The IT Nerd

Team Cymru today announced Total Insights Feeds (TIF), a unified threat intelligence framework that redefines what a threat feed is, what it covers, and what security teams can do with it. This is not an incremental update to Team Cymru’s existing feed portfolio. It is a structural departure from the category those feeds helped define.

For more than two decades, threat intelligence feeds have operated on a shared assumption: compile lists of known-bad infrastructure, distribute them, and enable defenders to act. That model no longer reflects reality. Adversaries now rotate infrastructure at machine speed, operate across tens of millions of IPs, and weaponize domains at a scale legacy reputation feeds were never designed to track. The indicator list alone is no longer sufficient, creating an urgent need for a fundamentally new approach.

Total Insights Feed is that new model. The platform evaluates more than 57 million IPs and CIDRs daily with weighted 0–100 risk scoring, analyzes over 400 million domains including phishing, DGA infrastructure, and malicious hosting, and enriches each indicator with more than 2,000 contextual attributes spanning malware families, C2 frameworks, botnet membership, attribution, and kill-chain stage. This intelligence is delivered in a structured format that enables security operations centers to act automatically, eliminating reliance on manual triage.

The need for this shift is driven by a fundamental breakdown in both coverage and context. Modern adversaries build and abandon infrastructure within hours, while command-and-control networks span millions of IPs and phishing campaigns operate across hundreds of millions of domains. Even highly accurate feeds that track hundreds of thousands of indicators leave most of the active threat surface unaddressed. At the same time, binary malicious classifications fail to provide the context needed to determine response. At today’s scale and velocity, human-driven analysis cannot keep pace, creating a widening gap between detection and action.Total Insights Feed is designed to close both gaps simultaneously.

The following core capabilities are powered by Team Cymru’s global network visibility across more than 700 ISPs and operators:

• Surface Coverage: 57M+ IPs and CIDRs evaluated and risk-scored daily, covering the full routable internet, not a curated sample
• Machine-Actionable Scoring: Weighted 0–100 risk scores with decay modeling, enabling automated block policies at configurable thresholds without analyst review
• Domain Intelligence: 400M+ domains assessed daily, with 3.5M+ tagged malicious, including phishing infrastructure, algorithmically generated domains, and malicious hosting
• Deep Contextual Tagging: 2,000+ contextual tags per indicator spanning malware families, botnets, C2 frameworks, scanners, anonymization infrastructure, and hosting classification
• Live Analysis and Actor Attribution: Named actor and campaign associations where available, MITRE ATT&CK mapping, kill-chain stage, first and last observation, and external intelligence references
• Unified Integration Architecture: A single JSON schema compatible with SIEM, SOAR, XDR, and TIP platforms, one integration, operational on day one, no custom parsing required

Total Insights Feed is built on three interconnected intelligence layers that converge into a single data stream, enabling a level of telemetry and coverage not accessible through traditional collection methods. Organizations migrating from legacy feeds gain broader coverage, richer context, and real-time analysis while maintaining the high-fidelity data their operations depend on. Total Insights Feed is offered in tiered configurations, including a risk-scoring tier for IP and domain reputation, a tags and analysis tier for deep contextual intelligence, and a complete tier that unifies all capabilities into a single stream, replacing fragmented feed architectures with a single, machine-ready data source.

Availability

Total Insights Feed is available immediately. Existing customers of Team Cymru’s Controller Feed, Reputation Feed, and BARS architectures are fully supported within Total Insights Feed, with current intelligence preserved and expanded and can contact their Team Cymru account representative to discuss migration. New customers and media inquiries should contact sales@cymru.com or visit team-cymru.com.

The U.S. Environmental Protection Agency (EPA) has proposed $19.1 million in funding for its Information Security Program in fiscal year 2027, representing a $9.6 million increase over 2026 levels, to strengthen cybersecurity protections across water systems, support controls and secure implementation of emerging technologies, including AI.

The proposal would expand the EPA’s Drinking Water Infrastructure Resilience Grant Program to include dedicated cybersecurity funding, enabling water systems to upgrade infrastructure, improve defenses, and enhance operational resilience against cyber threats. The agency also plans to continue providing technical assistance and support to states, Tribes, and local utilities responsible for water system operations.

The initiative comes as federal agencies continue to identify cybersecurity vulnerabilities in water and wastewater systems, which rely on interconnected operational and IT environments. Is also comes after the WH’s proposed budget suggests slashing the EPA’s budget by 52%, to $4.2 billion.

Doc McConnell, Head of Policy and Compliance, Finite State:

   “We know that US critical infrastructure is a visible target for our adversaries. It shouldn’t be a soft target too. It’s reassuring to see that the EPA is planning greater investment in the resilience and cybersecurity of our drinking water, especially given recent announcements about Iran-affiliated cyber actors targeting our water sector.

   “I hope that Congress appreciates the urgency of this threat and understands that these types of investments are national security imperatives, not just for the water sector, but across all our critical infrastructure. Infrastructure operators across the country need additional resources to understand their risk, secure their systems, and respond quickly to incidents when they occur.”

Phil Wylie, Senior Consultant & Evangelist, Suzu Labs:

   “EPA is clearly signaling that water system cybersecurity is now a critical infrastructure priority, not just an IT concern. The proposed increase, especially with dedicated funding tied to drinking water resilience, is a meaningful step. But it comes against the backdrop of a significantly reduced overall EPA budget, so the real challenge will be whether utilities and states have the resources and operational capacity to translate that funding into measurable security improvements.”

Damon Small, Board of Directors, Xcape, Inc.:

   “The EPA’s proposed $19.1 million cybersecurity budget for FY 2027, a nearly 100% increase, is a drop in the bucket compared to the systemic vulnerability of U.S. water infrastructure, yet it signals a critical shift toward direct federal intervention. 

   “By attempting to embed cybersecurity funding into the Drinking Water Infrastructure Resilience Grant Program, the agency is finally moving past “voluntary guidance” to address the chronic underfunding of operational technology (OT) security in small and medium-sized utilities. However, this progress is threatened by a paradoxical White House proposal to slash the overall EPA budget by 52%.

   “A move that would likely gut the very personnel needed to oversee these new grants and technical assistance programs. For security leaders and utility executives, the immediate priority remains securing the IT/OT boundary and remediating default credentials on Internet-exposed controllers (PLCs), as geopolitical actors continue to exploit these low-hanging fruits.

   “Relying on federal grants that may be dead on arrival in Congress is not a strategy; instead, utilities must leverage existing State Revolving Funds (SRFs) and CISA’s local grant programs to harden assets before the 2027 fiscal cycle begins. All of this comes on the heels of reports that cyberattacks from the Middle East against US critical infrastructure are on the rise.

   “Asking the EPA to defend national water systems while cutting half its staff is like asking a lifeguard to watch the pool from the parking lot.”

Given how critical and vulnerable that this infrastructure is, they need this and more funding. Otherwise things could easily go sideways in terms of this infrastructure getting pwned by someone.