About 75% of insider incidents involve nobody acting maliciously. Programmes built to detect grievance address a quarter of the problem.
Foothold to exfiltration in about 72 minutes. Every response process that assumes a human decides in time is now mistimed.
A missing authentication check on a table query endpoint. One defect, and a different blast radius inside every tenant.
Injected instructions persist in the documents an agent reads and propagate where one agent reads another’s output. No filesystem required.
1,596 disclosed, 97 patched. Discovery is now a capital expenditure; fixing is still one person in their own time.
Ten thousand critical findings in a month across operating systems, browsers and core libraries. Discovery funded at twenty-five times remediation.
“Battle-tested” is used as a security argument. A defect that survived 27 years of review in OpenBSD undercuts it.
Three technology estates in one company. The research attention is on the vehicles; the billion-pound losses are in enterprise IT.
Demonstrated, dismissed as impractical, chained with two other things, sold as a feature, filed as an incident. Every technique here took that route.
This figure measures the category every disclosure-based count excludes by construction: the attacks that were stopped.
Trial volunteers consented explicitly and specifically. The consent given did not contemplate this.
A person reading a hostile page is not compromised by reading it. An agent is deciding what to do next on the basis of what the page says.
Only five of the seven routes are mechanisms anyone designed. The two reaching small firms are accidents of how research works.
Scarcity normally produces rising wages and employers training people up. “Cannot afford” and “cannot find” describe the same failed hire.
Real, distributed across people who will never know, and deferred by years. No instrument here can see it.
444 counts events. 133 counts things somebody assessed as saleable and put on the market.
Where disclosure is not mandatory, criminal forums become the primary public record — and affected people learn from researchers.
A group that works one industry at a time is reusing research, not expressing a preference. That makes the next target legible.
The email store is worth more than the institution is — and the exposed parties are people who simply wrote to an academic.
Applying the rule to a ransomware leader is the case that tests whether it is a rule or a preference. If it only holds for sympathetic subjects it is not a rule.
Presenting "encrypted" and "corrupted" as interchangeable makes an accident of the attacker’s process sound like a defence.
A file containing people who died twenty years ago is not a file that was being maintained. It is an accumulation, sold as current.
Nobody attacked anything. A sharing mechanism offered a wider scope than the task needed.
A signing key burned into shipped hardware cannot be rotated the way a credential can.