Signals
Short, graph-backed reads on cyber risk. One topic, one chart, one page, built from our live research data. Each carries a badge: Weekly desks refresh with the data, Standing insights hold until the picture changes, Records mark a one-off event.
Updated 16 October 2026, 10:37 UTC
Latest
RecordThe AI Hype Index just hit a record low16 October 2026StandingThe Day-One Hole in Zero Trust Architecture13 October 2026StandingIndex Ventures AI Claims Rest on 19 Unexplained Cases13 October 2026RecordCVE disclosure is on pace for a record year11 October 2026RecordTechnique shift: T1210 is now a top attacker technique enabled by this quarter's flaws11 October 2026RecordFortinet broke into the most-exploited vendors of the last 90 days11 October 2026RecordA record month for exploited vulnerabilities: 43 added to CISA KEV11 October 2026RecordAIA record quarter for AI-software vulnerabilities: 1144 in 2026Q311 October 2026
For your role
The weekly desk written for how you read this. Pick a role to focus.
Threats & exploitation 8
Confirmed exploitation, the actors behind it, and how fast flaws weaponize.
WeeklyLeak-Site WatchLeak-site watch: read the extortion feed, don't react to itUpdated 23 July 2026WeeklyThis Week in Cyber RiskThis week in cyber risk: 7 newly confirmed-exploited CVEsUpdated 11 October 2026WeeklyThreat Actor SpotlightThreat actor spotlight: AnonOpsUpdated 10 October 2026StandingAIAI Risk WatchAI risk watch: the Hype Index sits at 73/100Updated 14 October 2026StandingEU Saw It FirstENISA flags 10 exploited CVEs that CISA's KEV hasn't listedUpdated 13 October 2026StandingWeaponization SpeedWeaponization speed: the median new-KEV CVE was 0 days from disclosure to exploitedUpdated 13 October 2026
Flaws 21
The vulnerabilities and weakness types themselves.
WeeklyMapping NoteMapping note: the standard chain loses cross-site scripting (XSS)Updated 11 October 2026WeeklyWeakness Under-RatingThe weaknesses NVD marks up most: CWE-707 averages +2.4 over the vendorUpdated 24 July 2026WeeklyWeakness of the WeekWeakness of the week: CWE-79 (Cross-site Scripting) leads this week's new CVEsUpdated 11 October 2026StandingThe AI Attack Surface170 AI attacks, four weaknessesUpdated 30 July 2026StandingAIBlind Spots / Coverage GapsBlind spots: the AI weaknesses the standard catalogs barely useUpdated 11 October 2026StandingNews AnalysisEntra ID passkeys and three confirmed SSO incidentsUpdated 12 August 2026StandingNews AnalysisIndex Ventures AI Claims Rest on 19 Unexplained CasesUpdated 13 October 2026StandingNews AnalysisKEV entry confirms exploitation of MLflow SSRFUpdated 20 August 2026StandingNews AnalysisN-able Patch Gap Matches KEV and Campaign DataUpdated 04 August 2026StandingNews AnalysisSwiss SharePoint incident tied to two high-percentile CVEsUpdated 14 August 2026StandingNews AnalysisThe Day-One Hole in Zero Trust ArchitectureUpdated 13 October 2026StandingAI Risk WatchThe first six-figure year, and why a falling hype index means moreUpdated 19 August 2026StandingThe AI Risk GapThirty AI risks, and the one that maps to nothingUpdated 31 July 2026StandingThe Defensive GapWhere the defensive playbook runs outUpdated 31 July 2026
7 records in this area
The AI Hype Index just hit a record low16 October 2026CVE disclosure is on pace for a record year11 October 2026The quietest week for confirmed exploitation we have tracked04 August 2026Vulnerabilities are being weaponized faster than we have ever measured03 August 2026Weakness-type records 2latest 25 August 2026AI vulnerability records 1latest 11 October 2026
Scoring & data quality 7
How severity is scored, who scores it, and how far to trust it.
WeeklyScore DisagreementNVD and the vendor split hardest on CVE-2026-21806: a 6.7-point gapUpdated 15 October 2026StandingCVSS 4.0 AdoptionAbout one in three new CVEs now carries a CVSS 4.0 score (30% in 2026Q3)Updated 30 September 2026StandingSeverity InflationNVD is marking vendor scores up by more each year, +0.8 in 2026Updated 24 July 2026StandingSeverity Re-scoringNVD overrules the vendor's severity score on 80% of CVEs, mostly upwardUpdated 05 August 2026StandingWho Scores the ScoresNVD publishes its own severity score for only 27% of recent CVEsUpdated 13 October 2026StandingRegional Risk Watch (EU/UK)Regional risk watch: the EU and US agree on severity 94% of the timeUpdated 12 October 2026StandingCVSS Trust IndexWhose CVSS scores NVD overrules: Oracle at 6%, VulDB at 95%Updated 25 August 2026
Vendors & products 4
Which vendors and products are drawing exploitation and risk.
Controls & response 2
The controls and responses that address what's above.