Hourly or daily

Get alerts about security issues that affect you

When a serious vulnerability is published for software you use, your security channel hears about it the same hour.

Runs: Hourly or daily
Apps: Slack
AI: Optional
Access: chat:write

Send this to your assistant

Create a ClickRuntime automation: every hour, check the CISA list of actively exploited vulnerabilities and post any new ones that mention Microsoft, Fortinet or Atlassian to #security.

Paste it into your assistant. It tells you what it will send or change before it runs live.

Add to ChatGPT Add to Claude

First time? Adding ClickRuntime to your assistant takes about two minutes.

Why use it

Why teams use this automation

A new critical CVE is published for software you run, a staff email address appears in a breach database, or an IP address from your range lands on a blocklist. Each of these is public information, available from CISA, Have I Been Pwned, AbuseIPDB and certificate transparency logs. Yet small security and IT teams have no time to check them every day, so exposure is discovered weeks later, often because a customer or an email bounce points it out.

On the hourly or daily schedule you pick, ClickRuntime fetches the public feeds, keeps only items it has not shown before that match your watch list of products, domains and IP addresses, can ask its built-in AI to rate severity, and posts what is new to your security channel. Everything else is ignored.

IT admins, small SaaS companies and managed service providers get the most from a short, focused watch list.

What you get out of it

Exploited vulnerabilities reach you quickly
A new entry in CISA's Known Exploited Vulnerabilities catalog for software you use is a reason to patch this week. Hearing about it the same day shortens the time attackers have to use it against you.
Breached accounts are found early
If staff email addresses appear in a new breach, you can force password resets and enable multi-factor authentication before stolen credentials are tried against your systems, which is how many account takeovers begin.
Blocklist problems are noticed
When one of your sending IPs lands on a blocklist, email delivery quietly degrades. An alert lets you investigate the cause and request removal, instead of finding out through unexplained bounce rates and angry sales reps.
Rogue certificates are spotted
Certificate transparency logs reveal certificates issued for your domain. An unexpected one can mean a misconfigured service or a phishing site, and an early alert gives you time to respond.
Security work is documented
Each alert and the follow-up in the channel create a time-stamped record of when you learned about an issue and what you did, which helps with insurance questionnaires and customer security reviews.

How it works

What happens, step by step

Every hour or every day, ClickRuntime downloads the public list of security flaws that attackers are actively using.
It keeps only flaws in products from the vendors you care about, such as Microsoft or Fortinet.
It skips any flaw it has already told you about.
New ones are posted to your Slack security channel with the product, a short description and the date a fix is due.

Before it runs live

Connect Slack, then invite the app to the channel (type /invite @ClickRuntime there)

What you get

RunsHourly or daily

Get alerts about security issues that affect youtoday, 9:00Succeeded

Slack · #securityNew actively exploited vulnerabilities: • CVE-2026-21410 Fortinet FortiOS: Heap overflow in SSL VPN (fix by 2026-11-07)

Build your own

Need it to work differently?

This template is a starting point. Copy the prompt and change it, or describe a different automation from scratch, with your own conditions, more apps or an AI step. Your assistant writes it, tests it and runs it on ClickRuntime.

Your own rules
Conditions, thresholds, filters and exceptions, written the way you'd explain them to a colleague.
Any number of apps
One automation can read from one app and update several others. Over 248 apps are ready, and anything with an API works too.
AI where it helps
Summaries, classification, extraction and drafts use ClickRuntime's built-in AI, with no extra key.
On a schedule or on each event
Runs as often as every 5 minutes, or the moment an app sends an event, and keeps track of what it already handled.

Changes you can ask for

Run it at a different time, more or less often, or only on weekdays
Change what the AI looks for, or how it writes the result
Add another app, for example also send it to Google Sheets
Combine it with other Slack steps into one automation

Under the hood

The code that runs this automation

This is the Python script that runs each time the automation starts. Your AI assistant writes it for you when you send the prompt, and you allow each step in your assistant. To change how the automation works, describe the change to your assistant and it updates the script for you. For every function it can use, see the script reference.

security_feed_and_exposure_alerts.pyexample

from clickruntime import on_trigger, state, http, notify

KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
VENDORS = ("microsoft", "fortinet", "atlassian")

@on_trigger
def run(event):
    vulns = http.get(KEV_URL).json()["vulnerabilities"]
    seen = set(state.get("seen") or [])
    lines = []
    for v in vulns:
        if v["cveID"] in seen or v["vendorProject"].lower() not in VENDORS:
            continue
        lines.append(f"• {v['cveID']} {v['vendorProject']} {v['product']}: {v['vulnerabilityName']} (fix by {v['dueDate']})")
        seen.add(v["cveID"])
    if lines and state.get("seen") is not None:
        notify.slack("New actively exploited vulnerabilities:\n" + "\n".join(lines), channel="#security")
    state.set("seen", sorted(seen))
    return {"new": len(lines)}

FAQ

Common questions

Which feeds can it watch?

It works with public feeds and APIs such as CISA's Known Exploited Vulnerabilities list, Have I Been Pwned, AbuseIPDB and certificate transparency search. Some services require an API key, which is stored as a secret rather than in plain text.

How does the watch list work?

You list the product names, domains, email domains or IP ranges you care about. Items that do not mention any of them are dropped, so you are not shown every CVE ever published, only ones that touch your own stack.

Does the AI severity rating replace a proper assessment?

No. It gives a quick first read on how urgent an item looks, helping you order the work. Real decisions should rely on the vendor advisory and your own environment, and the post always links to the original source.

What permissions does it need?

chat:write. Nothing else in your accounts is used.

Does it need AI?

No, but you can ask for an AI step (for example a summary). It then uses ClickRuntime's built-in AI allowance.

How many runs does it use?

One run each time it runs (hourly or daily). Checks that find nothing to do and stop right away aren't counted.

Can I change how it works?

Yes. Describe the change to your AI assistant, for example a different schedule, channel or filter. It updates the automation, tests it and tells you what changed.

Daily