HOW IT OPERATES
Three Actions.
Continuously running.
All the Time.
The Global Defender Exchange (GDX) operates as a community-driven system. Every defender both contributes to and benefits from collective threat intelligence sharing. The exchange is bi-directional, not one-way distribution. That’s how global defense scales.
Defenders flag what they see.
Something doesn’t look right. A defender notices, and their observation becomes the exchange’s awareness. Multiplied across 143+countries, that’s how patterns surface beforethey become breaches.
The exchange notices first.
When ransomware targets a hospital, a phishing wave hits a school district, a botnet probes a power grid, defenders inside the exchange seethe early signal and act on it together. Calibrated to their environment. Operationalized inside the tools they already use.
Threats stop before they land.
Every attack the exchange catches is one fewer person who has to learn what “compromised”feels like. Most people will never know they were protected. That’s the point. That’s the work. That’s the exchange.
The Exchange in Operation
Continuous threat exchange, made visible.
The Threat Matrix is a real-time read of the global defense exchange. As global defenders contribute signal across the system, correlated threat intensity is published back to every defender connected to it. Analyst-grade. High-confidence. Signal over noise.
1.2
M
Threats/Day
847
Active IOCs
99.7
%
Confidence
Who Runs the Exchange
Real people. Doing the quiet work.
The Global Defender Exchange runs because thousands of vetted defenders show up every day to do work that protects everyone else. Not visible. Not trying to be. But always there.
The Analyst
Watching the signals.
When patterns shift inside the noise, they’re the first to know. Calibrating, correlating, deciding what matters. Often at 3am. Often before anyone else has noticed anything is wrong.
- Caught a malicious certificate before it could be deployed against a critical infrastructure provider.
The Investigator
Tracing across continents.
Mapping the adversary’s moves. Following infrastructure from one shell company to the next, one hop to the next, until the picture is clear enough to give law enforcement atarget.
- Mapped the global command-and-control architecture of a ransomware operation across global internet infrastructure, contributing to coordinated indictments.
The CSIRT Lead
Coordinating when minutes matter.
Running response across timezones, languages, borders. Holding the line while infrastructure is contained, evidence is preserved, and the people they protect keep doing their work uninterrupted.
- Coordinated containment of a national-level breach in under twelve hours, with zero downtime for citizens.
The Engineer
Building defense at scale.
Writing the quiet code that runs in the background. Tools and pipelines that turn raw signal into protection for millions of people who’ll never see a single line of it.
- Shipped a detection pipeline that processed 94 million daily events across 50+ data types.
These are the people inside the exchange. The ones who make global defense something that actually happens, not just something that gets talked about.
Join Their Ranks →Threat Intelligence Tools
How the exchange shows up at scale.
These aren’t products in a catalog. They’re the operational threat intelligence tools defenders inside the exchange use to make global defense real for ISPs, CSIRTs, hosting providers, and the people who depend on them.
Every tool here exists because a defender needed it, built it, and contributed it back to the community. That’s how the work gets done.
Bogon, UTRS, Nimbus, MHR. Production-grade, community-driven threat intelligence tools, open to the global defender community. Same infrastructure powering 180+ CSIRT teams across 143+ countries. The point is to make the exchange operationally usable for any defender, at any scale.
Inside the Exchange
Bogon Networks
Continuously updated bogon reference defenders use to filter invalid IP space from network traffic. Used by ISPs, enterprises, and CSIRT teams worldwide as a baseline hygiene control.
- Real-time updates as IP space is allocated
- DNS, BGP, and routing registry options
- Used by thousands of networks globally
Inside the Exchange
UTRS 2.0
The Unwanted Traffic Removal Service connects 900+ cooperating networks for coordinated, defender-driven DDoS mitigation. Bi-directional by design, operationally simple.
- 900+ cooperating networks globally
- FlowSpec, IPv6, carpet bombing defense
- Coordinated defender response
Inside the Exchange
Nimbus
Near-real-time threat detection for ISPs and hosting providers. Correlates your network flows with 7M+ IP reputation indicators continuously updated by the exchange.
