Who Benefits From a Security Relationship With DugganUSA? Five Groups Who Do, Four Who Don't, and the Evidence You Can Check Live.
DugganUSA turns scattered public threat reporting into feeds and pre-install checks that a small team can use in minutes. It cites its sources, says what it does not know, and corrects itself in public. If that describes something you need, you can get a free API key in a minute. One key works for the feed, the API, the Jeevesus and Dredd MCP servers, Edge Shield and the Checks Action.
This post answers a plain question, who actually benefits, including who does not. The numbers in it are from November 3, 2026, and the live versions are on our About page, which fetches them from public endpoints each time it loads.
Who benefits
Small and mid-size defenders. A team with no threat-intel analyst gets one feed and a ten-minute Microsoft Sentinel connection, in place of reading dozens of advisories and writing the rules themselves. We ingested 4,186 indicators from 101 campaigns since September 1. They cited 79 different sources, and 82% were not IP addresses.
People building with AI agents. A check before a package, a GitHub Action or an MCP server is installed, with the evidence behind each verdict. The Checks Action is free.
Maintainers and researchers. We cite primary research by name, never relabel it as ours, and put its indicators where a defender can act on them.
People a breach lands on. When we cover a breach, we say what the organization has and has not told them, and what to do. Our posts on the Florida student financial aid breach and the Harvard alumni breach are examples.
Microsoft-stack shops. The feed connects to Sentinel through the built-in Threat Intelligence - TAXII connector. We ran the quickstart end to end in our own Sentinel workspace.
Who does not
Anyone who needs a SOC 2 report or another attestation. We have none and do not claim one.
Anyone who needs us to be first. Most of what we carry is other people's research and public feeds. When we claim a lead, we show both timestamps. Of 217 campaign indicators we already held before a report appeared, 213 came from third-party feeds, mostly ThreatFox.
Anyone buying custom work. We license data and automated checks. We do not sell hours.
Anyone who needs customer-outcome proof at scale. Most of the real blocks we have measured were on our own properties, as the evidence below shows.
What we get
People who use it, honest feedback when it is wrong, and the standing to keep publishing openly.
The evidence
All three come from public endpoints, and each has a limit.
Novelty. In a stratified sample of 468 indicators from our own sources, 464 were not in ThreatFox. It is one comparator and a sample.
Accuracy. Over a rolling 30 days we submitted 907 IP addresses to Spamhaus. It independently listed 574, rejected none of the ones it has reviewed, and 333 are still pending.
In use. In 30 days, 874 distinct indicators blocked real traffic. 32,421 of the 55,794 hits were on our own properties. The other 23,373 came from one outside consumer. We have shown the feed blocks real traffic. We have shown much less about what it does for customers.
What it looks like when we are wrong
This week our own canary recorded a legitimate crawler as a scanner at confidence 95. The crawler belongs to an MCP directory. It had fetched a decoy path that directories poll on purpose. Our edge then answered 403 on our real MCP manifest for four days. Cloudflare had listed it as a verified bot, and its address was the operator's own web host. We corrected the records, kept the evidence, added that crawler to the edge's verified-crawler list so it is exempt from decoys and blocks, and wrote this paragraph. The lesson for anyone running decoys is that one trap hit should not outrank an independent verification.
How to start
If you use Microsoft Sentinel, follow the ten-minute connection guide.
Building with agents? Add the free Checks Action to a repository, or point your agent at the Jeevesus and Dredd MCP servers.
Questions about limits, prices and what is free are answered in the FAQ on our About page, and the live prices are at analytics.dugganusa.com/api/v1/billing/prices.
Limits
These figures are from public endpoints as of November 3, 2026 and move weekly. The 4,186 indicators are the campaigns we chose to ingest, so the sample reflects our editorial choices. The reference-source count is a proxy. We have not measured how many outside consumers would block with the feed if they could. The evidence for customer benefit is thin, and we say so.
Five percent of this is wrong somewhere. It always is. The numbers will move again before you finish reading.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments