AI Enabled Cyber Threat Salience from Cybersecurity News Metadata

Introduction:
Cybersecurity risk is shaped not only by verified incidents, but also by how threats become visible in public information ecosystems. This study develops an AI enabled cyber threat salience framework for measuring temporal, thematic, and source level patterns in global cybersecurity reporting.

Methods:
The study analyses 18,307 usable cybersecurity news records collected between 3 October 2023 and 2 June 2026. Complete month analysis uses 18,263 records across 32 months, drawn from 190 source domains, 18,248 unique titles, and 17,922 unique URLs. The framework combines title level thematic coding, monthly aggregation, early to late salience comparison, Jensen Shannon divergence, and source concentration metrics. Eleven cyber threat themes were measured, including vulnerabilities and exploits, malware and botnets, AI security, nation state activity, phishing, data breaches, ransomware, cloud and identity, critical infrastructure, supply chain compromise, and cryptocurrency related risks.

Results:
Cybersecurity reporting showed strong temporal volatility, with a 3.4 fold difference between the highest and lowest complete month volumes. The most visible theme was vulnerabilities and exploits, appearing in 2,816 records, or 15.4% of usable records, followed by malware and botnets with 1,509 records and AI security with 1,407 records. Late period salience increased for vulnerabilities and exploits from 13.5% to 21.3%, and AI security from 6.0% to 13.6%, while ransomware declined from 5.8% to 1.6%. Source concentration was high, with the top five domains contributing 60.9% of all records.

Conclusions:
The framework converts cybersecurity news metadata into measurable cyber threat salience intelligence. It supports cyber risk monitoring, AI security trend detection, source aware interpretation, and public cyber risk analytics without treating news visibility as verified attack prevalence.