- NetFlow v5/v7/v9, IPFIX, sFlow, jFlow
- 10 preset Kibana dashboards
- Continuous monitoring and alerting
Inside the Exchange
MHR API
The Malware Hash Registry validates samples against 30+ AV databases plus the exchange’s own analysis engine. Integrated directly into defender tooling via REST API.
- 30+ AV databases cross-referenced
- Web portal and REST API access
- Used by researchers, hunters, IR teams
Built on the same Pure Signal™ infrastructure that powers Team Cymru’s commercial products. Operating inside the Global Defender Exchange for the global defender community.
Trust by designation.
Traffic Light Protocol RED is the highest tier of trust in the defender community. Information shared at TLP:RED stays inside the room it was shared in. No further distribution. No exceptions. Twenty years operating at this designation means we’ve built the discretion required to be trusted with what nobody else gets to see.
01 / Stays in the Room
Intelligence shared at TLP:RED never leaves the room.
Never repackaged into commercial products. Never publicly attributed without explicit clearance. Never surfaced in marketing material or case studies. The designation is the contract, and the contract is non-negotiable.
02 / Operational, Not Promotional
TLP:RED operations don’t become press releases.
We don’t ride the publicity of operations that didn’t end in public action. We don’t talk about cases that closed quietly. The work is the work, and most of it stays where it happened. By design.
03 / Discretion As Practice
National CSIRTs share with us what they can’t share publicly.
Investigators bring us active cases before charges drop. Disclosure laws prevent the same intelligence from reaching commercial vendors. That access is earned by twenty years of holding the line on what TLP:RED actually requires.
If your work depends on knowing your intelligence won’t surface in someone else’s marketing deck, you’re in the right exchange. The Global Defender Exchange operates at TLP:RED because the work that matters most can’t happen anywhere else.
WHEN RESPONSE IS THE ONLY THING THAT MATTERS
When minutes decide outcomes.
National response teams. Critical infrastructure defenders. Sector-specific CSIRTs. CAP is how vetted response teams enter the Global Defender Exchange at full participation, with premium intelligence access, dedicated researcher support, and a direct line into 180+ teams across 143+ countries when the situation calls for it.
A national CSIRT has twelve hours to contain a ransomware operation before public services start to fail.
A critical infrastructure team needs to know which IPs to block right now, not inthe next intelligence drop.
An investigator needs attribution before a window with international lawenforcement closes.
01
Premium Intelligence Access
Full access to enterprise-grade threat feeds and original Team Cymru research, calibrated for incident response work.
02
Dedicated Analyst Support
Direct line to threat researchers for complex investigations and case-specific guidance from the exchange.
03
Operational Response
When a major incident hits, the exchange mobilizes. Direct research erengagement, coordinated investigation, no commercial overhead.
04
Trusted Defender Community
Connect with fellow defenders worldwide for coordinated investigation, shared signal, and trusted exchange of intelligence.
180
+
CSIRT TEAMS IN EXCHANGE
143
+
Countries Connected
The Standing Commitment
When lives are on the line, the math changes.
We can’t make broad promises about what we’ll do for free, and we won’t pretend otherwise. But we can tell you what’s been true for twenty years: when threats put real people at risk, Team Cymru shows up. We share what we have. We coordinate where we can. We stand alongside the defenders carrying the weight, regardless of whether there’s a contract attached.
When ransomware targets a hospital.
When ransomware hits hospitals or pediatric care systems, we coordinate with the response teams handling them. Signal moves fast. Decisions get made in the same hour. The patients on the otherside of the network never need to know the .
When journalists and human rights workers are targeted.
Journalists. Human rights workers. The sources who trust them. Surveillance and disruption attempts against this work get our attention because the stakes aren’t theoretical. The exchange helps trace, attribute, and disrupt operations targeting people who don’t have institutional protection.
When small CSIRTs face nation-state threats.
When small CSIRTs in under-resourced regions facenation-state-grade threats, we don’t tell them to come back when they have a budget. We do what we can. Quietly, and now. The exchange exists for exactly these moments.
This isn’t charity. It’s purpose. The Global Defender Exchange exists because someone has to be the layer that doesn’t ask for paperwork before sharing what
matters. We’ve decided to be one of those someones.