ICHI
ICHI
Internet Cyber Health Index
UTC —
PATCH —
CACHED
Internet Cyber Health Index
The one daily signal of digital ecosystem health

The Internet Cyber Health Index tracks the daily condition of the digital ecosystem by combining vulnerability pressure, exploitation, malware infrastructure, threat actor activity, ransomware, and supply-chain pressure into a single executive-readable signal. A daily executive signal of internet cyber health — VECTORS dimensions in one score.

ELEVATED
Score 69 / 100
0 NORMAL25 GUARDED50 ELEVATED70 HIGH85 CRITICAL
SNAPSHOT Server-rendered snapshot · Sep 24, 8:48 PM EDT · live data loads in the browser
TREND —
CONFIDENCE Medium
UPDATED Sep 24, 8:48 PM EDT
MONITORED SOURCES 21/23 live · 6/7 core
0–24 NORMAL Routine vigilance. Standard patch cadence.
25–49 GUARDED Review patch queues. Brief security leadership.
50–69 ELEVATED Accelerate critical patches. Activate threat-hunting.
70–84 HIGH Executive notification. Emergency response posture.
85–100 CRITICAL Full incident posture. Sustained executive engagement.
7-DAY TREND — —
MONITORED SOURCES
21 / 23 monitored sources live · 6/7 core —
Daily Snapshot Today's lead facts & what changed →

AI / Emerging Technology

Observation · not scored methodology →

Awaiting today's AI telemetry — model supply chain, AI-stack advisories, AI incidents.

What is driving ICHI today

Ranked from each dimension's contribution to today's score versus its own 21-day baseline · hover for the arithmetic
  1. Waiting for live scoring…
What the Internet is telling us today
  • Assembling from live signals…
Rule-based from live feeds — no generated text. Each line links its evidence.

Internet Pressure & Observability

Derived views of the signals behind today's Internet cyber conditions. Scoring status is shown per signal.
Exploitation Pressure PENDING · Collecting today's signals… Derived · inputs scored in E
    Open full exploitation analysis →
    Diagnostics & source panel
    Internet Exposure PENDING · Collecting today's signals… Observation · not scored
      Open full exposure analysis →
      Diagnostics & source panel
      Exploitable Exposure Attribute exposed surface to the CVEs behind it — exposure × likelihood map, CVE leaderboard, and device drill-down. Open attribution →
      Identity & Actor Operations PENDING · Collecting today's signals… Scored · O · Actor Operations
        Open full phishing & actor-operations trend →
        Diagnostics & source panel
        Remediation Pressure PENDING · Collecting today's signals… Scored · V modifier + Remediation uplift
          Open full remediation / patch-gap inventory →
          Diagnostics & source panel
          VECTORS · model v7 · Methodology
          TODAY'S CYBER WEATHER

          Today's conditions are summarized here once live feeds resolve.

          EXECUTIVE POSTURE

          Review open CRIT and HIGH CVEs against your stack. Confirm all CISA KEV patches are applied within your SLA. Monitor Tier 1 vendor status pages.

          Top Events

          Explanatory · does not add to the score
          EXPLOIT

          What happened

          Why it matters

          Ecosystem breadth

          Affected trust systems

          Advanced Analysis

          Experimental · not scored

          Analytical re-projections of signals already collected — kill-chain heat, attack-path correlation, chokepoints, evidence chains, KEV gap, derived paths, and defensive depth. None of these move the index.

          Defensive Depth · pressure by layer · experimental full view →
          Correlating layers…

          Live Observations & Deep Intelligence

          Source-level telemetry behind the index, grouped by what it measures
          — · Today's snapshot
          Loading conditions
          —
          VECTORS Model ↓ · Analyst Signals ↓ · Full Breakdown · Methodology · Sources · About ↗ Status ↗
          Core TelemetryCVEs · KEV · EPSS · incidents · wire volume · C2 — the raw counts under V, E and C
          Entry № I

          Live Observations

          Pulled from /api/*
          UPDATING…

          Recent CVEs

          STN–01 · NVD
          Cache: 5 min Window: 24 hr
          Severity Distribution
          • Live data loading… cached values shown
          40 total (cached) All →

