Every number, traceable
Primary sources by section. Where two sources disagreed, both are cited in the data files.
The raw data, and where it is published
Every chart on this site renders from a data file. Each of them is published in Substrate (open-source components of human knowledge). Most figures carry their own source URL; the figures that still lack one are listed in each file's list of gaps. Cite them, diff them, or prove them wrong:
- Microsoft Patch Tuesday, 106 months
- Annual CVE totals 2016–2026, the NVD backlog and CNA growth
- CWE Top 25 rank shifts and memory-safety data
- The AI-finds-bugs evidence, both sides
- Zero-days and Mandiant time to exploit
- The AI-involvement ledger: every documented case, its tool class, observer, outcome and evidence grade, with the quoted span
- ITRC, Verizon DBIR and IBM cost series
- The outcome reports: every edition and metric charted on Outcomes, with the quoted span
- The outcome hypotheses on The AI Question
- Dated changes in how sources count
The live series are collected in Substrate itself, so the numbers and the code that fetched them sit side by side:
- Time to exploit: one row per KEV entry, plus the monthly series
- SEC 8-K Item 1.05, leak-site victims and HIBP, monthly and separate
- Each conjecture, its refutation condition and its computed status
- The full CISA KEV catalog as fetched
- CVE.org publication date for every KEV CVE
- California Attorney General breach notices, with the monthly series
- HHS OCR breach reports (500+ people), with the monthly series
- SEC 8-K Item 1.05 filings with amendments linked, and the Item 8.01 incident series
- CVEs whose CVE.org record credits a listed AI tool, monthly
- CVEs per month by numbering authority, with severity and tracked weakness classes
Dataset home: Vulnerability and breach data in Substrate, with the answer-first summary, the collectors, the update log and source notes.
Outcome reports, edition by edition
Every edition the Outcomes page reads, linked to the page each figure came from. The dataset keeps one row per edition and metric, with the quoted span.
IC3
- 2011 Internet Crime Report
- 2012 Internet Crime Report
- 2013 Internet Crime Report
- 2014 Internet Crime Report
- 2015 Internet Crime Report
- 2016 Internet Crime Report
- 2017 Internet Crime Report
- 2018 Internet Crime Report
- 2019 Internet Crime Report
- 2020 Internet Crime Report
- 2021 Internet Crime Report
- 2022 Internet Crime Report
- 2023 Internet Crime Report
- 2024 IC3 Annual Report
- 2025 IC3 Annual Report
Chainalysis
- 2026 Crypto Crime Report, ransomware chapter (blog, 2026-02-26)
- 2025 Crypto Crime Report, ransomware chapter (blog, 2025-02-05)
- 2024 Crypto Crime Report, ransomware chapter (blog, 2024-02-07)
- 2023 Crypto Crime Report, ransomware chapter (blog, 2023-01-19)
- 2022 Crypto Crime Report, ransomware preview (blog, 2022-02-10)
- 2021 Crypto Crime Report, ransomware excerpt (blog, 2021-01-26)
Coveware
- Q2 2026 quarterly report (published 2026-07-29)
- Q1 2026 quarterly report (published 2026-04-30)
- Q4 2025 quarterly report (published 2026-02-03)
- Q3 2025 quarterly report (published 2025-10-24)
- Q2 2025 quarterly report (published 2025-07-23)
- Q1 2025 quarterly report (published 2025-05-01)
- Q4 2024 quarterly report (published 2025-02-04)
- Q3 2024 quarterly report (published 2024-11-01)
- Q2 2024 quarterly report (published 2024-07-30)
- Q1 2024 quarterly report (published 2024-04-17)
- Q4 2023 quarterly report (published 2024-01-26)
- Q3 2023 quarterly report (published 2023-10-30)
- Q2 2023 quarterly report (published 2023-07-21)
- Q1 2023 quarterly report (published 2023-04-28)
- Q4 2022 quarterly report (published 2023-01-20)
- Q3 2022 quarterly report (published 2022-10-26)
- Q2 2022 quarterly report (published 2022-07-28)
- Q1 2022 quarterly report (published 2022-05-03)
- Q4 2021 quarterly report (published 2022-02-03)
- Q3 2021 quarterly report (published 2021-10-21)
- Q2 2021 quarterly report (published 2021-07-23)
- Q1 2021 quarterly report (published 2021-04-26)
- Q4 2020 quarterly report (published 2021-02-01)
- Q3 2020 quarterly report (published 2020-11-04)
- Q2 2020 quarterly report (published 2020-08-03)
- Q1 2020 quarterly report (published 2020-04-29)
- Q4 2019 quarterly report (published 2020-01-23)
- Q3 2019 quarterly report (published 2019-11-01)
- Q2 2019 quarterly report (published 2019-07-16)
- Q1 2019 quarterly report (published 2019-04-16)
- Q4 2018 quarterly report (published 2019-01-22)
Coalition
- 2026 Cyber Claims Report (published 2026-03-05)
- 2025 Cyber Claims Report (published 2025-05-07)
- 2024 Cyber Claims Report: Mid-year Update (published 2024-10-10)
- 2024 Cyber Claims Report (published 2024-04-24)
- 2023 Cyber Claims Report: Mid-year Update (published 2023-09-20)
- 2023 Cyber Claims Report (published 2023-05-16)
- 2022 Cyber Claims Report: Mid-year Update (published 2022-09)
