Internet Cyber Health Index
Methodology

Model v7.1 · VECTORS seven-dimension scored composite (V E C T O R S — O is Actor Operations) · Outages informational · Updated Oct 13, 2026 (r89.7)
A defensible, outside-in measurement of the daily condition of the digital ecosystem, derived entirely from public, authoritative, machine-readable sources. Not a company-specific internal risk score.

What the Index Measures

The Internet Cyber Health Index (ICHI) aggregates signals across seven scored dimensions of cyber threat activity into a single 0–100 composite score updated continuously as data arrives. It answers the question an executive would actually ask: how bad is it out there today, and what should I do differently?

The index is deliberately outside-in. It does not measure your organization's posture — it measures the condition of the broader Internet ecosystem your organization depends on: the vulnerabilities being weaponized right now, the infrastructure failing, the adversary machinery in motion, and the software supply chain you import from.

Scoring Model

ICHI now uses the VECTORS model as its headline scoring base. VECTORS (model v7.1) evaluates seven scored pressure areas across the digital ecosystem: Vulnerability Pressure, Exploitation, C2 / Malware Infrastructure, Threat Actors, Actor Operations (phishing-driven, the O), Ransomware, and Supply Chain. Outages is retained as an informational dimension — tracked and displayed, but not scored (see the revision note and dimension table below).

The previous production model, TVIEWS, was a broader six-dimension composite covering Threat Activity, Vulnerability Pressure, Operational Impact, Exposure Surface, Weaponization, and Systemic Stress. VECTORS is intended to be more operational, more explainable, and more directly tied to external cyber telemetry — each VECTORS dimension corresponds to a specific class of public, observable feed rather than to a conceptual category that mixes several feeds together.

TVIEWS remains referenced in this document only as the previous/original model, for visitors comparing the current ICHI scoring to earlier published values. It is no longer the active scoring model.

How to read the score. ICHI is a directional signal, not a forecast precise to a single integer. The severity band (NORMAL · GUARDED · ELEVATED · HIGH · CRITICAL) is the operative read; the integer score is published as a courtesy. Treat moves within a band as noise; treat band crossings as meaningful. The six scored dimension weights are expert-prior estimates from the operator, not empirically backtested against historical events. A weight-calibration revision against named events (Shai-Hulud, CrowdStrike outage, MOVEit, xz-utils, LastPass) is planned but not yet shipped.

Top Cyber Event is explanatory. Each day ICHI surfaces a dominant observed condition — a ransomware spike, a KEV mass-exploitation wave, a supply-chain compromise, an outage cluster, a data-quality event, or remediation pressure. The Top Event card explains what is driving today's number. The Top Event does not add points to the composite. The headline integer comes from the weighted VECTORS sum plus two meta-condition uplifts (VID and Remediation Pressure) which measure things VECTORS does not capture.

Scoring policy. ICHI uses VECTORS as the headline scoring base. Limited meta-condition adjustments may be applied only for ecosystem-level conditions not directly represented as a VECTORS dimension, such as Vulnerability Intelligence Degradation or Remediation Pressure. Top Event is explanatory only and does not alter the score. Dimension signals (V, E, C, T, R, S) are not uplifted twice — if a condition already maps cleanly to a VECTORS dimension, that dimension carries the weight on its own.

AI Exposure Watch · observation only · not scored

Three independent AI-risk signals, added at r85.0. None of them touch the composite, and they are deliberately not combined into a single number — they measure different things on different cadences and are not expected to correlate.

• Model supply chain. Share of flagged artifacts among the most-downloaded public models on Hugging Face, read from the Hub's own scan results (picklescan, JFrog, and VirusTotal across all public repositories since October 2025). Sampled by download rank rather than upload recency: widely pulled models are the ones that carry organisational exposure, whereas flagged-share among all recent uploads largely measures spam. Repository identifiers only are retained; no path to a malicious artifact is ever stored or displayed.
• AI stack advisories. Advisory velocity for a fixed list of AI/ML runtime packages via OSV.dev. The package list is held constant so a growing denominator cannot manufacture a trend. Queried by package and ecosystem rather than by keyword, because these frameworks are frequently unnamed in CVE description text and a keyword pass badly undercounts them.
• Top AI incident. Narrative headline from the AI Incident Database public RSS feed. That feed is report-level rather than incident-level — a typical fortnight carries roughly 89 press items resolving to about 29 distinct incidents — so items are deduplicated on the incident reference embedded in each entry. Ranking is by breadth of security relevance (how many independent term families an incident matches) and then recency. Report count is displayed but excluded from ranking, because ranking by it would surface the most widely covered story rather than the most relevant one.

Why this is not scored. The advisory signal almost certainly overlaps vulnerability pressure already counted in V through NVD, and scoring it would breach ICHI's feed-signal independence rule. The incident feed is human-curated, so its volume tracks curator activity as much as the threat landscape. The model-scan signal is the most promising of the three but has no baseline yet. The panel accumulates history the way Exposure Watch does; any promotion to a scored dimension would be a separate methodology event requiring demonstrated independence from V, E, S and P.

