Model
Seven scored dimensions; weights from the methodology.
Methodology →Coverage
Live evaluation time is being read.
Data confidence → Source health →What changed todayAll key intelligence →
Briefing timestamp pending
Loading today’s governed intelligence briefing…
This list shows up to four distinct events. An item is current for 72 hours after its latest material development (up to 7 days with dated, current authoritative evidence of active exploitation or ongoing disruption). After that it stays, labelled as an earlier priority with its own date, until a newer or stronger item takes its place. Leaving the list is not resolution of the threat. Priority history → All key intelligence → · Priority history →
- Loading…
- Loading…
- Opens on demand: the feed is read when this tab is chosen.
Headlines and links only, from the publishers' own feeds; ICHI does not reproduce articles. Intelligence feed →
What's moving the indexIndex analysis →
- Loading…
Top incidents · ledger, 7 daysAll incidents →
- Loading the incident ledger…
Intelligence briefing
Six groups summarise all 26 intelligence modules. Explore any group for its live widgets, drivers and evidence.
Scoredfeeds the VECTORS score Observationalcontext, not scored Operationalplatform status Proposednot built · movement only where the data states it
Social Signals Observational
Emerging cybersecurity discussions from public communities.
Loading social signals…
View all social signals →Not scored · never affects the index
Weekly index briefing
Loading the latest complete week…
Index analysis
Full VECTORS dimension scores, weights and contributions (live), the daily change, and the scoring explanations. The links open the production views.
VECTORS dimensions LIVE
| Dimension | Score | Weight | Contribution | Daily change | |
|---|---|---|---|---|---|
| Loading… | |||||
Overview / Threat activity
Threat activity
Active exploitation, zero-days, ransomware (claims kept apart from confirmed incidents), threat actors, command-and-control, phishing and AI-assisted operations.
Zero-day tracker records · last 30 days LIVE Observational
Every record the Zero-Day Tracker holds for the window, with its class. Only Confirmed exploited zero-days (exploited before a fix, stated by the vendor) and Reported / under review are zero-day classes; rapidly exploited N-days, N-days and timing-unknown records are listed for completeness and are never counted as zero-days.
| CVE | Class | Vendor · product | Confirmed | Patch | Evidence |
|---|---|---|---|---|---|
| Loading the tracker records… | |||||
Full Zero-Day Tracker, with 60 / 90 / 180 / 365-day windows, filters and CSV →
Top incidents · incident ledger, last 7 days LIVE
Confirmed and reported incidents from the ledger; an actor’s claim is labelled as a claim. Ranking and search on Incidents.
- Loading the incident ledger…
Intelligence modules
Overview / Vulnerability pressure
Vulnerability pressure
Emerging and known-exploited vulnerabilities, research-confirmed exploitation before KEV, government advisories, supply-chain risk and the disclosure gap (vulnerabilities fixed outside the CVE system).
Priority vulnerabilities Research-confirmed · ahead of KEV · not scored
“Critical” here means pre-auth or remote code execution under ICHI’s consequence ladder — not CVSS or a vendor severity label.
View all priority vulnerabilities
Top vulnerabilities CISA KEV · edge devices
| CVE | Product / Technology | Evidence | Status |
|---|---|---|---|
| Read when this view opens. | |||
Disclosure gap · vulnerabilities fixed outside the CVE system Observational
Read when this view opens.
Intelligence modules
Overview / Infrastructure health
Infrastructure health
Cloudflare-observed DDoS activity with its geography, vendor status-page outages (an active outage or incident counts toward Vulnerability Pressure, V), edge-device exploitation, Internet-facing exposure and trust-root developments.
Global threat activity LIVE Observational
DDoS attacks Cloudflare observed in the last 7 days, by country.
Loading the DDoS geography…
Loading the HTTP (L7) and network (L3/4) trends…
Select a country on the map or in the list.
All reported countries, as a table
Measure, source and limits
Internet pressure & observability Derived views
Production's observability strips: each row states what is scored, its direction, confidence and freshness. A cloud data & secret exposure row appears only when its source marks the panel visible.
Read when this view opens.
Intelligence modules
Overview / Sector exposure
Sector exposure
Sector Pressure: confirmed and reported incidents, unverified ransomware claims and government advisories by sector, kept apart and never combined into a score.
Sector impact (30 d) LIVE Observational
Sector Pressure keeps three kinds of evidence apart. Rank by one kind at a time; they are never combined into a score.
Select a sector to see its drivers and evidence.
Evidence kinds, window and limits
Intelligence modules
Overview / Defense & resilience
Defense & resilience
Only validated defensive observations: patch coverage (fix evidence), the calibrating Identity & Trust measure, and the remediation-pressure uplift. Defensive effectiveness is not measured, and nothing here implies it.
