Every day in this range, as a table
Model
Seven scored dimensions; weights from the methodology.
Methodology →Coverage
Live evaluation time is being read.
Data confidence → Source health →What changed todayAll key intelligence →
Briefing timestamp pending
Loading today’s governed intelligence briefing…
This list shows up to four distinct events. An item is current for 72 hours after its latest material development (up to 7 days with dated, current authoritative evidence of active exploitation or ongoing disruption). After that it stays, labelled as an earlier priority with its own date, until a newer or stronger item takes its place. Leaving the list is not resolution of the threat. Priority history → All key intelligence → · Priority history →
- Loading…
- Loading…
- Opens on demand: the feed is read when this tab is chosen.
Headlines and links only, from the publishers' own feeds; ICHI does not reproduce articles. Intelligence feed →
What's moving the indexIndex analysis →
- Loading…
Top incidents · ledger, 7 daysAll incidents →
- Loading the incident ledger…
Intelligence briefing
Six groups summarise all 26 intelligence modules. Explore any group for its live widgets, drivers and evidence.
Scoredfeeds the VECTORS score Observationalcontext, not scored Operationalplatform status Proposednot built · movement only where the data states it
Weekly index briefing
Loading the latest complete week…
Index analysis
Full VECTORS dimension scores, weights and contributions (live), the daily change, and the scoring explanations. The links open the production views.
VECTORS dimensions LIVE
| Dimension | Score | Weight | Contribution | Daily change | |
|---|---|---|---|---|---|
| Loading… | |||||
Overview / Threat activity
Threat activity
Active exploitation, zero-days, ransomware (claims kept apart from confirmed incidents), threat actors, command-and-control, phishing and AI-assisted operations.
Zero-day tracker records · last 30 days LIVE Observational
Every record the Zero-Day Tracker holds for the window, with its class. Only Confirmed exploited zero-days (exploited before a fix, stated by the vendor) and Reported / under review are zero-day classes; rapidly exploited N-days, N-days and timing-unknown records are listed for completeness and are never counted as zero-days.
| CVE | Class | Vendor · product | Confirmed | Patch | Evidence |
|---|---|---|---|---|---|
| Loading the tracker records… | |||||
Full Zero-Day Tracker, with 60 / 90 / 180 / 365-day windows, filters and CSV →
Top incidents · incident ledger, last 7 days LIVE
Confirmed and reported incidents from the ledger; an actor’s claim is labelled as a claim. Ranking and search on Incidents.
- Loading the incident ledger…
Intelligence modules
Overview / Vulnerability pressure
Vulnerability pressure
Emerging and known-exploited vulnerabilities, research-confirmed exploitation before KEV, government advisories, supply-chain risk and the disclosure gap (vulnerabilities fixed outside the CVE system).
Priority vulnerabilities Research-confirmed · ahead of KEV · not scored
“Critical” here means pre-auth or remote code execution under ICHI’s consequence ladder — not CVSS or a vendor severity label.
View all priority vulnerabilities
Top vulnerabilities CISA KEV · edge devices
| CVE | Product / Technology | Evidence | Status |
|---|---|---|---|
| Read when this view opens. | |||
Disclosure gap · vulnerabilities fixed outside the CVE system Observational
Read when this view opens.
Intelligence modules
Overview / Infrastructure health
Infrastructure health
Cloudflare-observed DDoS activity with its geography, Internet outages (informational, never scored), edge-device exploitation, Internet-facing exposure and trust-root developments.
Global threat activity LIVE Observational
DDoS attacks Cloudflare observed in the last 7 days, by country.
Loading the DDoS geography…
Loading the HTTP (L7) and network (L3/4) trends…
Select a country on the map or in the list.
All reported countries, as a table
Measure, source and limits
Internet pressure & observability Derived views
Production's observability strips: each row states what is scored, its direction, confidence and freshness. A cloud data & secret exposure row appears only when its source marks the panel visible.
Read when this view opens.
Intelligence modules
Overview / Sector exposure
Sector exposure
Sector Pressure: confirmed and reported incidents, unverified ransomware claims and government advisories by sector, kept apart and never combined into a score.
