Cyber Security API

Get news about cyber crime and cyber warfare from /v1/cyber-security/news. Each article includes a cyber block with vulnerability IDs (CVEs), affected vendors and the highest severity score (CVSS) stated in the article. It also shows whether a mentioned vulnerability appears in CISA's Known Exploited Vulnerabilities (KEV) catalog. Other fields use the standard News API format.

What the Cyber Security API gives you

• A feed that is already filtered. Every article belongs to the IPTC category cyber crime (medtop:20000086) or cyber warfare (medtop:20001361). You do not have to write or maintain a keyword list.
• Vulnerability details per article. Read CVE IDs, KEV status, affected vendors and severity scores from cyber.cves, cyber.in_kev, cyber.vendors and cyber.cvss, without searching the article text yourself.
• The full News API filter set. Language, date range, source, title search, entities, sentiment, event types, sorting, pagination, facets, field selection and exports work exactly as on /v1/news/everything.

How the Cyber Security API selects articles

1. The feed includes cyber crime and cyber warfare articles. Use cyber.type to select one category, or omit it to get both.
2. Add language, date, source or other filters to narrow the feed. Even OR in a boolean query only matches articles within these two cyber categories.
3. Read cyber for vulnerability details. The CVE IDs come from the article's title, description or body. KEV status shows whether a mentioned vulnerability is known to have been used in real attacks.

Cyber Security API or /v1/news/everything?

Use /v1/cyber-security/news when you need security news and the vulnerability details. If you only need the articles, /v1/news/everything?category.id=medtop:20000086,medtop:20001361 returns a comparable selection without the cyber block.

	/v1/cyber-security/news	/v1/news/everything with cyber categories
Cyber crime and cyber warfare articles	Always, no extra parameters	Only with category.id
Pick one category	cyber.type=crime or cyber.type=warfare	category.id=medtop:20000086 or category.id=medtop:20001361
CVE IDs, KEV status, vendors, CVSS	In cyber on every article	Not returned
Cyber column in CSV, TSV, XLSX	Yes	No
Price	1 point per request	1 point per request

Coverage limits

• Only articles in the cyber crime or cyber warfare category appear in this feed. For broader security coverage, search /v1/news/everything by title for words such as ransomware or zero-day.
• CVE IDs must be written out. cyber.cves lists IDs in the CVE-YYYY-NNNN form found in the text. An article that only says "a critical Fortinet flaw" has an empty list.
• cyber.cvss is the highest score stated in the article. If the article gives no score, the field is null.
• cyber.vendors lists vendors for the article's CVEs that are in KEV. Other companies mentioned in the article do not appear in this field.

Pricing and plans

• A request that returns articles costs 1 point, the same as /v1/news/everything. A request that returns an empty page is not charged.
• The endpoint is available on every plan, including Free. Plan limits are the same as for /v1/news/everything: on Free, per_page is capped at 10, the article body is hidden and exports other than JSON are not available. See Rate limits and quotas.
• The prompt parameter works here too. It requires Basic or above and adds 2 points when the wording has not been parsed before.
• If your API key is restricted to specific endpoints, it needs the cyber_security_news scope. Unrestricted keys work as they are.

Next steps

• Quickstart — your first request and the fields to read.
• Filters — cyber.type and the News API filters that matter for security feeds.
• Response format — what each cyber field means.
• Use cases — exploited-vulnerability alerts, vendor watch, daily digests.
• API reference — the /v1/cyber-security/news endpoint, parameters and error codes.