Intelligence modules
Overview / Data confidence
Data confidence
The governed sources by tier, how recent each dataset is, the stored history, methodology and collection limitations. Per-source status is on Source health.
Sources & data freshness LIVE Operational
Monitored sources
- Loading…
Public status only; internal diagnostics stay private.
Feeds & sources Operational
Every governed source by tier, from production’s source-health model. A category whose source plane did not answer is stated unavailable, never healthy and never zero sources.
Read when this view opens.
Sources behind the live evaluation LIVE
Intelligence modules
Overview / Research
Research
Every research dataset ICHI collects, including those that are not scored and not on the homepage. Sections read their data when they first open; links go to the existing pages that hold the full records, filters and archives.
Why some intelligence is not on the homepage
The homepage shows the scored index and a short, time-limited priority list. Everything else ICHI collects stays available here and on its own pages. Not being on the homepage is not a finding that something is unimportant or untrue.
- Not scored. Observational datasets (AI research, Athena disclosures, DDoS, attack surface and others) give context but do not feed the VECTORS score, so they are not shown as score drivers. Vendor status pages are different: the number of vendor services in an active outage or incident is a scored input to Vulnerability Pressure (V), while the outage pages themselves are a presentation of those status pages.
- Not yet confirmed. A pre-KEV vulnerability reaches the priority list only when research confirms it. Actor-operations entries are vendor statements that ICHI does not confirm.
- Time-limited. A priority item leaves the homepage 72 hours after its last material development, or after 7 days when dated active exploitation or disruption is recorded. The panel normally shows three items and never more than six. Expired items stay on Priority history and remain searchable.
- Not collected. Some registered sources are not collected because their terms do not allow free public reuse without written permission. Each one is listed with its reason under Evidence & sources; ICHI does not infer anything from a source it does not collect.
AI research Observational · not scored
No AI score exists in ICHI and none is shown. These are research observations, each with its own source and limits.
AI Exposure Watch (/api/ai-watch · daily)
Read when this section opens.
AI Exposure Watch — every field and its daily history (/api/ai-watch)
Read when this section opens.
AI-assisted offensive operations (/api/actor-ops · vendor statements; ICHI does not confirm)
Read when this section opens.
Zero-days and AI (/api/zero-days · ai)
Read when this section opens.
AI service status (/api/outages · group ai; an active outage or incident reported in the last 3 days counts toward Vulnerability Pressure (V), as for every vendor status page)
Read when this section opens.
Full records: AI-assisted operations · Research (AI Exposure Watch history) · Zero-day trends · Methodology
Emerging vulnerabilities · pre-KEV Research-confirmed · not scored
Read when this section opens.
The ranked list with its category filter is in Vulnerability pressure → Priority vulnerabilities. Every record, the ten filters (priority, all pre-KEV, pre-CVE, independent, vendor, exploited, no patch, edge, internet exposed, all tracked), record views and the claims section are on Research (pre-KEV).
Athena disclosures Chainguard Athena · disclosure, not exploitation · not scored
Read when this section opens.
The disclosure gap (silent fixes) is in Vulnerability pressure. Athena rows join Priority vulnerabilities only within 30 days of disclosure.
Threat actors & ransomware
- Ransomware ecosystem — leak-site claims by group and day (RansomLook; claims are unverified), group activity
- AI-assisted operations — vendor-attributed actor statements and dual-use tools
- Threat actors (dimension T) — actor reporting from 17 sources
- Command & control — ThreatFox / abuse.ch C2 servers by family
- Phishing — daily phishing domains and URLs, TLDs
- Zero-day trends — confirmed, under-review and rapid N-day classes over 30 / 60 / 90 days
Incidents
- Incident ledger — confirmed, reported and claimed incidents, search, record pages
- Sector evidence — incidents, claims and ICS advisories per sector
- Key intelligence — every governed event
- Priority history — every item that held the homepage priority list
Infrastructure & geography
- DDoS activity — Cloudflare Radar layer 3/4 and 7, origin and target locations, pairs, vectors, botnets, threat reports
- Outages — 55 vendor status pages by tier (informational)
- Edge exposure — edge-device flaws, exploitation observed, KEV, exposure
- Attack surface — Internet-facing services by category and country (infrastructure location)
- Internet health — PKI, naming and routing trust-root developments
- Identity & trust — the calibrating shadow tier and its categories
- Defensive depth · Patch coverage
Sources & telemetry
- Data confidence — every governed source by tier, freshness, the live evaluation's feeds, observability strips
- Evidence & sources — source registry and health
- Data & exports · Build your export — datasets including index history, incidents, comparisons and AI tools
- Methodology — VECTORS v7.1, every source and limitation
Historical intelligence
- Pressure history — every recorded daily score, partial days labelled, comparisons
- Weekly briefing · Why the index moved
- Priority ranking (shadow) · Priority history
- Daily record (CSV)