Methodology revision · patch-freshness-36h · r89.20 · 2026-10-16. A patch-coverage measurement counts only while it is current. Patch-Reference Coverage sets Vulnerability Pressure's patch-gap modifier (0 to +8 points). Until this revision every scorer used the latest stored measurement whatever its age, so on a day its daily collector failed the score kept the previous day's — or an older — modifier as if it were new (2026-10-14 to 10-16 scored the 2026-10-13 measurement, the full +8). Now a measurement is eligible only while it is at most 36 hours old, judged against the time its collection completed. A measurement older than that, one with no valid collection time, or one dated in the future is not scored: it is treated exactly as the model has always treated a missing patch-coverage input — the gap is absent and the modifier adds nothing to V. It is not replaced by an estimate, and it is still shown, labelled stale, with its real date. A failed or partial collection never writes a measurement, so it can never appear as a fresh one. Collection now runs before the daily snapshot (21:30 and 23:30 UTC; the snapshot is taken at 00:00 UTC), so each snapshot scores the measurement completed that evening; before, the two ran together at 00:00 and the snapshot usually read the previous day's. The formula, the dimensions, the weights and every other input are unchanged, and so is the model (v7.1). Published scores are not restated.

Methodology revision · model v7.1 · r89.7 · 2026-10-13. Threat Actors and Ransomware re-measured; dimensions and weights unchanged. Threat Actors now measures actor activity — how many ransomware groups posted claims in the last 7 days and how many claims they posted — with actors named in reporting kept at a quarter of the dimension. Ransomware reads a full week of claims. Backtested before release over the 81 stored v7 days (2026-07-24 to 2026-10-13): Threat Actors' average day-to-day move fell from 8.9 to under 4 points and it now tracks active groups (correlation 0.75, was 0.26); Ransomware now tracks weekly claim volume (0.69, was 0.11) at a similar average level (71.7, was 73.3); the composite moved −0.5 points on average, and days in the HIGH band fell from 14 to 4 (each of the 11 that left was within 2.1 points of the 70 threshold; one day, 2026-08-08, entered it). Scores published before this revision are not restated: v7.1 is a new model regime, and history comparisons and percentiles start again from its first day.

Methodology revision · r89.2.5 · 2026-10-12. Wording only: the C2 source is named as abuse.ch ThreatFox. ICHI's C2 collector moved from abuse.ch Feodo Tracker to ThreatFox in r77.10; this page, the homepage footer and the feed label still said Feodo. No input, weight or score changed.

Methodology revision · r63 · 2026-05-15. Renamed Patch Window Pressure to Remediation Pressure to reflect the broader operational pressure on defenders. Remediation is broader than patching alone — it includes vendor mitigations and workarounds, compensating controls, WAF / Akamai / firewall rules, disabling exposed services, configuration changes, segmentation and exposure reduction, identity-control changes, credential rotation, EDR detections and blocking, threat hunting, and incident containment. The scoring math is unchanged in r63; the existing proxies (fresh critical CVEs, KEV velocity, network-reachable bug volume, Patch Tuesday window) remain as indicators of defender action burden. The model rebuild — adding EPSS pressure, exploit references, ransomware relevance, and vendor mitigation advisories as direct inputs — is planned for a later release.

Methodology revision · model v7 · r80.0 · 2026-07-22. VECTRS becomes VECTRS+P: Phishing (P) added as the seventh scored dimension, and three further changes ship in the same event. (1) P — Phishing enters the composite at a 0.10 weight, computed from the OpenPhish Community Feed at 12-hour resolution with a 70-day backfilled baseline: unique-domain diversity carries 80% of P and positive 7-day domain momentum 20%. Phishing is a top initial-access vector and was the model's largest coverage gap. (2) T fixed and ecosystem blend activated. A defect present since r46 weighted an input (APT feed item velocity) that was never populated, silently capping T at 70; that dead sub-weight is removed and distinct named adversaries now carry the T base alone. Separately, the Adversary Ecosystem blend (75% base / 25% online criminal-ecosystem breadth from ransomlook) — computed and displayed as a gated observation since launch — is now live inside T, its baseline having shown independent movement. (3) V gains a capped patch-gap modifier (0 to +8 points): when the share of fresh high/critical CVEs lacking public fix evidence exceeds 15%, V rises linearly to +8 at a 40% gap, reflecting disclosure outrunning remediation evidence. (4) Weights re-normalized over 0.95 (the six prior weights plus P's 0.10), preserving prior relative proportions. Net transition effect measured on transition-day data: under one point of composite movement. The retired v6 model is computed alongside v7 in nightly snapshots as a shadow, so the transition is fully auditable. Naming addendum (r80.1, 2026-07-23): the seventh dimension, introduced at r80.0 as "P — Phishing," is named O — Actor Operations, restoring the model's original VECTORS acronym; the dimension's formula, weight, and inputs are unchanged, and the informational Outages dimension relinquishes the model letter. In stored snapshots and API payloads the dimension's internal key remains P (with O continuing to identify informational Outages) to preserve historical continuity. Edge Exploitation Watch is simultaneously designated a permanent drill-down view: it decomposes telemetry already scored in V and E, so scoring it would double-count.

