The same unfunded dependency is the root cause of files in four sections of this database, and nobody is being asked to choose a remedy.
Every gap this corpus has documented sits in the space between three registers, and no combination of them closes it.
Two in five notifiable breaches involve nobody attacking anything, and sit outside everything this database has to say.
Almost everything in this database stops at the IT boundary. Industrial-device compromise produces consequences that cannot be restored from backup.
Eight per cent, in a scheme with a stable definition and eight years of continuity, is the most credible year-on-year change in this database.
The corpus is a sample of failures. The caseload is a sample of the well-defended. Neither source can locate the truth between them.
A corpus that spends its time discounting other people’s figures owes the same treatment to itself.
A rule cannot make a help-desk conversation resistant to a plausible caller. Compliant organisations appear in this database as often as non-compliant ones.
This database is a sample of long dwell times. Fast detection is exceptional here and apparently ordinary elsewhere.
One fix is cheap and nobody is doing it: emergency services already record diversion times. Nothing links them to incident dates.
None of the failures in this database required an unknown technique. Each required somebody with time to notice, decide and act.
Four accidents in 454 files is not coverage of a population reportedly targeted by 43% of attacks.
A small private company passes none of the five filters. Whatever happens to it is invisible to this database.
Twenty-six times smaller than a single ransom payment filed elsewhere in this database. Watching money you cannot seize is the ordinary condition.
The only action in this database that produces a certain answer to “are they still in?”
Reading this database suggests a breach means millions of records. The national average is five thousand times smaller than the largest file here.
Reachable, taken, and published are three populations. Almost every affected count in this database is one of them without saying which.
A sector whose failure would degrade the response to every other incident in this database.
The largest incidents in this database are measured only as a byproduct of a commercial risk-transfer market.
An accurate account of how large organisations are compromised, and a poor guide to how most compromises happen.
They pass none of the five filters. Each small-firm file in this database entered the record by accident.
An RMM platform is the purest case in this database: its entire purpose is executing commands on other people’s computers.
A webshell is the least sophisticated technique in this database. That it worked against the system of record is the finding.
Per-capita recovery falls as the class grows. The largest incidents in this database have the weakest claim on the mechanism.
The closest thing in this database to a measured downstream consequence — and it still is not the proof.
This database has 350 files and none of them cover a stolen phone — because it produces no notification and no defendant.
A figure that can only be an undercount. Those are the most useful numbers in this database and there are very few of them.
There is no moment at which the attacker chooses to be seen — which is the moment most of this database is built around.
The standing objection to everything this database says about availability harm is that nobody can show it reaching a person. Here a trust did.
The only demand in this database attaching a condition unrelated to payment. Nobody repeated it.
Every remedy this database records requires a living person to take an action.