# Where to track threats and incidents

By Ivo Donker · 7 November 2026 — written with AI assistance (Claude Opus 5.5); facts checked against the sources listed below

You don't need an expensive threat-intelligence service to know what's going on. Governments, universities and non-profits publish for free what is actively being exploited, how high the threat level is and which AI incidents have occurred. Below are the sources we use ourselves, organised by what you want to know. All links were checked on 7 November 2026.

## Netherlands: warnings and where to go

| Source | What you'll find there | For whom |
| --- | --- | --- |

| [NCSC (National Cyber Security Centre)](https://www.ncsc.nl/) | National Cyber Security Centre. Since 1 January 2026 merged with the Digital Trust Center into a single point of contact, also for SMEs. | Everyone, organisations |

| [NCSC security advisories](https://advisories.ncsc.nl/) | Advice per vulnerability with an assessment of likelihood and impact. Follow via RSS. | Homelab, IT, SaaS |

| [Cybersecurity outlook Netherlands](https://www.nctv.nl/onderwerpen/cybersecuritybeeld-nederland) | The annual threat outlook from NCTV and NCSC (2026 edition: AI accelerates and expands the threat). | Decision-makers, journalists |

| [Fraudehelpdesk (fraud helpdesk)](https://www.fraudehelpdesk.nl/) | Current warnings about scams, including voice and deepfake fraud, and a reporting point. | Everyone |

| [Safe Internet](https://veiliginternetten.nl/) | Information from the national government in plain language. | Everyone |

| [Safe Banking](https://www.veiligbankieren.nl/) | Information from the banks about bank fraud. | Everyone |

| [Politie (police)](https://www.politie.nl/) | Online reporting of (cyber)fraud. | Victims |

| [DIVD](https://www.divd.nl/) | Dutch Institute for Vulnerability Disclosure: volunteers who scan the internet and warn vulnerable organisations. Their [CSIRT page](https://csirt.divd.nl/) shows ongoing cases. | Homelab, IT |

| [Internet.nl](https://internet.nl/) | Free test of whether your website, email and connection use modern security standards. | Everyone with a domain |

## What is currently being exploited?

| Source | What you’ll find |
| --- | --- | --- |

| [CISA KEV-catalogus](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) | The US list of vulnerabilities that are demonstrably being actively exploited. Concise enough to track; the best priority list for patching. |

| [FIRST EPSS](https://www.first.org/epss/) | Daily probability that a vulnerability will be exploited within 30 days. Handy for sorting hundreds of “critical” alerts. |

| [EUVD (ENISA)](https://euvd.enisa.europa.eu/) | The European vulnerability database. |

| [NIST NVD](https://nvd.nist.gov/) | The US database of all CVEs and their scores. |

| [SANS Internet Storm Center](https://isc.sans.edu/) | Daily threat logs and the [Infocon threat level](https://isc.sans.edu/infocon.html) (green, amber, orange, red). |

| [Shadowserver](https://www.shadowserver.org/) | Scans the entire internet daily for vulnerable and exposed systems; network owners receive free notifications. The [dashboard](https://dashboard.shadowserver.org/) shows what is exposed per country. |

| [abuse.ch](https://abuse.ch/) | Open feeds of malicious URLs, malware and indicators (URLhaus, MalwareBazaar, ThreatFox). |

## Europe

- [ENISA Threat Landscape](https://www.enisa.europa.eu/topics/cyber-threats/threat-landscape): the annual European threat landscape, plus an outlook to 2030.

- [CERT-EU](https://cert.europa.eu/): threat reports and advice from the EU institutions’ CERT.

- [CERT-FR](https://www.cert.ssi.gouv.fr/): the French CERT, which in October 2026 warned about attacked cooling regulators.

## AI-specific: incidents and attack techniques

| Source | What you’ll find |
| --- | --- | --- |

| [AI Incident Database](https://incidentdatabase.ai/) | Searchable archive of reported AI incidents, from deep‑fake fraud to agents that went astray. Managed by the non‑profit Responsible AI Collaborative. |

| [MITRE ATLAS](https://atlas.mitre.org/) | Knowledge base of attack techniques against AI systems, the “ATT&CK for AI”. |

| [OWASP GenAI Security Project](https://genai.owasp.org/) | The Top‑10 lists for LLM and agent risks, with mitigations. |

| [AVID](https://avidml.org/) | Open database of vulnerabilities and failure cases of AI models. |

## Check yourself

- [Have I Been Pwned](https://haveibeenpwned.com/): Is your email address present in a data breach? (Private initiative by Troy Hunt, free for consumers.)

- [Internet.nl](https://internet.nl/): How modern is the security of your domain and email?

- Shadowserver notifications: if you have your own IP block or domain, sign up for the free reports on what is exposed externally.

## A routine that works

For home users, checking the Fraudehelpdesk (Fraud Help Desk) site once a month is sufficient. For a homelab: subscribe to the NCSC (National Cyber Security Centre) advice and check weekly whether anything from the KEV list is running on your systems. For a SaaS team, the KEV feed should be automatically incorporated into your vulnerability management, with a fixed remediation timeframe per severity; see [the minimum checks](https://cyber.llmnet.nl/en/bescherm-jezelf#saas). If you want to demonstrate why this matters: the [incidents of 2024–2026](https://cyber.llmnet.nl/en/incidenten) and the [outlook to 2030](https://cyber.llmnet.nl/en/vooruitblik-2030).

About “Cyberveilig Nederland”: this is an industry association of cybersecurity companies, not a government desk. Commercial sources are deliberately omitted from this list.