04 · Sources

Every number, traceable

Primary sources by section. Where two sources disagreed, both are cited in the data files. Vendor telemetry is flagged as such throughout.

The raw data — public, in Substrate

Every chart on this site renders from a JSON data file, and every data file is published in Substrate (open-source components of human knowledge) with per-figure source URLs inside. Cite them, diff them, or prove them wrong:

patch-tuesday.json — 103 months of Microsoft Patch Tuesday
cve-macro.json — annual CVE totals 2016–2026, NVD backlog, CNA growth
cwe-types.json — CWE Top 25 rank shifts + memory-safety data
ai-discovery.json — the AI-finds-bugs evidence corpus, both sides
attacker-trends.json — KEV, zero-days, time-to-exploit
attacker-cases.json — dated AI-attack cases with confidence labels
breaches.json — ITRC, Verizon DBIR, IBM cost series

Dataset home: substrate/Data/Vulnerability-And-Breach-Data — includes the answer-first summary doc, update log, and source notes.

Every number, traceable

The raw data — public, in Substrate

CVE volume & the NVD backlog

Patch Tuesday

Breach data

Vulnerability types

AI discovery (defender)

AI attack & exploitation (attacker)

Skepticism & counter-evidence