Methodology revision · r77.13 · 2026-06-30. Outages (O) removed from the composite score. Outage events observed on vendor statuspages cannot be reliably attributed to cyber causes — most are operational (configuration error, capacity, fiber cuts) — so scoring them as cyber pressure overstated the signal. Outages is now informational only: still collected and shown on the dashboard and the Outages page, but excluded from the index. The scored model is now V E C T R S (six dimensions). The remaining weights were re-normalized over 0.85 (the sum of their prior weights), preserving their relative proportions exactly — so the change reflects only the removal of O, not a re-weighting of the others. Expect the composite to move for the same world-state, since the share Outages used to contribute is now redistributed proportionally across the six scored dimensions.

Methodology revision · r59 · 2026-05-15. Removed the Top Cyber Event composite uplift and the standalone supply-chain uplift — both double-counted signals already captured by the VECTORS dimensions, and the Top Event card is now explanatory only. Retained the VID (data-quality) and Remediation Pressure uplifts because they measure conditions outside VECTORS. Renamed the AI-Accelerated N-Day Weaponization condition to Patch Window Pressure in r59 (and then to Remediation Pressure in r63) to match what its proxies actually measure (calendar position, fresh CVE volume, KEV velocity — not AI activity itself). Promoted the severity band over the integer score in the hero UI to reduce precision overclaiming.

Methodology revision · r46 · 2026-05-13. The index moved from the six-dimension TVIEWS model to the seven-dimension VECTORS model. The old Weaponization Pressure dimension was split into C2 / Malware Infrastructure and Threat Actors — those signals had always been conceptually distinct. The old Systemic Stress dimension, which mixed cloud/CDN outages with concentration risk, was retired in favor of Supply Chain (pressure on the software trust graph) — concentration risk moved into Outages. Ransomware was promoted from a sub-signal under the old Threat dimension to its own dimension, since it is the consequence layer most operators track separately. Expect 5–15 points of movement on the composite for the same world-state vs. r45.

VECTORS Dimensions

Seven scored dimensions, each 0–100, combined into a weighted composite: V E C T O R S (model v7.1). The model reclaims its original name as of r80.1: the O now denotes Actor Operations — active adversary operations, currently measured through phishing infrastructure — while the retired informational Outages dimension keeps its name but no longer holds a model letter. The model name VECTORS retains O (Outages) as a seventh, informational dimension — tracked and displayed but excluded from the score, because outage events cannot be reliably attributed to cyber causes.

Composite Formula

Each dimension is scored 0–100 using logarithmic (ln) and square-root (rt) transforms to prevent single signals from dominating. The composite is a fixed weighted sum, plus two meta-condition uplifts that measure things VECTORS does not capture:

Logarithmic scaling compresses extreme values: a day with 1,000 C2 servers doesn't score 10× a day with 100. Square-root scaling is used where moderate growth is more meaningful than extreme concentration.

Note on precision and calibration. ICHI is a directional signal, not a forecast precise to a single point. The integer score is published as a courtesy; the severity band is the operative read. The seven dimension weights are expert-prior estimates from the operator, not empirically backtested against historical events. Treat moves within a band (e.g. 42 → 47, both GUARDED) as noise; treat band crossings as meaningful. Future revisions may publish a backtested weight calibration against named events (Shai-Hulud, CrowdStrike outage, MOVEit, xz-utils, LastPass); until then, the weights should be read as a defensible starting point, not a settled measurement.

Severity Bands

Top Cyber Event (explanatory)

Each day ICHI identifies the dominant observed condition — a supply-chain compromise, a KEV mass-exploitation wave, a ransomware leak-site spike, a cluster of Tier-1 vendor outages, a Vulnerability Intelligence Degradation event, or Remediation Pressure. This is the "Top Cyber Event" surfaced on the dashboard. The Top Event does not add points to the composite score. It is an explanatory narrative layer that points at which VECTORS dimension(s) the dominant condition is showing up in, so readers can audit how the day's score relates to the day's news.

Why no uplift. Earlier revisions (r48–r58) added an additive uplift to the composite when a Top Event was active — CRITICAL +20, MAJOR +13, ELEVATED +6. In r59 the uplift was removed because the underlying signal was already being counted in the VECTORS dimensions (a ransomware spike raises the R dimension; an outage cluster raises O; etc.), and adding a separate uplift double-counted the same event. The Top Event card still selects today's dominant condition and explains it in full narrative form, but the headline integer comes only from the weighted VECTORS sum plus the two meta-condition uplifts described below (VID and Remediation Pressure), which measure conditions VECTORS does not capture. The running archive of daily Top Events remains available at /events.html.

Vulnerability Intelligence Degradation

Vulnerability Intelligence Degradation (VID) measures whether public vulnerability data is complete, timely, and actionable. ICHI raises the score when CVEs are missing enrichment, KEV records change materially, ransomware-use indicators flip, or exploitation signals appear before public vulnerability context is complete. The intuition: defenders depend on timely public data — CVSS scores to triage, CWE classifications to scope, CPE configurations to identify affected stacks, and KEV indicators to prioritize patching. When that pipeline is degraded, organizations make patch decisions on incomplete information. The index reflects that uncertainty as a real risk, even when the underlying vulnerabilities are not new.

