The Provider Is How Small Firms Enter the Record

At 25-1005b this desk recorded that the JLR supply-chain firms entered the public record through proximity to a large incident, and called that a sixth route — an accident rather than a mechanism.

The MSP cases supply a seventh: shared provider compromise. Twenty asset managers and an unenumerated set of DragonForce victims became visible because a single provider was named.

Proximity to a large incident requires the upstream event to be enormous. Provider compromise requires only that researchers identify the provider — which they generally do, because a shared vector is the most publishable part of the story.

So a small firm compromised through its MSP has a meaningfully higher chance of appearing in the record than one compromised directly, at identical severity.

If small-firm incidents become visible mainly when a provider is involved, then the visible portion over-represents provider-mediated compromise and under-represents everything else.

The national survey at 25-0615b found 84% of organisations reporting phishing as their most common attack — a direct route with no provider to name. That is the invisible majority, and this database contains almost none of it.

Mandatory notification, collective redress, research industry coverage, English-language publication, securities listing, proximity to a large incident, shared provider compromise.

Only the first five are mechanisms anyone designed. The last two are consequences of how research and journalism work, and they are the only ones reaching organisations below a certain size.

Graded medium: this is a structural argument about the database, extending 25-0502, 25-0924b and 25-1005b.