Skip to content
T threat.cafe

· Margot Reyes (editorial persona) · Intel commons after NVD · on threat.cafe

The intel commons is rationed: what abuse.ch, VirusTotal, NVD and MS-ISAC changes mean for teams built on free

Free threat intelligence is still mostly free of charge, but it is no longer free of conditions. Between 18 November 2024 and 15 April 2026, abuse.ch made API authentication mandatory, VirusTotal put its paid entry tier at $5,000 and labelled it non-commercial, MS-ISAC moved to paid membership, and NIST stopped trying to enrich every CVE in the NVD. A team that built its pipeline on these sources in 2023 now carries four new costs: keys to manage, terms to check, budget lines, and fallbacks for data that no longer arrives.

The headline number is four sources in seventeen months

Four changes, seventeen months apart at the extremes. Each was announced separately, by a different organisation, for a different reason. No single announcement looks large. Together they change what "free" means for a team of three analysts.

The usable figure is narrower than the headline. Not every change costs money. Two cost an account and a terms review. One costs money for one audience. One costs data.

The dated change log

DATE         SOURCE      CHANGE                                    WHAT IT COSTS YOU
-----------  ----------  ----------------------------------------  -------------------------
2024-11-18   abuse.ch    Announced: API data downloads need        Account + key per
                         authentication; unauthenticated rates     integration
                         limited
2025-02      abuse.ch    MalwareBazaar and YARAify hunting         Account
                         requires authentication
2025-06-30   abuse.ch    Authentication mandatory                  Broken unauthenticated
                                                                   scripts
2025-09-30   MS-ISAC     CISA cooperative agreement expired;       Membership fee for
                         move to paid membership                   eligible SLTT bodies
2025-10-08   VirusTotal  New tiers: Community, Contributor,        Licence review; $5k+
                         Lite (non-commercial, from $5k),          for private API use
                         Duet
2026-04-15   NIST NVD    Risk-based enrichment; older backlog      Missing CVSS/CPE/CWE on
                         moved to "Not Scheduled"                  most CVEs
-----------  ----------  ----------------------------------------  -------------------------

What each change actually says

abuse.ch: authentication, because a few users took everything

abuse.ch runs community platforms including URLhaus, MalwareBazaar and YARAify. Its November 2024 announcement set the timeline: authentication required for API data downloads, hunting functions behind login from February 2025, and "Starting June 30, 2025, authentication will be mandatory."

The stated reason is load, not revenue. The platforms were often unresponsive, and abuse.ch said this was "almost entirely caused by a small percent of overall users," who are "typically from those who share nothing back." The post gives no usage figures. Its only number is a community "now 15,000 strong."

Getting a key is free: sign in at auth.abuse.ch with two identity providers and create an Auth-Key. The post says nothing about commercial use. That question sits in the linked terms of use, which each team has to read itself.

VirusTotal: four tiers and a non-commercial label

On 8 October 2025, VirusTotal announced four access tiers. VT Community stays free for "individual researchers, academics, and educators," with public API access. VT Lite is aimed at small teams, startups, small MSSPs and SMBs, starts "from $5k for low API volumes," and is labelled non-commercial. VT Duet, for large organisations, is priced by affiliates covered and contribution level.

Two details matter for small teams. First, the post gives no numeric API quotas and no effective date. Second, it lists small MSSPs as a Lite audience while labelling the tier non-commercial. A managed service provider using Lite to serve paying clients should ask VirusTotal in writing whether that use is covered.

The post also states that "security vendors who do not contribute detections are not included in these tiers."

MS-ISAC: from funded to paid

The Multi-State Information Sharing and Analysis Center served "more than 18,000 state, local, tribal, and territorial organizations," according to a Cloud Security Alliance research note. The note says MS-ISAC "lost its CISA cooperative agreement on September 30, 2025, and has since transitioned to a paid membership model," with the lowest tier, for organisations with annual budgets under $25 million, at $1,495 a year. It adds that the State and Local Cybersecurity Grant Program has been barred from covering the fee.

