What this endpoint does

Returns the complete catalog of risk rules that Recorded Future evaluates for Company entities, serving as a reference for understanding and filtering company risk assessments. Each risk rule represents a specific security concern — such as reported cyber attacks, exposed credentials, dark web attention, typosquat domains, infrastructure infections, email security misconfigurations, or vulnerable technologies. The rule name values returned here are the exact values accepted by the riskRule filter on Company: Search, making this a prerequisite for constructing targeted company risk searches. This endpoint takes no parameters and always returns the full rule set.

Response data

Returns an array of all active Company risk rules, each with a machine-readable name (for use as API filter values), human-readable description, criticality level, and a count of how many companies currently trigger that rule. Company criticality labels are Informational, Moderate, High, and Very High — note these differ from the IOC-style labels used by IP/domain/hash risk rules. Each rule also maps to security framework categories, including NIST Cybersecurity Framework controls (e.g., DE.CM-1, PR.DS-5) and Recorded Future Functional Categories (e.g., Security Incidents, Malicious Network Activity), enabling alignment with organizational security reporting. Results are nested under data.results.