          Known Exploited

          STN–02 · CISA
          Cache: 6 hr Sort: newest
          Adds · Last 14 Days
          • Cached baseline · live KEV data connecting
          Catalog count loading… All →

          Top EPSS

          STN–03 · FIRST
          Source: FIRST.org Cache: 1 hr
          Top 10 EPSS
          • Cached baseline · live EPSS data connecting
          — with epss > 0.9 All →

          Outages & Incidents

          STN–04 · LIVE
          Watched: 18 Cache: 2 min
          Service Health
          • Cached baseline · live outage data connecting
          — active All →
          Threat ActivityActive campaigns · ransomware · scanning / malicious infrastructure

          Active Campaigns

          named threat actors · Mandiant · CrowdStrike · Microsoft · Talos · Kaspersky · SentinelLabs
          —actors named
          —posts (90d)
          Top Actors · Mention Volume
          Loading APT campaigns · cached baseline

          Ransomware Watch

          ransomware.live · leak-site aggregation DARK-WEB ORIGIN
          —last 24h
          —tracked
          Victims · Last 7 Days
          Loading ransomware victims · cached baseline
          PROBES · TOP ATTACKED PORTS SANS Internet Storm Center · 24h
          —
          Probe data loading…
          Internet & Operational HealthNetwork truth · vendor status · internet health · sectoral telemetry

          Network Truth

          Cloudflare Radar · CAIDA IODA · what users actually experience
          —radar 24h
          —ioda 24h
          —ongoing
          Top Affected Countries · Last 7 Days
          Loading network truth · cached baseline

          Vendor Status

          55 statuspages monitored · Tier 1: hyperscalers · identity · payments · CDN  ·  Tier 2: security · observability · AI · comms · infra · SaaS  ·  Tier 3: dev / supply chain
          —outages
          —monitored
          Connecting…
          Live Status · All Tiers
          Vendor status loading…

          Internet Health

          global routing & traffic monitors
          opens external dashboards · refreshed continuously

          Sectoral Telemetry

          IODA internet signals · EIA-930 grid · live operational data · no API keys required
          —IODA
          —FCC
          Loading sectoral telemetry · cached baseline
          Impact & DisclosuresSEC 8-K material incidents · critical infrastructure advisories

          SEC 8-K · Cyber Disclosures

          EDGAR · Item 1.05 material incidents · last 90 days
          —last 90d
          —last 30d
          Disclosures · 12 weeks
          Loading SEC EDGAR · cached baseline

          Critical Infrastructure

          CISA ICS · Joint advisories · Treasury OFAC · sector-classified
          —last 7d
          —tracked
          Sector Breakdown · Last 7 Days
          Loading critical infrastructure · cached baseline
          Supply Chain / SoftwareRegistry and package-ecosystem telemetry
          IntelligenceDaily wire · cyber news · threat reporting
          Entry № II

          The Daily Wire

          5 RSS sources · curated daily
          CISA · Krebs · The Hacker News · Bleeping Computer · SANS ISC
          News feeds loading…
          Threat & Malware
          FEODOabuse.ch Feodo Tracker · active C2 servers
          RANSOMWATCHransomwatch.telemetry.ltd · victim posts 24h
          APTMalpedia / APT feed aggregate · named actors 90d
          Vulnerability
          NVDNIST NVD JSON 2.0 · CVEs published daily
          CISA KEVCISA Known Exploited Vulnerabilities catalog
          EPSSFIRST.org EPSS · exploitation probability scores
          Infrastructure & Outages
          STATUSPAGES55 vendor statuspages · 3 tiers
          DSHIELDSANS DShield · port probe intensity
          IODAGeorgia Tech IODA · BGP + telescope signals
          Regulatory & Disclosure
          SECSEC EDGAR full-text search · 8-K cyber incidents
          CISA ICSCISA ICS advisories + joint advisories
          RSSKrebs · BleepingComputer · DarkReading · TheRecord · SC Media