Curated, citation-backed profiles (high/medium confidence), plus provisional entries auto-tracked from leak-site claims — clearly badged and not analyst-vetted. Ransomware entries reflect a group's claimed victim, not a confirmed breach.