They are using machine learning to comb the darknets, capturing about 300 threats a week.

About 90% hack application and backdoor recognition, that is for sale, and about 80% hacker forum vulnerability identification.

"These threat warnings include information on newly developed malware and exploits that have not yet been deployed in a cyber-attack"

https://arxiv.org/abs/1607.08583