# Breach Signal Radar - Security Incident Sales Triggers (`apricot_blackberry/breach-signal-radar`) Actor

Typed JSON trigger-event API for AI agents and sales pipelines: companies that just had a breach, SEC 8-K cybersecurity disclosure, ransomware event, or major outage. Discover, monitor, and full-history modes with severity, trigger score, and talk track. MCP-ready, no login.

- **URL**: https://apify.com/apricot\_blackberry/breach-signal-radar.md
- **Developed by:** [Creator Fusion](https://apify.com/apricot_blackberry) (community)
- **Categories:** Business, Lead generation, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per event

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Breach & Security Incident Sales Triggers — SEC 8-K, Ransomware News & Outage Lead Feed

Find the companies that just got hit. This actor turns SEC 8-K cybersecurity disclosures, vendor status-page incidents, and global breach news into a clean, ranked trigger-event feed for reps selling security, IT, compliance, backup, and incident-response products. Every run returns typed JSON rows — company, ticker, severity, trigger score, source link, and a ready-to-send talk track — schema below. The Apify Store lists exactly one other breach-trigger actor; this is the only one built on SEC Item 1.05 — the legally mandated disclosure that makes the signal authoritative instead of scraped-and-guessed.

A breach is the single strongest buying signal in security sales: budget is unlocked, the board is asking questions, and the buyer is actively shopping. This actor puts those accounts in your CRM the day the signal lands.

### Why agents use this actor

- **Deterministic typed output.** Every row matches the published dataset schema. Every field is nullable, so partial signals never break your pipeline.
- **Per-event pricing.** You pay per company-signal returned, so autonomous budgets are predictable before the run starts.
- **No auth, no cookies, no proxy required.** All four sources are public endpoints.
- **Clear error semantics.** Bad input fails fast with a descriptive message and exit code 1. A source that fails is recorded in the `SUMMARY` key-value record and the run continues on the remaining sources. Zero results is a hard failure, never a silent empty dataset.
- **Rate-limit handling built in.** SEC's required descriptive User-Agent, SEC request pacing, and GDELT's throttle window are all handled internally with backoff and retries.

### Data sources

| Source | Signal | Why it matters |
| --- | --- | --- |
| SEC EDGAR full-text search | Form 8-K **Item 1.05** material cybersecurity incident disclosures | The highest-authority signal that exists. US public companies are legally required to file it. Board-level, budgeted, dated. |
| Atlassian Statuspage feeds | Vendor incident feeds (`/api/v2/incidents.json`) across dozens of major SaaS vendors | Customer-visible outages — resilience and SLA conversations. |
| GDELT news index | Global breach/ransomware/data-leak coverage | Catches private companies that never file with the SEC. |
| Google News RSS | Second independent news source | Coverage depth and fresher publication times. |

### Modes

| Mode | What it does | Typical use |
| --- | --- | --- |
| `discover` | Finds any company with an incident in the lookback window across all enabled sources | Fill top of funnel with net-new accounts |
| `monitor` | Checks your named `companies` list for incidents in the window | Schedule daily against your target account list |
| `company-history` | Returns the full available incident history for the named companies | Account research before a call |

### Input schema

| Field | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `mode` | string enum | no | `discover` | `discover`, `monitor`, or `company-history` |
| `companies` | string\[] | required for `monitor` / `company-history` | `[]` | Company names and/or domains. A domain also unlocks that vendor's status-page feed. |
| `lookbackDays` | integer | no | `7` | Incident window in days. Ignored in `company-history`. |
| `sources` | string\[] | no | `["sec","statuspage","gdelt","google-news"]` | Which sources to query |
| `keywords` | string\[] | no | `[]` | Extra terms ANDed into news queries in `discover` mode (industry, region) |
| `minSeverity` | string enum | no | `low` | Drop rows below `low` / `medium` / `high` / `critical` |
| `statusPageDomains` | string\[] | no | `[]` | Override the built-in vendor status-page list |
| `fetchFilingExcerpts` | boolean | no | `true` | Fetch each 8-K and extract the Item 1.05 narrative into `excerpt` |
| `maxItems` | integer | no | `100` | Max rows returned, highest `triggerScore` first |

### Output schema

One row per company-incident, sorted by `triggerScore` descending. All fields nullable.

