ICHI
ICHI
Internet Cyber Health Index
UTC —
PATCH —
CACHED
Internet Cyber Health Index
The one daily signal of digital ecosystem health

The Internet Cyber Health Index tracks the daily condition of the digital ecosystem by combining vulnerability pressure, exploitation, malware infrastructure, threat actor activity, ransomware, and supply-chain pressure into a single executive-readable signal. A daily executive signal of internet cyber health — VECTORS dimensions in one score.

ELEVATED
Score 68 / 100
0 NORMAL25 GUARDED50 ELEVATED70 HIGH85 CRITICAL
SNAPSHOT Server-rendered · Last valid reading · Oct 24, 23:20 UTC (3 h ago) · live data loads in the browser
TREND —
CONFIDENCE —
UPDATED Oct 24, 23:20 UTC
MONITORED SOURCES 22 sources
0–24 NORMAL Routine vigilance. Standard patch cadence.
25–49 GUARDED Review patch queues. Brief security leadership.
50–69 ELEVATED Accelerate critical patches. Activate threat-hunting.
70–84 HIGH Executive notification. Emergency response posture.
85–100 CRITICAL Full incident posture. Sustained executive engagement.

30-day trend · daily snapshots

—
30-day ICHI index trend, coloured by risk tier Loading the historical series.

What is driving ICHI today

Ranked from each dimension's contribution to today's score versus its own 21-day baseline · hover for the arithmetic
  1. Waiting for live scoring…

Data & confidence

MONITORED SOURCES
22 monitored sources · source status —

What the Internet is telling us today

Live activity, exposure and operational signals across the global internet.

What the Internet is telling us today
  • Assembling from live signals…
Rule-based from live feeds — no generated text. Each line links its evidence.

Priority Vulnerabilities

Emerging and high-priority vulnerabilities, including exploitation evidence, patch status, and pre-CVE research.

Observation · not scoredView all

“Critical” here means pre-auth or remote code execution under ICHI’s consequence ladder — not CVSS or a vendor severity label.

Pre-KEV research findings PENDING · Collecting governed research sources… Observation · not scored
      Open full research analysis
      Provenance & governed source registry

      Flags identify the SOURCE ORGANISATION only. They never indicate affected country, attacker nationality, victim country or product origin.

      DDoS Activity Cloudflare-observed attack trends and map, most-targeted industries, botnet campaigns and threat reports Observation · not scored Details

      AI / Emerging Technology

      Observation · not scored methodology

      Awaiting today's AI telemetry — model supply chain, AI-stack advisories, AI incidents.

      Internet Pressure & Observability

      Derived views of the signals behind today's Internet cyber conditions. Scoring status is shown per signal.
      Exploitation Pressure PENDING · Collecting today's signals… Derived · inputs scored in E
        Open full exploitation analysis
        Diagnostics & source panel
        Internet Exposure PENDING · Collecting today's signals… Observation · not scored
          Open full exposure analysis
          Diagnostics & source panel
          Exploitable Exposure Attribute exposed surface to the CVEs behind it — exposure × likelihood map, CVE leaderboard, and device drill-down. Open attribution
          Identity & Actor Operations PENDING · Collecting today's signals… Scored · O · Actor Operations
            Open full phishing & actor-operations trend
            Diagnostics & source panel
            Remediation Pressure PENDING · Collecting today's signals… Scored · V modifier + Remediation uplift
              Open full remediation / patch-gap inventory
              Diagnostics & source panel

              Feeds & sources

              Every governed source ICHI reads, with its current status. Details are on Source health.

              Source health
              Governed research sources

              Advanced & live intelligence

              Top events, VECTORS, Network Truth, sectoral and critical-infrastructure telemetry, SEC disclosures, ransomware watch and the Daily Wire — kept in full.

              Expand
              TODAY'S CYBER WEATHER

              Today's conditions are summarized here once live feeds resolve.

              EXECUTIVE POSTURE

              Review open CRIT and HIGH CVEs against your stack. Confirm all CISA KEV patches are applied within your SLA. Monitor Tier 1 vendor status pages.

              Top Events

              Explanatory · does not add to the score
              EXPLOIT

              What happened

              Why it matters

              Ecosystem breadth

              Affected trust systems

              Advanced Analysis

              Experimental · not scored

              Analytical re-projections of signals already collected — kill-chain heat, attack-path correlation, chokepoints, evidence chains, KEV gap, derived paths, and defensive depth. None of these move the index.

