What Is A Signal?
4 July 2025
Definition of a signal, the lifecycle of a signal, and different signal types.
Definition of a signal
A signal is an atomic threat intelligence unit. The GSE is 'signal agnostic', meaning that the platform can handle any signal types, and our supported signal types are evolving in collaboration with GSE users and partners. In practical terms, a signal can be a link (URL, domain, subdomain [...]) an email address, IP address, ASN, telephone number, a merchant ID, bank account number (visit our Sending Signals documentation for the latest list of signals we support).
A signal has a life cycle, with key moments being when first seen, last seen, mitigated. Optionally each signal can have a confidence score which is built up through a combination of the sender's optional evaluation, and that of users and the platform (derived from feedback).
A signal can have other relational data attached to it, for example an advertising signal may contain an advert identifier plus related phishing URLs and redirect URLs. We work with several organisations to develop taxonomies that are relevant to their sector and the information they need to fight scams and fraud.
Signals are not the same as evidence or legal conclusions. They are simply an indication of potential concern, which can be validated, strengthened, or dismissed. Signals may be submitted via many sources ranging from cybersecurity professionals, industry actors, public safety officials, and consumers.
Why 'signals'?
The GSE has deliberately chosen the term 'signal' to describe the information shared within it. A 'signal' can be any type of information (whether or not personal data), and it does not necessarily imply any finding of wrong doing, or of evidence that would stand up in court - but a signal could also be any of those things.
Many 'signals' turn out to be false alarms. They may be a one-off, designated by a single source, or many sources. They can have varying levels of confidence attributed to them within the GSE platform and process - from the first source that uploads them, and through the feedback of other GSE users.
The GSE is more akin to a voluntary neighbourhood watch scheme, in which members of a community share concerns about things they have seen that seem unusual, without making accusations of criminal wrongdoing or taking legal responsibility for the accuracy of their statement.
The strength of voluntary, cooperative schemes such as the GSE is their apparent weakness - and the term signal is non-judgmental to encourage people to share information at a low threshold of concern, and allow others in the community to make their own decision about what action to take (or not) in response.