Sector pressure evidence

Window. The 30 UTC days ending today. Each sector shows three counts; they are never added, weighted or turned into a level, and a sector with more records is not "higher" than another.

Exposure. Every CISA ICS and ICS-medical advisory first released in the window, read from CISA's own CSAF documents (github.com/cisagov/CSAF, TLP:WHITE). The sector is CISA's own "critical infrastructure sectors" statement for that advisory; nothing is guessed from titles. CISA's Energy sector covers electricity and oil & natural gas, so its advisories count for both tiles. A revision ("Update A") is the same advisory. An advisory means products used in the sector are vulnerable, not that anyone was attacked. "KEV" counts advisories with a CVE in CISA's Known Exploited Vulnerabilities catalogue. Coverage is complete only when every document CISA's index lists in the window has been read.

Claims. Unverified ransomware leak-site claims ICHI holds (its incident ledger and RansomLook research records). A claim counts for a sector only when the alleged victim's industry is stated: the industry the organisation filed with a regulator, or a whole-word industry term in its own name or in the claim's description of it ("… Hospital", "… Credit Union", "(container shipping)"). A name that points to two sectors, or none, is not assigned. The ransomware group's own profile and any vendor's sector are never used.

Incidents. The incident ledger's established statuses: confirmed means a regulatory filing or the organisation's own statement; reported means newsroom reporting, not confirmed. The industry rule is the same as for claims. A claim is never counted as an incident.

Zero means none found in ICHI's sources for that sector, not proof of safety. Most claims and incidents name no industry ICHI can establish; the page header states how many.