The five trigger conditions ICHI watches: (1) NVD enrichment gap — recent CVEs missing CVSS, CPE, or CWE data; (2) NVD backlog — meaningful fraction of CVEs in "Awaiting Analysis" status past normal turnaround; (3) CISA KEV delta — new entries added since yesterday's snapshot; (4) KEV ransomware flip — knownRansomwareCampaignUse changes from "Unknown" to "Known"; (5) exploit-before-enrichment — exploitation/EPSS/vendor warnings present for CVEs whose NVD enrichment is still incomplete. The VID uplift stacks additively only with approved meta-condition uplifts (currently Remediation Pressure), capped at composite 99. Levels and signals are recomputed daily by a scheduled function (vid-builder.js) that snapshots NVD enrichment state and the KEV catalog into Netlify Blobs; the dashboard reads the snapshot on demand.

Remediation Pressure

Remediation Pressure measures the urgency placed on defenders to act based on current external cyber conditions. It includes patching, but is broader than patching alone. The signal reflects fresh critical vulnerabilities, known exploitation, KEV velocity, exploit availability, ransomware relevance, exposure risk, and conditions where compensating controls or emergency mitigations may be required.

What counts as remediation. Remediation in this context is the full set of defender actions taken in response to external cyber conditions — not just applying vendor patches. ICHI treats the following as remediation work that consumes operator capacity:

• Patching (vendor-supplied fixes applied to affected systems)
• Vendor mitigations and workarounds (configuration changes, feature toggles, registry settings advised by the vendor when a patch is unavailable or being staged)
• Compensating controls (IPS/IDS signatures, EDR custom rules, restricted execution policies)
• WAF / Akamai / CDN rules (virtual patching at the application layer for internet-facing services)
• Firewall blocks (rate-limiting, geo-blocking, source-IP blocks, port restrictions)
• Disabling exposed services (turning off vulnerable endpoints, removing affected APIs from public exposure)
• Configuration changes (hardening defaults, disabling legacy protocols, tightening default permissions)
• Segmentation and exposure reduction (network isolation, micro-segmentation, removing direct internet exposure)
• Identity-control changes (MFA enforcement, conditional access policies, session-token revocation)
• Credential rotation (secrets, API keys, service-account passwords, certificates)
• EDR detections and blocking (custom IOC ingestion, behavior-based blocking, response playbook activation)
• Threat hunting (proactive search for indicators of compromise associated with active exploitation campaigns)
• Containment actions (isolating suspect hosts, killing suspicious processes, network quarantine)

What this condition measures today. Four calendar and CVE proxies are used as initial indicators of defender action burden: (a) Patch Tuesday proximity, (b) fresh critical-severity CVE volume, (c) fresh network-reachable bug volume, (d) KEV weaponization velocity. These are good proxies because each one expands the set of remediation decisions defenders must make this week — but they are not the full signal. The scoring math has not yet been rebuilt to incorporate EPSS pressure, exploit-availability references, ransomware relevance, emergency vendor advisories, and explicit network-exposure data. Adding those inputs is planned for a later release. Until that rebuild, the current proxies stand in for the broader signal.

What this condition does not measure. It does not detect AI-assisted exploit research, AI-generated exploit code, or attacker tooling. The condition was previously labeled "AI-Accelerated N-Day Weaponization" (renamed to Patch Window Pressure in r59, then to Remediation Pressure in r63) — the current naming is meant to describe the operator-side consequence (defender action burden), not the attacker-side capability that contributes to it.

Note: in r63, the surfaced labels in the dashboard (Today's Snapshot card) still read as elevated / high / severe for consistency with prior releases. The operational-guidance bands above (LOW / MODERATE / SEVERE / CRITICAL) describe the same four states with action-oriented framing. A future release will align the surfaced labels.

Raw score components (each independent, additive — these are the unchanged proxies retained from the prior Patch Window Pressure formulation): (a) Patch Tuesday proximity — within 7 days after the 2nd Tuesday of the month: +1; (b) Fresh critical-severity CVEs (CVSS ≥ 9.0, published in trailing 7 days): ≥5 → +1; ≥10 → +2; (c) Fresh network-reachable bugs (CVSS vector contains AV:N, trailing 7 days): ≥3 → +1; ≥6 → +2; (d) KEV weaponization velocity (trailing 30-day median lag between NVD publication and KEV addition): ≤14d → +1; ≤7d → +2. The condition is recomputed daily by ainday-builder.js (internal name retained for route stability). Editorial override: the maintainer can pin the level (elevated, high, severe or clear) when external conditions warrant a specific public classification. Forced levels are flagged in the Today's Snapshot fact as "(editorial)" for transparency.

Research-Validated Emerging Risk (pre-KEV) OBSERVATION · NOT SCORED

This observation plane records vulnerabilities whose exploitability a governed source confirmed before CISA KEV listed them. It exists to measure how much warning the public research record gives ahead of the KEV catalogue. It is observation only and not scored — nothing on this plane reaches computeCTI, the VECTORS dimensions, or any historical score.