| Field | Type | Description |
| --- | --- | --- |
| `company` | string | null | Affected company name |
| `companyDomain` | string | null | Primary domain. Populated for status-page signals. |
| `ticker` | string | null | Stock ticker. SEC signals only. |
| `cik` | string | null | SEC Central Index Key. SEC signals only. |
| `signalType` | string | null | `sec-8k-cyber`, `outage`, `breach-news`, or `ransomware` |
| `severity` | string | null | `critical`, `high`, `medium`, `low` |
| `signalDate` | string | null | ISO 8601 incident timestamp |
| `headline` | string | null | One-line incident description |
| `excerpt` | string | null | Item 1.05 narrative (SEC) or latest status-page update. Null for news rows. |
| `sourceUrl` | string | null | Direct link to the filing, incident, or article |
| `sourceName` | string | null | Source label, e.g. `SEC EDGAR`, `Google News / BleepingComputer` |
| `recencyDays` | integer | null | Whole days since the incident |
| `triggerScore` | integer | null | 0-100 lead priority: source authority + severity + recency decay |
| `suggestedTalkTrack` | string | null | Dated opening line keyed to the signal type |
| `mode` | string | null | Run mode that produced the row |

#### Example — `sec-8k-cyber` row (real output)

```json
{
  "company": "AMGEN INC",
  "companyDomain": null,
  "ticker": "AMGN",
  "cik": "0000318154",
  "signalType": "sec-8k-cyber",
  "severity": "critical",
  "signalDate": "2026-07-31T00:00:00.000Z",
  "headline": "AMGEN INC filed an 8-K Item 1.05 material cybersecurity incident disclosure",
  "excerpt": "Item 1.05 Material Cybersecurity Incidents. In July 2026, Amgen Inc. (the \"Company\") identified unauthorized activity involving data stored in cloud environments hosted by third-party cloud service providers. Upon detecting the activity, the Company activated its cybersecurity response plan, implemented containment measures, and engaged independent cybersecurity forensic experts...",
  "sourceUrl": "https://www.sec.gov/Archives/edgar/data/318154/000031815426000119/amgn-20260729.htm",
  "sourceName": "SEC EDGAR",
  "recencyDays": 15,
  "triggerScore": 90,
  "suggestedTalkTrack": "AMGEN INC disclosed a material cybersecurity incident to the SEC on 2026-07-31 — board-level scrutiny and remediation budget are active now.",
  "mode": "discover"
}
```

#### Example — `outage` row

```json
{
  "company": "Snowflake",
  "companyDomain": "snowflake.com",
  "ticker": null,
  "cik": null,
  "signalType": "outage",
  "severity": "critical",
  "signalDate": "2026-08-14T17:29:49.607Z",
  "headline": "INC20000158",
  "excerpt": "This incident has been resolved. Customers may have experienced elevated error rates...",
  "sourceUrl": "https://stspg.io/4pz2gky6fxgz",
  "sourceName": "Atlassian Statuspage",
  "recencyDays": 1,
  "triggerScore": 84,
  "suggestedTalkTrack": "Snowflake posted a customer-visible service incident on 2026-08-14 — resilience, monitoring and SLA exposure are top of mind with their platform team.",
  "mode": "discover"
}
```

#### Example — `ransomware` news row

```json
{
  "company": "Texas Hearing Institute",
  "companyDomain": null,
  "ticker": null,
  "cik": null,
  "signalType": "ransomware",
  "severity": "high",
  "signalDate": "2026-08-14T12:20:27.000Z",
  "headline": "Texas Hearing Institute Ransomware Attack Affects 30,000 Patients",
  "excerpt": null,
  "sourceUrl": "https://news.google.com/rss/articles/CBMiqAFBVV95cUxPa3...",
  "sourceName": "Google News / HIPAA Journal",
  "recencyDays": 1,
  "triggerScore": 79,
  "suggestedTalkTrack": "Texas Hearing Institute was publicly linked to a ransomware event on 2026-08-14 — recovery, backup integrity and detection gaps are open agenda items this quarter.",
  "mode": "discover"
}
```