- 2022 Cyber Claims Report (file dated 2022-03)
CrowdStrike
Unit 42
- 2026 Global Incident Response Report
- 2026 Global Incident Response Report (prior-year comparison)
- 2025 Global Incident Response Report
- 2025 Global Incident Response Report (prior-year comparison)
- 2025 Global Incident Response Report: Social Engineering Edition
- Incident Response Report 2024
- Incident Response Report 2024 (prior-year comparison)
- Incident Response Report 2022
AI-involvement ledger (primary documents)
- OpenAI: Disrupting malicious uses of AI by state-affiliated threat actors
- Arup (spokesperson statement reported by CNN): British engineering giant Arup revealed as $25 million deepfake scam victim | CNN Business
- HP Wolf Security: HP Wolf Security Uncovers Evidence of Attackers Using AI to Generate Malware
- Google Project Zero: From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code
- XBOW: How XBOW Ranked #1 in Autonomous Penetration Testing | XBOW
- Google: A summer of security: empowering cyber defenders with AI
- CERT-UA: Кібератаки UAC-0001 на сектор безпеки та оборони із застосуванням програмного засобу LAMEHUG, що використовує LLM (велику мовну модель) (CERT-UA#16039)
- DARPA: AI Cyber Challenge marks pivotal inflection point for cyber defense | DARPA
- ESET: First known AI-powered ransomware uncovered by ESET Research
- Anthropic: Detecting and countering misuse of AI: August 2025
- Wiz: s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know | Wiz Blog
- OpenAI: Introducing Aardvark: OpenAI’s agentic security researcher
- Google GTIG: GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools | Google Cloud Blog
- Anthropic: Disrupting an AI-orchestrated cyber espionage campaign
- Mozilla: Hardening Firefox with Anthropic’s Red Team | The Mozilla Blog
- Mozilla: The zero-days are numbered | The Mozilla Blog
- Google GTIG: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access | Google Cloud Blog
- Zenity Labs: Real-World AI Infrastructure Attacks: What Honeypots Reveal
- Palo Alto Networks Unit 42: Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks
- Cisco Talos: UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
- Anthropic: Countering misuse of AI: September 2026 / Anthropic
- Google GTIG: GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI | Google Cloud Blog
Breach registries and filings
Changes in how sources count
- 2016-11 — CVE Numbering Authority expansion begins
- 2020 — ITRC switches its impact measure from records exposed to individuals impacted
- 2021-11-03 — CISA creates the Known Exploited Vulnerabilities catalog (BOD 22-01)
- 2023-05-27 — Cl0p's MOVEit Transfer mass exploitation begins
- 2023-12-18 — SEC Form 8-K Item 1.05 disclosures become mandatory
- 2023-12-19 — FBI disrupts ALPHV/BlackCat and seizes its websites
- 2024-02-15 — NVD posts its analysis-delay notice; enrichment slows
- 2024-02-20 — Operation Cronos takes over LockBit's leak site
- 2024-05-01 — DBIR redefines its human-element metric
- 2024-05-01 — DBIR adds a third-party involvement metric
- 2024-05-21 — SEC staff statement steers non-material incidents from Item 1.05 to Item 8.01
- 2024-06-15 — Smaller reporting companies come under Item 1.05
- 2025 — IC3 adds an "AI Related" descriptor (AI-tagged figures only)
- 2025 — Most breach notices no longer say how the attacker got in
- 2026-03-31 — CVE Program reaches 500 CNAs
- 2026-04-15 — NIST stops enriching most new CVEs by default
- 2026-06-10 — BOD 26-04 replaces BOD 22-01; KEV inclusion criteria stay the same
- 2026-07-28 — CVE Program lets Anthropic and OpenAI assign CVE IDs for what they find
- 2026-07-27 — GitHub gates its public bug bounty on HackerOne signal, citing AI-generated reports
- 2026-05 — Apple can pause a researcher's reports for 180 days over unvalidated AI findings
- 2026-10-22 — Ledger source list adds Mozilla’s two reports of AI-found Firefox bugs
Tests registered on 2026-10-20 and 2026-10-22 (the event studies retrospectively): tested releases and confounders
- Operation Cronos: NCA-led disruption of LockBit
- MOVEit mass exploitation by CL0P
- Ransom payment rate at a historical low (Coveware)
- BOD 26-04 replaces BOD 22-01; KEV inclusion criteria unchanged
- SEC Form 8-K Item 1.05 disclosures begin
- Overlapping release: Claude 3.5 Sonnet released (closed)
- Overlapping release: DeepSeek-R1 released with open weights (open-weight)
- HexStrike AI MCP agent framework published on GitHub
CVE volume & the NVD backlog
Patch Tuesday
Breach data
- ITRC — annual data breach reports (2016–2025)
- ITRC 2025 annual report announcement
- Verizon DBIR — 2024 edition (vuln exploitation +180%)
- Verizon DBIR — 2025 edition
- Verizon DBIR — 2026 edition (vulns overtake credentials)
- SecurityWeek — DBIR 2026 analysis
- IBM Cost of a Data Breach 2026 (IBM report page)
- IBM Cost of a Data Breach (via databreachcost.com index)
- CyberScoop — IBM 2025 report coverage