Who may assert what. Sources sit in a governed registry with a trust tier and a declared type. Only Tier 1 or approved Tier 2 independent research and vendor PSIRT sources can create a pre-KEV finding. A public proof-of-concept is supporting evidence only and can never, on its own, promote a finding. Each source is restricted to the evidence classes it is permitted to assert.

Qualification. Independent research must reach at least RESEARCH_REPRODUCED — the source must state that it reproduced, validated or demonstrated the issue; speculative or marketing language stays RESEARCH_THEORETICAL and is held back. A vendor advisory qualifies on confirmation shape instead (an assigned CVE, affected versions, or bulletin language), because vendors confirm vulnerabilities without publishing reproduction steps; a vendor advisory never implies pre-auth, RCE or a demonstrated exploit. KEV status fails closed: if the KEV catalogue cannot be read, nothing is promoted to pre-KEV, because "ahead of KEV" cannot be established.

Exposure and edge classification. A product is reported as Internet-exposed only where ICHI's own exposure telemetry confirms an exposed population for its category. Edge classification and exposure are tri-state — yes, no, or unknown — and an unknown is never displayed as a no. A vendor name alone never infers a product category.

Disagreement is kept, not resolved. Where a vendor states that authentication is required and independent research demonstrates a pre-authentication path, both claims are retained in provenance, the finding is marked SIGNALS_CONFLICTING, and its confidence drops. ICHI does not average, arbitrate or silently prefer one source over another. Where an article names several CVEs and a claim cannot be attributed to exactly one of them, the claim is held back as unattributable rather than applied to all of them.

Exploitation. "Exploitation observed" is asserted only from allow-listed telemetry reporting observed malicious activity. A public exploit, a demonstration, a feasibility argument, an EPSS score, or the absence of a KEV listing can never establish it.

Ranking. Findings are ordered by six named factors, compared in sequence: technical consequence → exploitation state → exposure relevance → patch condition → evidence strength → recency. The first factor that differs decides the position. Exploitation state sits second because confirmed real-world exploitation is a stronger urgency signal than patch availability alone: an actively exploited vulnerability that already has a patch ranks above a comparable one that has no patch but no observed exploitation. It sits below technical consequence deliberately — exploitation never lifts a lower-consequence finding above a pre-authentication remote code execution. There is deliberately no numeric "research risk score": every position is traceable to a stated factor, and each finding carries a "Why ranked here" line generated from the same comparison.

Collection conduct. Sources are read over their published feeds under conditional requests, with robots directives honoured and article bodies fetched only from the source's own approved domain. Full articles are never reproduced or stored — only a short, bounded evidence excerpt and the derived claims are retained, alongside a link back to the original. When a feed stops parsing, the source is flagged PARSER_DRIFT rather than silently reporting zero findings. See the full research analysis →

Chainguard Athena — CGP disclosures OBSERVATION · NOT SCORED

Chainguard Athena publishes AI-discovered vulnerability disclosures in OSV format, each identified by a CGP identifier and accompanied by a patch for a vulnerable version. ICHI treats it as a separately governed source from Chainguard Security Advisories: same organisation, different feed, different semantics, its own source health. It is observation only and not scored — nothing on this plane reaches the VECTORS dimensions, the composite, or any historical score.

CGP is a first-class identifier. A CGP is not a synthetic CVE and not a placeholder for one. A disclosure with no CVE is a published advisory with a published fix — frequently better documented than a CVE, not less — and it may never be assigned one. ICHI therefore never labels a CGP "pre-CVE", which means something different: a finding in a pre-CVE lifecycle state supported by evidence.

A disclosure is not an exploitation report. An Athena advisory may state that a flaw is critical, remote, unauthenticated and results in remote code execution, and ICHI still records its exploitation status as UNKNOWN (served as exploitation_observed: null, never false). Disclosure states that a vulnerability exists, not that anyone is using it. This source can never, alone, place anything on the Critical Active Threat band; where exploitation is later established it is attributed to the authority that observed it, such as the CISA KEV catalogue.

Affected and fixed versions follow OSV semantics. introduced, fixed, last_affected and limit each mean something different and are preserved rather than flattened. A fixed boundary is positive evidence that a fix exists; its absence is unknown, never "no patch available". Every affected package an advisory lists is kept, with its own ranges and its own fix.

deps.dev reach measures the public dependency graph. Where a package is enriched, the figure is the maximum dependent count across sampled affected versions — never a sum, because downstream projects overlap. It is indicative public reach: known public downstream dependents. It is not affected companies, deployments, private enterprise dependencies, installed systems or users. A critical flaw in a widely depended-on component may be reported as a systemic vulnerable component, which is an observation about blast radius and is kept strictly distinct from active exploitation and from a compromised software distribution.

One vulnerability, several identifiers. A CGP that later receives a CVE, NVD enrichment or a KEV listing remains one canonical finding carrying both identifiers, with its original disclosure date preserved and the interval between stages recorded as observational identifier lag. Reconciliation requires an identifier the publisher itself asserted — an explicit OSV alias. A shared package, a shared weakness class, a matching CVSS vector or a matching publication date are circumstantial and never merge two records: a false merge silently attributes one vulnerability's facts to another, while a temporary duplicate is visible and correctable.

