03 · Analysis · all datasets

What all the data says, taken together

Every other page carries one dataset. This page carries the standing questions, asked across all of them — the CVE decade, 106 months of Patch Tuesday, the CWE type rankings, the AI-discovery and attacker evidence, and the breach series. It's rebuilt whenever a source is added; the build fails if a dataset isn't covered here.

Where AI shows up, layer by layer

Every monthly series compares the same months a year apart (Jan–Sep 2025 against Jan–Sep 2026, ending at the last complete month of the CVE record). Figures from annual reports cover the period each report covers, named beside the figure, and are context, not part of that comparison. Each layer shows four things: what the data shows, how this site reads it, the best rival explanation with what would prove the read wrong, and the evidence grade. The reads are interpretation and are labelled as such; every figure is computed from the data files at build time and links to its source.

The short version interpretation

AI's effect is clearest where bugs are found: the CVE record grew ×2.1 year over year, spread across 294 numbering authorities and concentrated in the bugs that take reading code. Confirmed exploitation rose +34%, much slower. Attackers have moved from chat assistants to agents in documented cases. Defenders report strain: 5 reports from 2026-10-19 to 2026-10-31 describe incident-response firms at or past capacity, and vendor surveys put 28–63% of alerts uninvestigated (63% is this site's 100 − 37); no source here measures what caused it. Breach counts, ransom payments and detection times have not moved with discovery yet, and while defenders report being past capacity those counts cannot by themselves show that harm is flat. Fraud is where victims themselves report AI.

Layer	What moved	Is AI the cause? interpretation
Discovery	CVEs 33,614 → 71,056 (×2.1); reasoning-heavy classes ×3.1, scanner-era −4%	Strong pattern; AI's share not measured
Exploitation	KEV additions 183 → 246 (+34%) against CVEs +111%	Rising, far slower; no series records AI
Attacker operations	Ledger reports 3 → 11; agents or frameworks 2 → 9	Documented cases, mostly provider-reported
Defender capacity	5 reports of incident-response firms at capacity, 2026-10-19 to 2026-10-31; 28–63% of alerts uninvestigated (63% is this site's 100 − 37) in three vendor surveys	Strain documented in reports; AI's share not measured
Victim outcomes	Ransomware leak-site victims +29%, California AG +2%, HHS OCR −6%	Not visible; no series records AI
Fraud	IC3 losses mentioning AI at least $893M of $20.9B (2025)	Documented floor, not a share

Discovery: the CVE record doubled, and the growth is broad, serious and in the bugs that take reading code

Where the 37,442 extra CVEs came from

CVEs published Jan–Sep 2026 minus Jan–Sep 2025, by the numbering authority that published them: the five largest growers and everyone else.

GitHub (open-source advisories)+8,9221,984 → 10,906
VulnCheck+4,922232 → 5,154
Linux kernel+4,6582,491 → 7,149
Oracle+2,841235 → 3,076
Google Chrome+2,825110 → 2,935
Everyone else (419 authorities)+13,27428,562 → 41,836

Source: per-authority CVE counts (Substrate), counted from CVE.org's own records · fetched 2026-10-30.

What the data shows

CVE.org published 71,056 CVEs in Jan–Sep 2026, against 33,614 in Jan–Sep 2025 (×2.1). Of 424 numbering authorities publishing in either window, 294 numbering authorities grew and 116 shrank. The five largest growers account for 65% of the added CVEs: GitHub (open-source advisories) 1,984 → 10,906, VulnCheck 232 → 5,154, Linux kernel 2,491 → 7,149, Oracle 235 → 3,076 and Google Chrome 110 → 2,935. The other 419 authorities together went from 28,562 to 41,836 (+46%).

The weakness mix moved. The classes scanners have found in bulk for years (Cross-site Scripting, SQL Injection, Cross-Site Request Forgery (CSRF) and Unrestricted Upload of File with Dangerous Type) went from 10,075 to 9,641 (−4%), while the tracked authorization, server-side, memory and concurrency classes went from 7,232 to 22,559 (×3.1). Severity moved with it: of CVEs the authority scored, 47% → 55% were high or critical, and critical CVEs went from 1,965 to 6,163.

The same checks without the five largest growers: scanner-era classes −23%, the other tracked classes ×2.1, and the high-or-critical share 45% → 50%. 10,389 more CVEs than a year earlier name no weakness at all; 4,658 of them are Linux kernel records, which name none, so the kernel's growth sits outside the class comparison.

Microsoft's monthly releases show the same jump inside one vendor: 854 CVEs in Jan–Sep 2025, 2,754 in Jan–Sep 2026. Its largest release on record is Oct 2026, at 1,415. CVEs whose record credits a listed AI tool went from 13 to 375 over the same months; the first month with ten or more was Oct 2025, and Sep 2026 had 138. That count is a floor: most records name no tool. The table below the card lists every tracked weakness class.

Our read interpretation

AI-assisted code review is the likeliest single reason for the size and shape of this growth.

