Time to exploit and breach counts, month by month
The other pages are built from annual reports. These eight series come straight from seven public feeds, re-collected every week by collectors anyone can run from Substrate. Each breach source counts a different population, so they are never added together.
Time to exploit
Measured as the days from a CVE's public record (CVE.org) to CISA adding it to the Known Exploited Vulnerabilities catalog, over CVEs published since the catalog launched on 2021-11-03. CISA lists a bug only after exploitation is confirmed, so this is an upper bound on the real time to exploit.
This is a different measure from Mandiant's 5-day average for 2023 on the AI page. Mandiant counts from disclosure to the first exploitation its telemetry saw, on its own sample, so its figure runs shorter. This series is slower but public, monthly and recomputable by anyone.
In Sep 2026, 58% of KEV listings came within 7 days of the CVE
How fast each month's KEV listings came, by share. Each column is one month of KEV listings, among CVEs published since KEV launched. Bands, brightest first: listed on or before the CVE's publication day, within 7 days, within 30 days, later. Column width grows with the month's sample (n = 3–43), so a month resting on few listings is drawn thin; the tick is that month's median. Older CVEs CISA newly listed are left out.
Medians below zero
A median below zero (Oct 2022, Nov 2022) means most of that month's bugs were listed by CISA before their CVE.org record was published, as happens with zero-days and coordinated disclosures.Breaches, by source
There is no census of breaches. Each series below counts one population and has its own blind spot, written under its chart.
Eight live series on one monthly axis
exploitationbreach disclosurecounting changeEach strip has its own scale, so read shapes and timing, never heights against each other. Tap or move across any strip to read the same month in every strip. Hatched = month in progress (for SEC Dec 2023, the rule was in force from Dec 18 only). A dashed seam marks a dated change in how that source counts; its number matches the list under the chart.
About this series
Every catalog addition, including older CVEs CISA newly confirmed as exploited.About this series
The same medians as the columns above, as a line.About this series
organizations posted on extortion leak sites (mostly victims who did not pay), worldwide. Groups that get paid usually do not post the victim. Months are bucketed by ransomware.live's estimated attack date, and victims keep being posted for months afterwards, so recent months will keep rising.About this series
US public companies disclosing a cybersecurity incident they judged material, since the SEC rule took effect on 2023-12-18. Companies decide materiality themselves, and since May 2024 SEC staff have steered incidents not judged material to Item 8.01, counted separately in the next strip. 26 8-K/A amendments are linked to their originals in the dataset and not counted.About this series
US public companies reporting their own cybersecurity incident under Item 8.01 rather than Item 1.05, which SEC staff encouraged from 2024-05-21 for incidents not judged material (statement). 70 filings so far. Found by a phrase screen in code whose precision has not been checked against labels.About this series
businesses and state agencies submitting a sample breach notice to the California AG because the notice went to more than 500 California residents. By the date the notice was submitted, not the date of the breach (basis).About this series
HIPAA covered entities and business associates reporting a breach of unsecured protected health information affecting 500 or more individuals. By submission date. OCR posts reports after they are submitted, so the newest months undercount; the newest submission in this pull is 2026-10-05.About this series
verified breaches of online services whose data surfaced publicly, by the month HIBP loaded them. The month loaded can be years after the breach itself.- 1 2023-05-27 · Cl0p's MOVEit Transfer mass exploitation begins. One campaign against one file-transfer product stole data from many organizations at once from late May 2023; each victim can then appear separately as a notice, a leak-site post or a breach-report case. Verizon's 2024 DBIR names MOVEit as a driver of its near-tripling of exploitation as a breach entry point. Series covering 2023 data can carry a one-campaign bulge. ITRC's 2023 release says zero-day attacks jumped and supply-chain victims surged but does not name MOVEit. Source
- 2 2023-12-18 · SEC Form 8-K Item 1.05 disclosures become mandatory. Before this date there was no Item 1.05, so the series starts here by construction; any count before it is zero because the item did not exist, not because there were no material incidents. The rule was adopted July 26, 2023 and effective September 5, 2023, but incident disclosure was not required until this compliance date. Source
- 3 2023-12-19 · FBI disrupts ALPHV/BlackCat and seizes its websites. A law-enforcement action against a group the DOJ calls the second most prolific ransomware-as-a-service variant by ransoms paid, including seizure of its websites. Leak-site victim counts and distinct-group counts around this date can reflect what the tracker could see after the seizure, not only how many organizations were attacked. Source
- 4 2024-02-20 · Operation Cronos takes over LockBit's leak site. The NCA took control of LockBit's administration environment and its public leak site; the NCA calls LockBit the world's most harmful cyber crime group. Leak-site victim and group counts from this month onward can reflect the takedown as well as attack volume. Source
- 5 2024-05-21 · SEC staff statement steers non-material incidents from Item 1.05 to Item 8.01. The Director of Corporation Finance asked companies to file incidents they judged immaterial, or had not yet judged, under Item 8.01 rather than Item 1.05. Item 1.05 counts after this date cover a narrower set of filings than before it, so a fall in Item 1.05 filings after May 2024 can be a filing-practice change. The Item 8.01 cybersecurity series is the other half and carries this marker too. Source
- 6 2024-06-15 · Smaller reporting companies come under Item 1.05. Smaller reporting companies had 180 extra days, so the population that must file Item 1.05 widens on this date. A rise in filings after mid-June 2024 can come from more companies being covered. Source
Reproduce these numbers
Every series on this page is rebuilt by one command from the public dataset: bun Data/Vulnerability-And-Breach-Data/collectors/collect.ts in a Substrate checkout. The raw outputs, with a provenance block in every file, are in the dataset's live folder. How each series is computed: Methodology → · About →