Collection conduct. The repository is monitored read-only by content identity — commit SHA, then directory tree SHA, then advisory blob SHA — so only new or modified advisories are ever downloaded and an unchanged hour costs a single request. The announcement blog is not scraped: coverage follows the machine source, not a publication calendar. Patches are recorded as existing, with their path and content hash, and are never fetched for analysis, applied or executed. The repository is public; where an access token is configured it only raises the rate limit, and its value is never logged, persisted or returned.

Patch-Reference Coverage SCORED · V MODIFIER · MODEL v7

As of model v7 (r80.0), this signal contributes to the score as a capped modifier inside Vulnerability Pressure: a coverage gap (100 − coverage) at or below 15% adds nothing; above that, V rises linearly to a maximum of +8 points at a 40% gap. It is deliberately a bounded modifier rather than a standalone input because coverage partly reflects NVD reference-linking speed, not only true remediation state — the cap limits how much that proxy noise can move the composite. Since 2026-10-16 a measurement counts only while it is at most 36 hours old; an older, undated or future-dated measurement adds no modifier (the model's missing-input rule) and is shown labelled stale (revision note). The panel below continues to document the raw signal.

Patch-Reference Coverage tracks the share of fresh high/critical CVEs that include public evidence of a vendor fix, advisory, mitigation, or security update. A falling coverage rate may indicate that vulnerability publication is outrunning remediation evidence. The signal is experimental; since model v7 it enters the score only through the capped V modifier described above.

What it measures. Each evening (21:30 and 23:30 UTC, ahead of the 00:00 UTC daily snapshot) ICHI pulls the trailing 30 days of HIGH and CRITICAL CVEs from the NVD CVE 2.0 API and counts how many carry at least one reference tagged or identifiable as a vendor patch, vendor advisory, release note, mitigation, security update, or commit-style fix. The coverage ratio is that count divided by the total. The panel shows the trailing-30-day high/critical count, the count carrying remediation evidence, the coverage percentage, and 7-day and 30-day trend once baseline history accumulates.

What it does NOT measure, and why. ICHI does not currently measure true discovery-to-enterprise-deployment time, which is not publicly observable. NVD references are not reliably timestamped, and CISA KEV remediation windows reflect policy deadlines rather than observed remediation behavior. ICHI therefore tracks patch-reference coverage — the share of fresh high/critical vulnerabilities carrying public evidence of a vendor fix, advisory, mitigation, or security update — as an experimental indicator that enters the score only through the bounded V modifier. This is a presence proxy, not a patch-lag or time-to-patch measurement. The absence of a reference in an NVD record does not mean no patch exists — a vendor may have shipped a fix that is simply not yet linked in the record. Coverage is informative only in aggregate and over time, not for any individual CVE.

Why it exists and where it may go. The motivation is the shift, visible in 2026, from finding vulnerabilities being the bottleneck to verifying, disclosing, and remediating them being the bottleneck — as AI-assisted discovery began outpacing the ecosystem's capacity to patch. A widening gap between disclosure volume and public remediation evidence is the observable shadow of that shift. ICHI stores a daily baseline (retained 180 days) so that a future release can decide, with real history in hand, whether it should also feed Remediation Pressure. Today its only effect on the composite is the capped V modifier, and only while the measurement is current. Computed daily by patch-coverage-builder.js; served from /api/patch-coverage.

Next-Generation Internet Health Taxonomy SCORED · CALIBRATION PHASE · NOT IN HEADLINE ICHI

ICHI is extending beyond its vulnerability- and exploitation-heavy origins into a broader taxonomy of Internet cyber health: five tiers holding 18 canonical categories. Tier 1 Active Threats, Tier 2 Structural Exposure, Tier 3 Identity & Trust, Tier 4 Systemic Risk, Tier 5 Health & Recovery. All eighteen are registered now so later releases plug into stable identifiers; Identity & Trust is the first family to be activated for scoring (r86.7.0).

Higher score means worse. Every taxonomy pressure runs 0–100 where 0 is the healthiest observed condition and 100 the worst. This is the same direction as the headline ICHI index and uses the same band thresholds — Normal, Guarded, Elevated, High, Critical — which are not forked or redefined for the new taxonomy.

Score, coverage and confidence are separate. A score says how unhealthy a measured condition is. Coverage says how much of the intended measurement actually exists today. Confidence says how much to trust the measurement. They are reported side by side and never multiplied together: a pressure of 82 held at medium confidence stays 82, medium confidence. Folding uncertainty into the number would report an unhealthy Internet as half-healthy simply because we are unsure, so ICHI does not do it.

Missing data is never zero. A source that is unavailable, unauthenticated, rate-limited, schema-changed or still calibrating produces no number at all. Its weight is removed from the denominator and the resulting coverage is published. If a category falls below 60% of its intended weight, or a tier below 70% with fewer than two scoreable categories, no score is shown. A partial measurement is never renormalised into a confident full score, and no source outage can ever improve Internet cyber health.

No sampled estimate is presented as an Internet census. Every observation carries the source that produced it, the window it covers, the population it was measured across, its coverage, and what kind of measurement it is — confirmed event, verified exposure, observed activity, sampled measurement, estimate or prediction. There is deliberately no “census” measurement type, because no provider has one.