Sector impact (30 d) LIVE Observational
Sector Pressure keeps three kinds of evidence apart. Rank by one kind at a time; they are never combined into a score.
Select a sector to see its drivers and evidence.
Evidence kinds, window and limits
Intelligence modules
Overview / Defense & resilience
Defense & resilience
Only validated defensive observations: patch coverage (fix evidence), the calibrating Identity & Trust measure, and the remediation-pressure uplift. Defensive effectiveness is not measured, and nothing here implies it.
Intelligence modules
Overview / Data confidence
Data confidence
The governed sources by tier, how recent each dataset is, the stored history, methodology and collection limitations. Per-source status is on Source health.
Sources & data freshness LIVE Operational
Monitored sources
- Loading…
Public status only; internal diagnostics stay private.
Feeds & sources Operational
Every governed source by tier, from production’s source-health model. A category whose source plane did not answer is stated unavailable, never healthy and never zero sources.
Read when this view opens.
Sources behind the live evaluation LIVE
Intelligence modules
Overview / Research
Research
Every research dataset ICHI collects, including those that are not scored and not on the homepage. Sections read their data when they first open; links go to the existing pages that hold the full records, filters and archives.
AI research Observational · not scored
No AI score exists in ICHI and none is shown. These are research observations, each with its own source and limits.
AI Exposure Watch (/api/ai-watch · daily)
Read when this section opens.
AI Exposure Watch — every field and its daily history (/api/ai-watch)
Read when this section opens.
AI-assisted offensive operations (/api/actor-ops · vendor statements; ICHI does not confirm)
Read when this section opens.
Zero-days and AI (/api/zero-days · ai)
Read when this section opens.
AI service status (/api/outages · group ai; informational, never scored)
Read when this section opens.
Full records: AI-assisted operations · Research (AI Exposure Watch history) · Zero-day trends · Methodology
Emerging vulnerabilities · pre-KEV Research-confirmed · not scored
Read when this section opens.
The ranked list with its category filter is in Vulnerability pressure → Priority vulnerabilities. Every record, the ten filters (priority, all pre-KEV, pre-CVE, independent, vendor, exploited, no patch, edge, internet exposed, all tracked), record views and the claims section are on Research (pre-KEV).
Athena disclosures Chainguard Athena · disclosure, not exploitation · not scored
Read when this section opens.
The disclosure gap (silent fixes) is in Vulnerability pressure. Athena rows join Priority vulnerabilities only within 30 days of disclosure.
Threat actors & ransomware
- Ransomware ecosystem — leak-site claims by group and day (RansomLook; claims are unverified), group activity
- AI-assisted operations — vendor-attributed actor statements and dual-use tools
- Threat actors (dimension T) — actor reporting from 17 sources
- Command & control — ThreatFox / abuse.ch C2 servers by family
- Phishing — daily phishing domains and URLs, TLDs
- Zero-day trends — confirmed, under-review and rapid N-day classes over 30 / 60 / 90 days
Incidents
- Incident ledger — confirmed, reported and claimed incidents, search, record pages
- Sector evidence — incidents, claims and ICS advisories per sector
- Key intelligence — every governed event
- Priority history — every item that held the homepage priority list
Infrastructure & geography
- DDoS activity — Cloudflare Radar layer 3/4 and 7, origin and target locations, pairs, vectors, botnets, threat reports
- Outages — 55 vendor status pages by tier (informational)
- Edge exposure — edge-device flaws, exploitation observed, KEV, exposure
- Attack surface — Internet-facing services by category and country (infrastructure location)
- Internet health — PKI, naming and routing trust-root developments
- Identity & trust — the calibrating shadow tier and its categories
- Defensive depth · Patch coverage
Sources & telemetry
- Data confidence — every governed source by tier, freshness, the live evaluation's feeds, observability strips
- Evidence & sources — source registry and health
- Data & exports · Build your export — datasets including index history, incidents, comparisons and AI tools
- Methodology — VECTORS v7.1, every source and limitation
Historical intelligence
- Pressure history — every recorded daily score, partial days labelled, comparisons
- Weekly briefing · Why the index moved
- Priority ranking (shadow) · Priority history
- Daily record (CSV)