GreyNoise
A US security firm that watches internet-wide scanning traffic and publishes what attackers are probing for right now.
GreyNoise runs a large network of sensors that sit on the public internet doing nothing useful, which is exactly the point. Anything that connects to them is by definition scanning strangers, so the company can see which flaws attackers are hunting for at any given moment, and separate targeted attacks from the constant background noise the name refers to.
That vantage point makes GreyNoise one of the first places a new mass exploitation campaign becomes visible. In September 2026 it documented an attack in which a single person used hundreds of AI agents to exploit two flaws in PaperCut print software, compromising servers at 395 organisations across 48 countries.