The headline ICHI remains unchanged during calibration. Taxonomy scores are real measurements, not decorative observations — but during calibration they are held outside the published composite. Model v7, the VECTORS dimensions and weights, composite-lib.js and every historical snapshot are untouched by this work, and no taxonomy metric is injected into V/E/C/T/O/R/S. They will only ever contribute once enough ICHI history exists to calibrate what that contribution should be.

Identity & Trust TIER 3 · SCORED · CALIBRATION PHASE

Whether the Internet can still tell who and what to believe. Three categories, weighted as equal thirds — not because thirds are correct, but because nothing yet shows another ratio is better. Served from /api/trust, collected daily at 06:19 UTC by trust-builder.js, presented at /trust.

Credentials & Accounts. One measurement in Edition 1: compromised-credential authentication pressure, at 100% of the category’s current weight. Its source is Cloudflare Radar leaked-credential checks, and what it measures is Cloudflare-observed authentication requests involving known compromised credentials — not a percentage of global credentials, not a percentage of people, and not an Internet credential compromise rate. Because identity compromise is far wider than this one signal (stealer logs, stolen sessions and tokens, credential stuffing, password spraying, cloud identity compromise, MFA bypass), the category is published with source_breadth = LIMITED. Placeholder values are never invented for the signals that do not exist yet.

Encryption & PKI. Two intended measurements: deprecated public TLS at 60% and certificate validation at 40%. The TLS measurement is a Censys count of hosts observed offering TLS 1.0 or 1.1 on any service, over hosts observed offering any TLS service — host documents at a single document level, never a mix of host and service counts. Certificate validation is not currently measured: there is no defensible global aggregate of certificate trust state, Certificate Transparency issuance volume measures logging rather than active exposure, and self-signed certificates are not intrinsically unhealthy. Rather than invent a number, the category reports a score built on 60% of its intended weight and states the remaining 40% as unmeasured.

Naming, Routing & Email Trust. Three groups: DNS 20%, Routing 40%, Email 40%. Within DNS, DNSSEC is 100%. Within Routing: RPKI coverage deficit 60%, BGP origin hijacks 20%, route leaks 20%. Within Email: DMARC 30%, SPF 25%, DKIM 25%, legacy email TLS 20%.

The coefficients, in full. Email authentication pressure is FAIL% + (0.5 × NONE%). The 0.5 is a V1 calibration assumption, stored in configuration and published by the API: a domain with no DMARC policy has not failed a check, it has declined to publish one, which is weaker but not equivalent to failure. DNSSEC pressure weights INVALID at 1.0 and INSECURE at 0.4 — an unsigned zone is unprotected, while a zone whose signatures do not validate is actively broken and unreachable to a validating resolver. OTHER is not scored as failure at all; it is an absence of evidence. Email TLS counts 1.0 and 1.1 as deprecated and 1.2 and 1.3 as current, which does not imply that modern TLS makes an email system secure.

What routing measurements do and do not say. The RPKI figure is the share of announced IP space without a valid ROA. Absence of a ROA is not an invalid route and is not an attack; it means the origin has not been cryptographically authorised, so a hijack of it could not be detected by RPKI. A detected BGP origin hijack is a routing anomaly — many are misconfiguration — and ICHI does not call any of them malicious without independent attribution. A route leak is a propagation error, not by itself an attack. ICHI stores counts only: no prefix, ASN or country from any routing event is persisted.

Event measurements refuse to guess. Hijack and leak pressure are percentiles of each metric’s own observed history, never fixed thresholds — “ten hijacks equals eighty” would be a number about nothing. Until 30 daily observations exist a metric reports CALIBRATING, its weight leaves the denominator, and the raw event count still displays. Percentage metrics use absolute badness while history is short, moving to 0.65 × absolute + 0.25 × historical percentile + 0.10 × worsening velocity once a baseline exists.

Sources, licensing and attribution. Cloudflare Radar supplies nine slices — leaked credentials, DNSSEC, RPKI, BGP hijacks, BGP leaks, DMARC, DKIM, SPF and email TLS — each tracked as its own health slice, so one failed slice never implies the others failed. Radar data is published under CC BY-NC 4.0; ICHI records that licence, attributes it wherever the data appears, and holds every Radar slice at BLOCKED_LICENSE_REVIEW — collected but not scored — until compatibility is explicitly confirmed. Censys Platform supplies the TLS population through ICHI’s existing Censys credential and source identity; its field semantics are unverified against the live Platform and it is therefore held at NOT_ENABLED_SEMANTICS_UNVERIFIED rather than scored on an assumption. Spam, malicious-mail and spoof dimensions are deliberately excluded here; they belong to Phishing & Fraud in Tier 1, and scoring them twice would double-count.

History. ICHI’s own daily archive for these measurements begins the first day the builder stored one, and is never backfilled. A provider’s historical series may legitimately calibrate a metric’s baseline, but wherever it appears it is labelled source history. ICHI never implies it measured something on a date before it stored that measurement.