### Error semantics

- **Invalid `mode`, or `monitor`/`company-history` without `companies`** — the run fails immediately with exit code 1 and a message naming the missing field. Nothing is charged beyond `actor-start`.
- **A single source failing** — logged as a warning, recorded under `failures` in the `SUMMARY` key-value record, and the run continues with the remaining sources.
- **Zero results after filtering** — the run fails with exit code 1 and a message listing the mode, window, sources, and any source errors, so an agent can widen `lookbackDays`, lower `minSeverity`, or correct the company list and retry.
- **Per-row pushes.** Rows are pushed individually, so a run that fails late still leaves every row collected so far in the dataset.
- A machine-readable run summary is always written to the `SUMMARY` key-value store record: mode, window, per-source counts, pushed count, high-severity count, distinct companies, and failures.

### Use from AI agents (MCP)

```json
{
  "mcpServers": {
    "apify": {
      "url": "https://mcp.apify.com/?tools=apricot_blackberry/breach-signal-radar",
      "headers": { "Authorization": "Bearer <YOUR_APIFY_TOKEN>" }
    }
  }
}
```

Works in Claude, Cursor, ChatGPT deep research connectors, and any MCP client; the input schema above is the tool's parameter schema.

### Use from code

**curl**

```bash
curl -X POST "https://api.apify.com/v2/acts/apricot_blackberry~breach-signal-radar/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"mode":"discover","lookbackDays":90,"minSeverity":"medium","maxItems":50}'
```

**JavaScript**

```js
import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const run = await client.actor('apricot_blackberry/breach-signal-radar').call({
    mode: 'monitor',
    companies: ['Amgen', 'zoom.us', 'Navient'],
    lookbackDays: 30,
});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items.filter((i) => i.severity === 'critical'));
```

**Python**

```python
from apify_client import ApifyClient

client = ApifyClient("<YOUR_APIFY_TOKEN>")
run = client.actor("apricot_blackberry/breach-signal-radar").call(run_input={
    "mode": "discover",
    "lookbackDays": 90,
    "minSeverity": "high",
    "maxItems": 50,
})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item["company"], item["triggerScore"], item["suggestedTalkTrack"])
```

### Use from automation platforms

- **n8n / Make / Zapier** — use the native Apify integration, pick "Run Actor", and choose `breach-signal-radar` by name. Schedule `monitor` mode daily and route new rows straight into HubSpot, Salesforce, or Slack.
- **LangChain / LlamaIndex** — wrap it with the Apify Actor tool wrappers; the input schema becomes the tool signature.
- **Webhooks** — Apify webhooks can fire on run completion (`ACTOR.RUN.SUCCEEDED`, etc.), so you can trigger a downstream pipeline the moment a scheduled `monitor` run finishes instead of polling.
- **Apify Schedules** — run `monitor` every morning against your account list and let the completion webhook push fresh triggers to your CRM.

### Pricing

Pay per event. You are charged only for what a run actually produces.

| Event | When it fires |
| --- | --- |
| `actor-start` | Once per run |
| `company-signal` | Once per company-incident row pushed to the dataset |
| `high-severity-signal` | Additionally, for each row with `severity` of `critical` or `high` — the premium leads |

### FAQ

**What is an 8-K Item 1.05 and why does it matter for sales?**
Since December 2023, SEC rules require US public companies to disclose material cybersecurity incidents on Form 8-K under Item 1.05, within four business days of determining materiality. It is a legally mandated, precisely dated, board-approved admission that a company has a security problem. There is no stronger buying trigger in this market.

**How do I find companies that were breached this week?**
Run `discover` mode with `lookbackDays: 7`. Enable all four sources and set `minSeverity` to `high` to keep only the premium rows.

**Can I monitor my own target account list for breaches?**
Yes — that's `monitor` mode. Pass company names and/or domains in `companies`, set `lookbackDays: 1`, and schedule it daily. Passing a domain also checks that vendor's status page for outages.

**Does this work for private companies?**
Yes. SEC filings only cover US public companies, but the GDELT and Google News sources surface private companies, hospitals, universities, and government bodies that never file with the SEC.

**Do I need an API key or a proxy?**
No. All four sources are public. SEC's required descriptive User-Agent header is set for you.

**How is `triggerScore` calculated?**
It combines source authority (SEC filings score highest, then ransomware coverage, then outages and breach news), incident severity, and an exponential recency decay. Rows come back sorted highest first, so the top of your dataset is the top of your call list.

