All three datasets on one timeline
The global CVE firehose, Microsoft's Patch Tuesday, and US breach counts, together. They measure different things at different scales — all published CVEs (tens of thousands a year), one vendor's monthly releases (hundreds), and reported US data compromises (thousands) — so each gets its own panel and its own scale on one shared year axis. Compare timing and shape, never heights across panels. All three rose between 2023 and 2026, at different times.
US breaches stepped up 78% in 2023, a year before the CVE surge
All CVEs published worldwide, Microsoft Patch Tuesday CVEs per calendar year, and ITRC's US data compromises. Each panel has its own scale. The Patch Tuesday dataset starts in 2018, so the panels share 2018–2025; earlier CVE and ITRC years are on their own pages, and 2026 is partial for every series.
The monthly series, on one month axis
disclosureexploitationbreach disclosureEvery series here that is published monthly. Each strip has its own scale. Tap or move across any strip to read the same month in all of them. A "no data" bracket marks months a source does not cover: KEV began in November 2021, the leak-site series starts in 2023, and Patch Tuesday months after the last reviewed release are not yet in the dataset.
About this series
Recent months keep rising as victims are posted late; see Live.About this series
The month loaded can be years after the breach itself.How the three relate
Microsoft's slice of the whole
Microsoft's 1,150 Patch Tuesday CVEs in 2025 were about 2.4% of the 48,185 published worldwide. One major vendor is a small fraction of the global firehose — most CVE volume comes from the sprawling third-party ecosystem (WordPress plugins, the Linux kernel, thousands of smaller projects).
rose, then broke pattern
Global CVEs jumped 38% in 2024 and 21% in 2025. Microsoft's months stayed at or below 177 CVEs until 2026, when Jun 2026 (208), Jul 2026 (621), Aug 2026 (398), Sep 2026 (972) and Oct 2026 (1,415) broke that ceiling. And US breach counts moved first — the 78% step-up landed in 2023 and held. Three different measures, all off their baselines within the same three-year window.
but they aren't the same signal
The global rise has documented structural contributors, more issuers (CNAs) and disclosure completeness, though no public source says how much each explains. Microsoft's rise is a single vendor's own release cadence. Reading them as one "AI is causing more bugs" trend conflates two very different mechanisms — which is exactly the mistake this site exists to avoid.
The honest combined read
Put together, the three datasets say the same careful thing: disclosure volume, Microsoft's own releases, and reported US breaches all broke their baselines in the 2023–2026 window. That correlation is real and worth watching — and the breach data adds the one consequence-side signal: vuln exploitation became the #1 breach entry vector in 2026. What none of these show — separately or combined — is that AI is the cause. The confounders (CNA expansion, the NVD enrichment collapse, breach-notification law growth, Microsoft's internal tooling) are large, documented, and unquantified. The combined view sharpens the question; it doesn't answer it. The full reasoning is on the AI Question page →