              Defensive Depth · pressure by layer · experimental full view
              Correlating layers…

              Live Observations & Deep Intelligence

              Source-level telemetry behind the index, grouped by what it measures
              — · Today's snapshot
              Loading conditions
              —
              Core TelemetryCVEs · KEV · EPSS · incidents · wire volume · C2 — the raw counts under V, E and C
              Entry № I

              Live Observations

              Pulled from /api/*
              UPDATING…

              Recent CVEs

              STN–01 · NVD
              Cache: 5 min Window: 24 hr
              Severity Distribution
              • Live data loading… cached values shown
              40 total (cached) All

              Known Exploited

              STN–02 · CISA
              Cache: 6 hr Sort: newest
              Adds · Last 14 Days
              • Cached baseline · live KEV data connecting
              Catalog count loading… All

              Top EPSS

              STN–03 · FIRST
              Source: FIRST.org Cache: 1 hr
              Top 10 EPSS
              • Cached baseline · live EPSS data connecting
              — with epss > 0.9 All

              Outages & Incidents

              STN–04 · LIVE
              Watched: 18 Cache: 2 min
              Service Health
              • Cached baseline · live outage data connecting
              — active All
              Threat ActivityActive campaigns · ransomware · scanning / malicious infrastructure

              Active Campaigns

              named threat actors · Mandiant · CrowdStrike · Microsoft · Talos · Kaspersky · SentinelLabs
              —actors named
              —posts (90d)
              Top Actors · Mention Volume
              Loading APT campaigns · cached baseline

              Ransomware Watch

              ransomware.live · leak-site aggregation DARK-WEB ORIGIN
              —last 24h
              —tracked
              Victims · Last 7 Days
              Loading ransomware victims · cached baseline
              PROBES · TOP ATTACKED PORTS SANS Internet Storm Center · 24h
              —
              Probe data loading…
              Internet & Operational HealthNetwork truth · vendor status · internet health · sectoral telemetry

              Network Truth

              Cloudflare Radar · CAIDA IODA · what users actually experience
              —radar 24h
              —ioda 24h
              —ongoing
              Top Affected Countries · Last 7 Days
              Loading network truth · cached baseline

              Vendor Status

              55 statuspages monitored · Tier 1: hyperscalers · identity · payments · CDN  ·  Tier 2: security · observability · AI · comms · infra · SaaS  ·  Tier 3: dev / supply chain
              —outages
              —monitored
              Connecting…
              Live Status · All Tiers
              Vendor status loading…

              Internet Health

              global routing & traffic monitors
              opens external dashboards · refreshed continuously

              Sectoral Telemetry

              IODA internet signals · EIA-930 grid · live operational data · no API keys required
              —IODA
              —FCC
              Loading sectoral telemetry · cached baseline
              Impact & DisclosuresSEC 8-K material incidents · critical infrastructure advisories

              SEC 8-K · Cyber Disclosures

              EDGAR · Item 1.05 material incidents · last 90 days
              —last 90d
              —last 30d
              Disclosures · 12 weeks
              Loading SEC EDGAR · cached baseline

              Critical Infrastructure

              CISA ICS · Joint advisories · Treasury OFAC · sector-classified
              —last 7d
              —tracked
              Sector Breakdown · Last 7 Days
              Loading critical infrastructure · cached baseline
              Supply Chain / SoftwareRegistry and package-ecosystem telemetry
              IntelligenceDaily wire · cyber news · threat reporting
              Entry № II

              The Daily Wire

              5 RSS sources · curated daily
              CISA · Krebs · The Hacker News · Bleeping Computer · SANS ISC
              News feeds loading…

              Additional resources

              Research & analysis
              full pre-KEV finding table
              Vulnerabilities
              CVE, KEV and EPSS intelligence
              Indicators
              per-dimension measurement detail
              Exploitation
              active exploitation pressure
              Source health
              every feed, parser state and cadence
              Methodology
              model v7.0, weights and definitions
              Daily Change Archive
              see what changed on any recorded day
              Threat & Malware
              THREATFOXabuse.ch ThreatFox · active C2 servers
              RANSOMWARE.LIVEransomware.live + ransomlook.io · victim posts 24h / 7d
              APTMalpedia / APT feed aggregate · named actors 90d
              Vulnerability
              NVDNIST NVD JSON 2.0 · CVEs published daily
              CISA KEVCISA Known Exploited Vulnerabilities catalog
              EPSSFIRST.org EPSS · exploitation probability scores
              Infrastructure & Outages
              STATUSPAGES55 vendor statuspages · 3 tiers
              DSHIELDSANS DShield · port probe intensity
              IODAGeorgia Tech IODA · BGP + telescope signals
              Regulatory & Disclosure
              SECSEC EDGAR full-text search · 8-K cyber incidents
              CISA ICSCISA ICS advisories + joint advisories
              RSSKrebs · BleepingComputer · DarkReading · TheRecord · SC Media