**How current is the data?**
Every run queries the sources live. SEC filings appear within minutes of being accepted by EDGAR; status-page incidents and news are near real-time.

**Why do some news rows have no company domain or ticker?**
Domains and tickers are only available where the source provides them — status pages carry the domain, SEC filings carry the ticker and CIK. News rows carry the company name and the article link, which is what a rep needs to open the conversation.

### Changelog

**1.0** — Initial release. Four live sources (SEC EDGAR 8-K Item 1.05 full-text search, Atlassian Statuspage vendor feeds, GDELT, Google News RSS), three modes (`discover`, `monitor`, `company-history`), Item 1.05 narrative extraction from the filing itself, composite trigger scoring, per-signal talk tracks, typed dataset schema, and per-event pricing.

# Actor input Schema

## `mode` (type: `string`):

discover = find any company with a recent security incident. monitor = check your named account list for incidents in the lookback window (schedule this daily). company-history = full incident history for the named companies.

## `companies` (type: `array`):

Company names and/or domains to watch. Required for monitor and company-history modes. A domain (e.g. zoom.us) also unlocks that vendor's status-page incident feed.

## `lookbackDays` (type: `integer`):

How far back to look for incidents. Ignored in company-history mode, which returns everything available.

## `sources` (type: `array`):

Which signal sources to query: sec (8-K Item 1.05 material cybersecurity disclosures), statuspage (Atlassian Statuspage vendor incident feeds), gdelt (global news index), google-news (Google News RSS).

## `keywords` (type: `array`):

Optional extra terms ANDed into the news queries in discover mode, e.g. an industry or region ("healthcare", "bank", "Germany").

## `minSeverity` (type: `string`):

Drop signals below this severity. critical/high are the premium leads.

## `statusPageDomains` (type: `array`):

Override the built-in vendor status-page list in discover mode. Any Atlassian Statuspage host works, e.g. status.zoom.us or www.githubstatus.com.

## `fetchFilingExcerpts` (type: `boolean`):

Fetch each 8-K and extract the Item 1.05 narrative into the excerpt field. Adds one request per filing and makes rows far more useful for outreach.

## `maxItems` (type: `integer`):

Maximum number of company-incident rows to return, highest trigger score first.

## Actor input object example

```json
{
  "mode": "discover",
  "companies": [],
  "lookbackDays": 90,
  "sources": [
    "sec",
    "statuspage",
    "gdelt",
    "google-news"
  ],
  "keywords": [],
  "minSeverity": "medium",
  "statusPageDomains": [],
  "fetchFilingExcerpts": true,
  "maxItems": 50
}
```

# Actor output Schema

## `results` (type: `string`):

One row per company-incident in the default dataset - signal type, severity, trigger score, talk track, and source.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "mode": "discover",
    "companies": [],
    "lookbackDays": 90,
    "sources": [
        "sec",
        "statuspage",
        "gdelt",
        "google-news"
    ],
    "keywords": [],
    "minSeverity": "medium",
    "statusPageDomains": [],
    "fetchFilingExcerpts": true,
    "maxItems": 50
};

// Run the Actor and wait for it to finish
const run = await client.actor("apricot_blackberry/breach-signal-radar").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "mode": "discover",
    "companies": [],
    "lookbackDays": 90,
    "sources": [
        "sec",
        "statuspage",
        "gdelt",
        "google-news",
    ],
    "keywords": [],
    "minSeverity": "medium",
    "statusPageDomains": [],
    "fetchFilingExcerpts": True,
    "maxItems": 50,
}

# Run the Actor and wait for it to finish
run = client.actor("apricot_blackberry/breach-signal-radar").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "mode": "discover",
  "companies": [],
  "lookbackDays": 90,
  "sources": [
    "sec",
    "statuspage",
    "gdelt",
    "google-news"
  ],
  "keywords": [],
  "minSeverity": "medium",
  "statusPageDomains": [],
  "fetchFilingExcerpts": true,
  "maxItems": 50
}' |
apify call apricot_blackberry/breach-signal-radar --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,apricot_blackberry/breach-signal-radar"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/jO9FFt1ggJt7R4HUS/builds/Rohp53uWrKfyuuYvj/openapi.json