Everyone benchmarks CTI models the same way: a multiple-choice exam. GPT-5.4 gets 82%. Gemini 3.5 Flash gets 81.6%. Impressive, right up until you remember that no analyst's actual job is answering four-option questions about ATT&CK. So we handed those same models a real threat report and asked which techniques were in it. GPT-5.4 fell to 46.5. Gemini to 28.2. The quiz was never the job. We built BeyondCTI-27B for the job. On that same extraction task it scores 62.3, nearly 16 points ahead of GPT-5.4 and more than double Gemini, at 27B, open weights. It already runs inside our own pipeline, reading forums and leak sites at 4am so an analyst doesn't have to. Apache 2.0, on Hugging Face. Run it on your own reports and tell us where it breaks. Full writeup below.

CTI analysts, we see you. Twelve browser tabs, six forum logins, a Tor session that dies every twenty minutes, and a notes file called "final_final_v3.txt". That's the industry standard workflow for dark web monitoring in 2026, apparently. So we built the boring solution: one stream. 100+ dark web forums, onion sites included, scraped continuously into a single platform. Roughly a million raw threads so far, growing every hour. No logins, no Tor babysitting, no tab archaeology. You search, you read, you get on with your day. We're opening researcher access soon. Very few people collect at this scale, and fewer still let anyone else look at it. DMs are open.

Well, well, well. The public JSON formatter sites your developers paste production data into have been quietly publishing every paste for about seven years. Naturally, we read all seven years of it. 200,000+ documents. Cloud keys, SSH keys, payment API keys, whole tax returns with SSNs, people's full identities, bank balances. Nobody hacked anything. People pasted it in to make it look tidy, as you do. Full writeup below. Yes, it's as bad as it sounds.