The Security Bot Scenario

The Setup

You run a platform with a dozen services. Some are on Kubernetes, some on AWS. You depend on OpenSSL, Linux kernel, and a handful of open-source libraries. When a critical CVE drops, your team needs to know fast.

That's 8 different sources, each with different formats, update frequencies, and access methods. Today, most teams handle this one of two ways — both painful.

The Old Way: Humans in the Loop

Both approaches work, sort of. But they're expensive, fragile, and don't scale. Every new source is another scraper to build, another email to parse, another thing that breaks.

The DiffDelta Way: Agent-Ready Intelligence

With DiffDelta, all 8 of those sources are already being monitored. Every 15 minutes, our pipeline checks upstream, computes what changed, scores it for risk, and serves it as structured JSON on a global CDN.

Your bot's job becomes trivial:

The Code: 15 Lines

Here's a complete security monitoring bot. No SDK, no dependencies beyond requests.

import requests, json

# Your stored cursor (start with None on first run)
stored_cursor = load_cursor()  # e.g. from a file or database

# Step 1: Check for changes (400 bytes, ~10ms)
head = requests.get("https://diffdelta.io/diff/head.json").json()

if head["cursor"] == stored_cursor:
    print("No changes. Done.")
    exit()

# Step 2: Fetch the full delta
feed = requests.get("https://diffdelta.io/diff/latest.json").json()

# Step 3: Filter for security items and act on them
for item in feed["buckets"].get("new", []):
    if item["source"] in ["cisa_kev", "nist_nvd", "github_advisories",
                           "kubernetes_cve", "linux_kernel_cve"]:
        print(f"\U0001f6a8 {item['source']}: {item['headline']}")
        # → Create a Jira ticket, send a Slack alert, trigger a patch pipeline

# Step 4: Save cursor for next poll
save_cursor(feed["cursor"])

That's it. No HTML parsing. No rate-limit handling. No format normalization. The pipeline runs every 15 minutes, and your agent only processes what's actually new.

What the Data Looks Like

Here's what your bot actually receives — real data from DiffDelta's live CISA KEV feed:

Every item comes with a headline your agent can read, a structured excerpt with the details, evidence URLs linking to the original source, and a content hash so you can verify nothing was tampered with. No scraping, no guessing, no LLM required just to understand what happened.

The Math

Let's compare the cost of monitoring these 8 security sources:

Most of those 15-minute polls return nothing new. Your agent checks head.json (400 bytes), sees the cursor hasn't changed, and moves on. When something does change, you get exactly what's different — not the entire database.

This is what we call compute arbitrage: DiffDelta does the expensive work once (fetching, parsing, normalizing, scoring) and serves the result cheaply to every agent that needs it. You pay for one API call instead of rebuilding the pipeline yourself.