The growth is spread across most authorities, including vendors such as Microsoft and Oracle whose counting rules have nothing to do with each other. It is concentrated in the bugs that need reading code or reasoning about logic (missing or incorrect authorization, object references, use-after-free, races), which is what a model reading source finds, while the bugs scanners have found for years barely moved. It also skews more severe, which counts against the growth being low-value noise. The rising AI-credit floor fits the same picture.

This is an inference from pattern and timing: no source attributes the surge, and AI's share of it is not measured.

What the read rests on

✓ the CVE record grew at least ×1.8 (×2.1)
✓ numbering authorities that grew outnumber those that shrank at least two to one (294 to 116)
✓ the reasoning-heavy classes grew at least ×1.5 while the scanner-era classes grew no more than 20% (×3.1 and −4%)
✓ the high-or-critical share of scored CVEs rose (47% to 55%)
✓ without the five largest growers, the reasoning-heavy classes still outgrow the scanner-era ones by half again and severity still rises
✓ CVEs crediting a listed AI tool rose (13 to 375)

Rival explanation

Counting policy at a handful of authorities. The Linux kernel publishes a CVE for most fixes, and Google reports that kernel CVEs alone ran to about 5,000 from January to August 2026 with no zero-day exploitation observed (Google Threat Intelligence); GitHub's advisories and VulnCheck's backfilled records grew sharply; the CVE Program passed 500 numbering authorities on 2026-03-31, and Anthropic and OpenAI became authorities on 2026-07-28. This read is wrong if the shift toward reasoning-heavy classes and higher severity disappears once the largest growers are set aside, or the growth narrows to a few authorities in later windows. On this window it survives: the checks without the five largest growers are in the third paragraph above.

Evidence grade

documented for the AI-credited floor; AI's share of the growth: not yet measurable

Sources

Per-authority CVE mix (Substrate) · AI-credited CVEs (Substrate) · Tracked weakness classes (Substrate) · CVE.org records (cvelistV5) · ZDI's Oct 2026 Patch Tuesday review · Google Threat Intelligence

Tracked weakness classes, Jan–Sep 2025 against Jan–Sep 2026

Weakness class	Kind	Jan–Sep 2025	Jan–Sep 2026	Change
Authorization Bypass Through User-Controlled Key CWE-639	authorization	206	1,423	×6.9
Incorrect Authorization CWE-863	authorization	267	1,586	×5.9
Server-Side Request Forgery (SSRF) CWE-918	server side	354	1,685	×4.8
Use After Free CWE-416	memory	375	1,773	×4.7
Race Condition CWE-362	concurrency	94	419	×4.5
Integer Overflow or Wraparound CWE-190	memory	139	570	×4.1
Improper Input Validation CWE-20	server side	422	1,408	×3.3
OS Command Injection CWE-78	server side	510	1,685	×3.3
Path Traversal CWE-22	server side	652	2,148	×3.3
Out-of-bounds Write CWE-787	memory	329	1,034	×3.1
Out-of-bounds Read CWE-125	memory	444	1,389	×3.1
Missing Release of Memory after Effective Lifetime CWE-401	memory	47	143	×3.0
Exposure of Sensitive Information to an Unauthorized Actor CWE-200	server side	392	1,170	×3.0
NULL Pointer Dereference CWE-476	memory	199	493	×2.5
Missing Authorization CWE-862	authorization	1,451	3,429	×2.4
Stack-based Buffer Overflow CWE-121	memory	435	886	×2.0
Deserialization of Untrusted Data CWE-502	server side	453	922	×2.0
Unrestricted Upload of File with Dangerous Type CWE-434	scanner era	506	597	+18%
Cross-site Scripting CWE-79	scanner era	5,396	5,552	+3%
SQL Injection CWE-89	scanner era	2,757	2,728	−1%
Classic Buffer Overflow CWE-120	memory	463	396	−14%
Cross-Site Request Forgery (CSRF) CWE-352	scanner era	1,416	764	−46%

Dimmed rows are the classes scanners have found in bulk for years. Counts are the numbering authority's own weakness entries; a CVE naming two tracked classes counts in both. Source: per-authority CVE mix (Substrate), class list v1.0.0 (Substrate).

Exploitation: rising, but far slower than discovery

What the data shows

CISA added 246 vulnerabilities to its Known Exploited Vulnerabilities catalog in Jan–Sep 2026, against 183 a year earlier (+34%), while CVEs grew +111%. Median days from CVE publication to KEV listing 10 → 8 (n=97 → 163), 2026-04–2026-09 vs 2025-04–2025-09. Over 12-month windows: Median days from CVE publication to KEV listing 10 → 10 (n=209 → 275), 2025-10–2026-09 vs 2024-10–2025-09.

