How Feedly vets CTI sources using Cyber Source Rank

BLUF

Feedly's Cyber Source Rank, (or citation-based algorithm) works like academic citations. A source earns standing when other credible cybersecurity sources cite it, and its standing is continuously recalculated as citation behavior shifts.

The gap-and-noise problem

There are two main problems with CTI source coverage. The first is gaps. Missing a vendor advisory, an analyst report, or a regional CERT that holds the most relevant context on a threat. The second is noise. Pulling in so many low-quality feeds that signal drowns in repetition and low-effort aggregation.

Feedly's source layer is designed to handle both. It currently monitors more than 5,000 sources, built through three mechanisms: collective discovery, manual augmentation, and a citation-based ranking system that shapes how much weight each source carries when the AI generates an answer.

Step 1: collective intelligence as the discovery engine

Feedly started as a reader used by millions of people to follow the open web. That history is the foundation of the source layer.

Any public feed that a Feedly user follows enters Feedly's database. Across a user base that includes CTI analysts, security researchers, and threat intelligence teams, this creates a continuously updated map of what the CTI community is actually reading. The collective behavior of the platform acts as a distributed discovery engine, surfacing sources that matter before any individual team would find them through manual search.

This also means coverage is broad by default. The source database spans vendor advisory feeds, government and CERT bulletins, threat-actor tracking blogs, news and media, and sector-specific publications. The reading behavior of the platform's analyst community determines what counts.

Step 2: manual augmentation for sources without native feeds

Collective discovery covers machine-readable feed sources the community follows.

Some of the most authoritative CTI sources publish advisories on web pages with no RSS or Atom feed, they require active monitoring rather than passive subscription. For these sources, Feedly’s team builds and maintains custom scrapers and parsers.

When an important source has no native feed, the engineering team creates one, so coverage does not have a gap.

Step 3: ranking by manual curation and citation

A large source database is only useful if the best sources rise. Feedly ranks its sources through two mechanisms that work together.

Manual curation by CTI experts

The first pass is human. Feedly's team evaluates sources against a set of editorial criteria: does it produce original analysis, or aggregate others' work? Does it maintain consistent publishing quality? Does it cover a specific sector, actor type, or technique that fills a real gap? Sources that pass this review enter a curated tier that carries explicit weight in retrieval.

Manual curation sets the baseline. It catches sources that a purely automated system would undervalue.

Cyber Source Rank

The second mechanism is citation-based. Cyber Source Rank adapts the logic of academic citation to the CTI source graph. For example, a source gains standing when other credible sources reference it, and a reference from a high-authority source carries more weight than one from a low-signal blog.

Feedly recalculates these scores continuously. The algorithm propagates credibility through the citation network until scores settle, producing a ranking that reflects the collective judgment of the CTI publishing community rather than any single editorial decision.

The two mechanisms are complementary. Manual curation handles sources that citation patterns alone would miss. Cyber Source Rank handles the long tail of sources where human review at scale is not feasible, and it updates automatically as the community's citation behavior shifts.

How source rank influences AI-generated answers

Source ranking is one of the retrieval signals that the Threat Context Engine uses when generating answers to analyst queries.

When a query arrives, Feedly does not return an undifferentiated list of matching articles. Source Ranking runs alongside Elastic Search, Vector Search, the Threat Graph, Temporal Signal, Clustering, and the Organization Profile. Articles from high-authority sources are weighted more heavily in retrieval. When the AI synthesizes an answer, it reasons over a context window that has already been filtered and ranked for credibility, not one assembled from whatever the open web surfaces first.

The practical effect is that authoritative reporting rises into the answer, and lower-signal coverage does not dilute it. An analyst asking about a ransomware actor gets an answer grounded in the sources the CTI community actually trusts, with citations back to the original articles.