How we score events

Every event on this feed carries three of our own judgements and a set of external signals we quote. This page defines all of them, so you never have to guess what a label means, or hover to find out.

Our own judgements

These are ours. We assign them, and we can be wrong, so each one is shown alongside the evidence it rests on.

UK priority: Our triage band for UK organisations: Critical, High, Medium, Low or Informational. It reflects the evidence, how relevant the exposure is, and how soon action is warranted.
Action window: How soon to confirm exposure and act, shown as a date: “Act by 9 Nov”, or “Window passed” once that date has gone by. It is guidance for triage, not a legal deadline.
Confidence: How strongly independent sources corroborate the key facts. Evidence-weighted, not a popularity score or a guarantee the incident affects you.
Exploitation: Whether attackers are already using this issue, or its estimated attack likelihood is elevated. Confirmed in-the-wild use is stronger than a probability score alone.
Independence groups: Distinct outlets or roles counting separately toward corroboration. Syndicated copies of one release count as one independence group.

Why there is no Critical filter

Critical is the top band, but the feed does not offer it as a filter. An event only reaches Critical with authoritative evidence, such as the known-exploited catalogue or an official advisory, or with a person's approval, and every Critical event is held for editorial review before it is published. Because exposure is scored at a default for every reader (see below), automatic scores stay under the Critical line, so the filter would always be empty.

Why an event can rank lower than you expect

UK priority blends five scores. One of them, organisation exposure, is the same standard default for every reader, because the feed does not know your systems or suppliers. An actively exploited flaw can therefore show as Medium. If you run the affected product or depend on the named organisation, treat the event as more urgent than its band. Where the default is what holds an event back, its page says so next to the band.

Why action windows are dates

The window runs from the event's last material update, so we show it as a date: “Act by 9 Nov”. Once the date has passed it says so (“Window passed 7 Oct”) instead of repeating a duration that no longer means anything.

How to read the coverage signals

Each event shows who has reported it: an official authority, the affected vendor, independent researchers, and independent reporting. A story carried only by one of these is an early signal, not a confirmed picture.

We weight evidence rather than volume. Ten outlets repeating one press release is still one perspective, so the coverage bar counts independent perspectives, not articles. Where a perspective is missing we say so explicitly rather than leaving a gap you cannot see. Coverage gaps lists the events where the picture is still thin.

External standards we quote

These come from third parties. We pass them through with attribution and do not adjust them; where a name is jargon, we say what it means in plain English.

Known-exploited catalogue: Listed by CISA as actively exploited in the wild. Treat it as confirmed exploitation activity against this vulnerability, but still confirm whether you are exposed.Also known as: KEV, CISA KEV
Estimated attack likelihood: A model estimate of the chance this vulnerability will be attacked in the next 30 days. It is a probability signal, not confirmed exploitation.Also known as: EPSS
Percentile: Where this vulnerability’s estimated attack likelihood ranks among other CVEs. A higher percentile means more likely than most others, but it is still not confirmed exploitation.
CVSS: Common Vulnerability Scoring System: a vendor-neutral severity score (0–10) for how bad a vulnerability can be if exploited. Severity is not the same as active exploitation.Also known as: Common Vulnerability Scoring System
CWE: Common Weakness Enumeration: a catalogue identifier for the type of software weakness, for example injection or path traversal.Also known as: Common Weakness Enumeration
CPE: Common Platform Enumeration: a structured product identifier used to match affected software and hardware in vulnerability databases.Also known as: Common Platform Enumeration
NVD: US National Vulnerability Database: an authoritative catalogue of CVE records, severity scores and affected-product data.Also known as: National Vulnerability Database
NVD record status: How far the US National Vulnerability Database has got with its own record for this CVE. “Analyzed” means NVD has finished scoring it. This describes NVD's workflow, not our assessment.
Ransomware campaign use: CISA’s catalogue field noting whether ransomware operators are known to have used this vulnerability. “Known” does not mean your organisation has been breached.
Actor claim: A threat-actor or leak-site listing only. It is useful as an early supplier warning, but it is not proof of a confirmed breach.

The event timeline

Events change as reporting lands. The Pulse timeline on each event page records what changed and when. Every mark on it is one of these.

Escalation: An update that pushes the event up: a higher UK priority, a shorter action window, or stronger evidence. It is drawn above the line.
De-escalation: Anything that lowers the event: a lower priority band, a fall in estimated attack likelihood, or a quiet recheck that found nothing new. It is drawn below the line.
Story: A new reporting source linked to this event. Review it against your estate; one story alone is not automatic confirmation of impact.
Signal: A material change in exploitation, enrichment or urgency for this event, such as a new catalogue listing or a rise in estimated attack likelihood.
Critical / live: The moments that matter most: a vulnerability joining the known-exploited catalogue, or a ransomware group listing a victim. These are the only red marks on the trace.

Under the trace, the status line says when the event was last rechecked. When a scheduled recheck has not happened yet it says the recheck is overdue, rather than showing a time that has passed.

Keyboard shortcuts

A shortcut nobody can find is a shortcut that does not exist, so here they are.

Ctrl K, or ⌘K on a Mac: Open search from anywhere.
Esc: Close search or any dialog.
Tab, then Enter: Use the skip links to jump past the header, and then past the filters straight to the stories.

What this feed is not

This is general information for UK IT managers and business leaders, not official government or law-enforcement advice, and not a substitute for your own assessment of your estate. Our summaries are AI-assisted and reviewed against the sources we cite; read our AI responsibility statement for how that works and where its limits are.