use.
○
Hard Launch
Public milestone: contributor portal live, peer review battle-tested with founding members, historical backfill underway. Public call for volunteer reviewers and researchers. Threatpedia opens its doors as a community-curated encyclopedia.
Last updated: June 18, 2026 — This roadmap is a living document and subject to change.