Edge Exploitation Watch OBSERVATION ONLY · NOT SCORED

The Edge Exploitation Watch tracks exploitation pressure against internet-facing edge devices — VPNs, firewalls, gateways, routers, load balancers, and security appliances. These systems are privileged, exposed, and often slower to patch, making them priority targets for state actors and ransomware groups.

What it measures. Each day ICHI filters CISA KEV entries and trailing-30-day high/critical NVD CVEs against a curated, conservative list of edge-device vendors (Fortinet, Ivanti, Citrix/NetScaler, SonicWall, Palo Alto, F5, Juniper, Check Point, and others) and device-category keywords (VPN, firewall, gateway, load balancer, security appliance). It reports a current level (Normal / Guarded / Elevated / High / Critical) driven by the count and recency of edge entries, the product categories driving it, the evidence tier reached, and a confidence indicator. The match list favors precision over recall so the figure is defensible and auditable.

Evidence tiers. Three tiers are distinguished. Vulnerability-only (high/critical CVEs on edge products) and exploit-confirmed (edge entries in CISA KEV) are measured directly from public feeds. Implant / persistence-confirmed — reporting that adversaries have placed implants on edge devices — is not machine-measurable from a structured feed; it lives in narrative threat-intelligence reporting (Mandiant, Google TAG, CISA/NSA advisories). The computed level is driven only by the two measurable tiers. The implant tier is surfaced only as an editorial flag when a major report warrants it, and is labeled as such; ICHI never auto-claims implant detection.

Why it is not scored — permanently (decided r80.0). Edge-device vulnerabilities already contribute to the composite through Vulnerability Pressure and Exploitation: a Fortinet KEV entry raises both today. This watch isolates the edge-specific share of telemetry that is already scored, so adding it to the composite would double-count the same KEV signal — and its baseline confirmed it tracks overall exploitation pressure rather than moving independently. As of the model v7 methodology event it is designated a permanent drill-down view: kept for visibility into a critical device class, with no effect on the score, by design rather than by pending decision. Computed daily by edge-watch-builder.js; served from /api/edge-watch.

Phishing Watch SCORED · O — ACTOR OPERATIONS · MODEL v7

Phishing Watch is ICHI's first phishing-class signal. It observes aggregate volume in the OpenPhish Community Feed — a continuously refreshed rolling window of live, independently verified phishing URLs, updated roughly every twelve hours.

What it measures. Each day ICHI records the number of URLs in the window, the number of unique base domains hosting them, and the distribution of top-level domains. Because the community feed is a fixed-size rolling window, the raw URL count saturates at the window ceiling; the meaningful signals are the day-over-day and 7-day movement of unique domains and shifts in the TLD mix, which reflect the breadth and churn of active phishing infrastructure. Raw phishing URLs are aggregated and immediately discarded — they are never stored, displayed, or republished by ICHI.

Scored as of model v7 (r80.0, 2026-07-22). Phishing graduated from observation to the seventh scored dimension exactly as this section previously described the path: it accumulated a 70-day baseline (12-hour resolution, reconstructed from feed history and continued live), demonstrated movement independent of the six existing dimensions, and entered the model through a public methodology event with renormalization notes (see the model v7 revision above). P is weighted at 0.10 of the composite: unique-domain diversity carries 80% of the dimension and positive 7-day domain momentum 20%. Computed daily by phishing-watch-builder.js; served from /api/phishing. Source data © OpenPhish, used with attribution.

Kill-Chain Pressure EXPERIMENTAL · NOT SCORED

Kill-Chain Pressure re-projects ICHI's existing signals onto the stages of a generic attack sequence, answering a question the dimension grid doesn't: where along the attack chain is internet-wide pressure currently concentrated?

What it is — and is not. Each stage's heat derives entirely from signals already collected and documented above: Recon from DShield mass-scanning volume; Initial Access from phishing-infrastructure breadth and fresh KEV additions; Exploitation from EPSS-critical and confirmed-exploit counts; Command & Control from active and newly-registered C2; Impact from ransomware leak-site victim flow. The same logarithmic saturation math and severity bands as the composite are used, so a HIGH here means the same thing a HIGH means anywhere on the page. This is a re-projection of observed pressure, not attack-path prediction: it does not model any specific environment, does not infer unobserved vulnerability chains, and contributes nothing to the score. Inferred or "novel" path modeling — connecting vulnerabilities into hypothesized chains — is a separate research direction that would ship, if ever, only as clearly-labeled hypothesis after methodology review.

Confidence Scoring

Feed Classification

Governance and Disclaimer

The Internet Cyber Health Index is not investment advice. It is not breach attribution. It is not a prediction engine. It is not a substitute for enterprise-specific risk assessment. It is based on public, commercial, and observed cyber-risk indicators. It is designed as a composite signal of digital ecosystem stress.

ICHI is a directional cyber-risk signal, not a deterministic forecast.

Data Sources

Threat & Malware

Vulnerability

Infrastructure & Outages

Regulatory & Disclosure

News & Intelligence

Known Limitations

About the Observer

The index is maintained by Joe Bernik, a cybersecurity executive who built this as a personal outside-in daily briefing tool. The methodology is open: all sources are public, the weight derivation is published here, and the scoring code runs entirely in the browser and Netlify edge functions.