About 75% of insider incidents involve nobody acting maliciously. Programmes built to detect grievance address a quarter of the problem.
Three documented routes into the same object. Closing one is not closing the campaign, and the map arrived after the territory.
Legacy remote access at the entry point in 73% of intrusions, up from 38% in two years. The box keeps working, which is why it is still there.
Hospitals flat, their suppliers up ~35%. Hardening one class of victim redistributes attacks rather than preventing them.
27,000 entries with no analysis attached. Your scanner matches on metadata that, for these, does not exist.
The calculation is not that a city has money. It is that a city has visible pain and a decision-maker accountable to the people feeling it.
Twenty successors, and daily endpoints up from one million to nine. Enforcement removed operators; the device pool never changed.
Education fails closed while other sectors degrade. The fix is not detection — it is an offline copy of the data needed to open safely.
Three technology estates in one company. The research attention is on the vehicles; the billion-pound losses are in enterprise IT.
The industry that invented blameless incident analysis handles cyber incidents with commercial confidentiality instead.
The case for paying depended on a repeat player with a reputation to protect. Seventy-three new entrants in a year removes exactly that.
Every file that ends with credit monitoring should be read as ending with nothing.
A universal register with cause classification is achievable — one country has run it for eight years.
A corpus that spends its time discounting other people’s figures owes the same treatment to itself.
Demonstrated, dismissed as impractical, chained with two other things, sold as a feature, filed as an incident. Every technique here took that route.
A five-day difference in median dwell, attributable to who noticed. It is the strongest available case for spending on detection.
A rule cannot make a help-desk conversation resistant to a plausible caller. Compliant organisations appear in this database as often as non-compliant ones.
“Attacks rose despite enforcement” is equally compatible with enforcement having prevented a much larger rise. There is no counterfactual.
The corpus has treated the measured cases as the anomaly. They may be the only honest data in the set.
A hospital carries the operational-technology problem of a utility alongside the data-protection problem of a bank.
A consumer-facing organisation is bounded by the customers it can serve. A supplier is bounded only by how many of them it can sell to.
Enhanced verification for everyone is just verification. An alert triggered by a population is not a signal.
A shift from the transaction that sometimes works to the one this corpus has never seen work.
The head start was the entire point of coordinated disclosure. At an interval measured in hours, publication is a starting gun heard equally by both sides.
This figure measures the category every disclosure-based count excludes by construction: the attacks that were stopped.
The signature schemes held. The hash functions held. The losses came from signing workflows and outsourced support.
The corpus should be as suspicious of numbers that agree for no visible reason as of numbers that disagree.
Blocking more attempts and losing more data are the same finding. A manufacturer can lose its entire engineering position with no duty to tell anyone.
Three categories within 3% of each other, with entirely different dynamics. Categories that overlap in reality produce counts that converge.
At 30% of recorded crime, this stops being a specialist function and becomes ordinary policing.
Around 30% of 2025 breaches originated with a third party. The boundary an organisation defends stopped being the boundary that determines its exposure.
The only reliable incident costs in this corpus come from organisations that had no choice but to publish them.
Prevention will fail. Detection is what determines whether that becomes a state government offline for 28 days.
Jurisdictions are penalised in insurance and procurement for the act of becoming transparent.
Corporate IT, a production line, and a connected product you can still reach after sale. Few industries carry all three.
Where disclosure is not mandatory, the regional picture is assembled almost entirely from what attackers chose to publish.
15% reads as a measurement somebody made. 2,640 a week reads as a headline somebody wanted.
Content tells you what a known person said. Metadata tells you who the people are — and it is the one that scales.
Only five of the seven routes are mechanisms anyone designed. The two reaching small firms are accidents of how research works.
The structural argument covers only the zero-day case. The corpus weakened itself by folding the two together.
Cities do not recover differently. They simply cannot stop describing it.
Neither actor wanted the vendor. Both wanted what the vendor holds about everyone else — the same reach as a thousand intrusions, from one operation.