Treat the price as reported, not confirmed. CSA attributes it to the Center for Internet Security, but the CIS subscription page read on 15 October 2026 lists no prices. That page does confirm one free option remains: anyone can subscribe to MS-ISAC advisories on known vulnerabilities.

NVD: enrichment by priority

On 15 April 2026, NIST announced that the NVD would enrich three groups of CVEs first: those in CISA's Known Exploited Vulnerabilities catalog, those in software used by the federal government, and critical software as defined under Executive Order 14028. KEV entries get a target of "within one business day of receipt." Backlogged CVEs published before 1 March 2026 moved to "Not Scheduled." NIST will also stop routinely issuing its own severity score when the CVE Numbering Authority has supplied one.

The denominators explain why. NIST says CVE submissions rose 263% from 2020 to 2025, and that it enriched nearly 42,000 CVEs in 2025, 45% more than any prior year.

CSA's analysis of the change puts the backlog moved to "Not Scheduled" at about 29,000 CVEs. It estimates the three priority groups cover 15% to 20% of annual CVE volume. Both are CSA's figures, not NIST's. The NVD still lists every CVE. What changes is how many arrive with CVSS, CPE and CWE data attached.

Competing explanations

It is tempting to read this as one trend: the commons is being monetised. The evidence supports a narrower reading.

Load. abuse.ch cites unresponsive platforms caused by heavy non-contributing users.

Contribution. VirusTotal ties access to whether vendors contribute detections.

Funding. MS-ISAC's change follows the end of a federal cooperative agreement.

Volume. NVD cites a 263% rise in submissions.

Only one of the four is a new price for most readers. The shared cause is that each source was subsidising heavy users who gave nothing back, and each found a different way to stop.

Methodology and limits

The change log uses each source's own announcement where one exists. The MS-ISAC price and the NVD backlog and coverage percentages come from CSA research notes and are labelled as such. Terms change; every entry carries the date it was read. Nothing here covers OSV, the GitHub Advisory Database, or CISA's KEV catalog. CSA described KEV in April 2026 as "one of CISA's most consistently maintained outputs," with no reported change.

This article is general information, not legal advice. Licensing questions about commercial use belong with your counsel and each provider's current terms.

The dependency audit

Run this once, then every six months. One row per integration, not per source, because one source may feed three tools.

INTEGRATION AUDIT SHEET
------------------------------------------------------------------
source / endpoint          e.g. URLhaus API, VT public API, NVD API
used by                    tool, script or pipeline name
auth method                none / key / OAuth; key owner by name
key stored where           vault path, not a laptop file
terms last read            date + URL of terms page
commercial use?            allowed / not allowed / asked in writing
fields you depend on       e.g. CVSS, CPE, detections, payload
fallback if it stops       second source for the same field
contribution back          what you send upstream, if anything
------------------------------------------------------------------

Three rows usually fail first. A script with no key that worked until mid-2025. A VirusTotal integration nobody re-read after October 2025. A scanner or SIEM that pulls CVSS straight from NVD and now shows blanks. CSA's NVD note recommends asking vendors whether supplemental enrichment is active, and treating KEV as a primary input.

How to give back

The sources changed because of users who took without contributing. The cheapest way to keep access is to stop being that user.

  • abuse.ch: submit samples and URLs. Uploads already required authentication, and top contributors are invited to a closed channel.
  • VirusTotal: vendors with detection engines can apply to the Contributor tier, which the post says ensures "continuous access to VT feeds."
  • NVD: request enrichment of a specific CVE you depend on by email to [email protected], as NIST's announcement describes.
  • Budget: where a source offers paid access that matches your use, budget for it before an integration breaks, not after.

Decision consequences

The finding would be wrong if a team audited its pipelines and found no broken calls, no unread terms, and no missing enrichment. Run the audit and see. The more likely result is one silent failure and one terms question per source.

threat.cafe credits and plans to fund the open sources its list relies on; the threat.cafe home page sets out that commitment.

Sources

#threat-intelligence #nvd #virustotal #abuse-ch #ms-isac

All posts