Worse than any September through oil shocks, three-day weeks and a pandemic. Output statistics may be a better instrument than any breach register.
The reached system is almost never the one the security programme was built around.
Geopolitical exposure is additive, not substitutive. It does not displace ordinary criminal risk — it sits on top of it.
Source code is not a signing key. A vendor’s list of known-but-unpatched flaws is a queue of working zero-days with the analysis done.
The unrecorded categories include a medicine arriving later than it would have.
One episode of care generates records in six organisations — six independent breach exposures for the same history.
An organisation can lose its entire commercial position and notify only on the contact fields.
Four accidents in 454 files is not coverage of a population reportedly targeted by 43% of attacks.
Concentration is dangerous on the side holding the data and useful on the side attacking it. Both moved the wrong way at once.
The properties are not defects. They are the function — which is why a vulnerability there is worth more.
For a child the loss is maximally unquantifiable: real, permanent, and not yet manifest.
Real, distributed across people who will never know, and deferred by years. No instrument here can see it.
Two incidents among four operators is a strong signal. Two among several thousand is close to nothing.
A company can raise prices. A county cannot — more security means visibly less of something a resident can see.
On every register in this corpus, the incident that mattered most did not happen.
The other fields require expertise to read. Participation in a trial for a named condition does not.
A transfer product is transitional by design. In practice the files persist, because deletion is a configuration nobody set.
A regulator receiving a dozen filings describing the same technique could warn the market. That is not a new obligation — it is a use of filings that already exist.
The standard response to data being held insecurely is to give it to another organisation that holds it.
The most sensitive records in this corpus, held by the least resourced organisations, under the thinnest supervision.
A boundary between corporate systems and customer tenants held under live attack. This corpus rarely gets to observe that.
837 incidents, 419 confirmed breaches. The 418 that never became a disclosure are the sector’s real attack volume.
An HR record exceeds a bank’s, and includes categories no commercial relationship generates.
Internet-facing, parsing untrusted input, trusted by everything behind it. All three by design — and the customer has no hardening available.
The equipment is not unpatched through neglect. It is unpatchable — commissioned to run continuously for thirty years, by a vendor that may no longer exist.
Payments become known; refusals do not. The observable signal is biased towards paying, and it is the observable signal that sets expectations.
A hotel record is the join key that turns location-adjacent data into confirmed physical presence. No DPIA has a field for that.
Evidence arriving later does not upgrade an inference. It removes one objection and leaves the rest where it was.
The data followed the obligation and the supervision did not follow the data.
A third of hospitals say incidents affected care. It measures disruption, not harm — and it still moves the funding argument.
The largest incidents in this database are measured only as a byproduct of a commercial risk-transfer market.
A customer can stop being a customer. An employee cannot decline to give their employer a national identifier and a bank account.
By the final phase there was no peer sector to watch, because the target was defined by a product rather than an industry.
343 mandatory filings in six months. Healthcare tops breach tables partly because it is the only sector compelled to count.
A safety regime, built for other purposes, produced the segmentation that a security argument has repeatedly failed to fund elsewhere.
A retailer and a bank suffering identical intrusions produce very different invoices, and the difference is regulation rather than damage.
Telling small organisations to outsource is not a compromise position. It is the only realistic path to any capability at all.
A distribution that departs from economic size is evidence of deliberate selection. It is the one regional file where the geopolitical framing is supported rather than assumed.
The finding is about the structure of the economy rather than the threat landscape — more durable and less urgent than reported.
A number that moves faster than the world does is measuring the instrument.
In a lawful market, removing the dominant supplier reduces volume because capacity is expensive to replace. Here the capacity is software.
A floor from a public ledger and a ceiling from an interested party are not the same kind of object. This corpus has not always said which it was holding.
An operation that runs on rotas, subscriptions and payment disputes does not require exceptional people. That is what makes it reproducible.