Microsoft CVEs already exploited when the patch shipped: 18 in Jan–Sep 2025, 14 in Jan–Sep 2026, while Microsoft's patched CVEs went ×3.2. Google's telemetry counts 10.5 vulnerabilities exploited per month in 2025 and 18 from January to August 2026, and zero-days 8 and 11 per month, with 22 in August 2026 alone. Google asserts AI is part of the cause: We found that AI is measurably changing not just the pace of vulnerability discovery and exploitation, but also the types and typical risk profiles of vulnerabilities that are being discovered. VulnCheck finds AI-discovered vulnerabilities exploited at about the same rate as the rest (14 of 1,061 exploited (1.3%); Glasswing 23,000+ → 126 CVEs → 1 exploited).

Our read interpretation

Discovery has outrun exploitation, so for now the larger effect lands on defenders as patch volume: far more fixes to test and ship for a smaller rise in confirmed exploitation. If AI is behind the discovery growth, attackers have the same tools and every published patch is a diff to study, so exploitation counts should close part of the gap over the next few quarters. That is a prediction, not a finding.

What the read rests on

✓ KEV additions rose (183 to 246)
✓ KEV additions grew less than half as fast as CVEs (+34% against +111%)

Rival explanation

CISA's catalog confirms exploitation late and selectively, so it undercounts the present; Google's counts are its own telemetry and are not comparable with CISA's. The time-to-exploit reading changes with the window, so it gives no clear direction. This read is wrong if confirmed exploitation keeps growing far slower than discovery for another year, which would mean the extra bugs are mostly ones attackers do not use.

Evidence grade

not yet measurable: no exploitation series records AI, and Google's attribution is its own assertion

Sources

Time to exploit and KEV additions (Substrate) · CISA KEV catalog · Patch Tuesday (Substrate) · Google Threat Intelligence · VulnCheck

Attacker operations: from chat assistants to agents running intrusions

What the data shows

AI ledger attack reports published in Jan–Sep 2025: 3, of which 2 used agents or attack frameworks and 3 reached an intrusion. In Jan–Sep 2026: 11, of which 9 used agents or attack frameworks and 8 reached an intrusion. Of the 2026 reports, 6 come from a model provider reporting misuse of its own model and 3 are confirmed by someone else. For context, outside the comparison: the ledger's earliest year, 2024, holds 7 reports, 5 of them attackers using a hosted model as an assistant and 0 using an agent. Ledger dates are when the document was published. Across the whole ledger, 1 documented AI-assisted attack puts a figure on the loss. From annual reports, each for its own period: CrowdStrike's average eCrime breakout time fell from 98 minutes in 2021 to 29 in 2025. Mandiant's incident responders tag attacker AI use (ATT&CK T1588.007) in 0.2% of cases in M-Trends 2025 and 0.2% of cases in M-Trends 2026, and M-Trends says: However, despite threat actors increasingly leveraging AI, especially during the early phases of the attack lifecycle, we don’t consider 2025 to be the year where breaches were the direct result of AI.

Our read interpretation

How attackers use AI changed within about two years, from asking a chatbot for help with research and code to agents that scan, exploit and move inside networks with a person approving targets. The cases are real, but most come from the providers whose models were misused, and providers can see only their own models, so the scale outside those reports is unknown.

What the read rests on

✓ most of the 2026 attack reports involve agents or attack frameworks (9 of 11)
✓ most of the 2026 attack reports come from the provider whose model was misused (6 of 11)

Rival explanation

A reporting effect: providers publish more misuse reports each year, and an open-weight model run on the attacker's own hardware is invisible to all of them, so the ledger shows what became visible, not how common it is. This read is wrong if independent incident-response tagging of attacker AI use stays near Mandiant's 0.2% while provider reports keep growing; then the change is mostly in what providers publish.

Evidence grade

documented cases; prevalence not yet measurable

Sources

AI ledger (Substrate) · Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access | Google Cloud Blog · Real-World AI Infrastructure Attacks: What Honeypots Reveal · Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks · UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations · Countering misuse of AI: September 2026 / Anthropic · GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI | Google Cloud Blog · M-Trends 2026: att&ck t1588.007 (obtain capabilities: artificial intelligence) observed · CrowdStrike 2026 Global Threat Report: average ecrime breakout time

Defender capacity: firms report turning work away while the main breach registries have not moved

What the data shows

From 2026-10-19 to 2026-10-31, 5 reports from 3 publishers described incident-response firms at or past capacity. 2 of the 5 come from sources that sell no incident-response service.

Debevoise & Plimpton's breach counsel, 2026-10-31: Incident response firms are stretched thin and turning away work, or have wait times of days, not hours. Some victim companies are being forced to check with three or four incident response firms before finding one with capacity.
Troy Bettencourt, as reported by Axios, 2026-10-30 (Axios's words): The same heavy workload is happening across the industry, and even Palo Alto Networks' incident response subcontractors are at max capacity, he said.
Sophos, 2026-10-26: our own IR function has never been busier and is forecasting an industry-wide capacity crunch
Sophos, 2026-10-21: DFIR firms we know are asking whether they can use Sophos to provide overflow support when their teams reach capacity.
Rob Joyce, 2026-10-19: IR firms are saturated & turning away work.

Inside organizations, three vendor-sponsored surveys put the share of security alerts never investigated between 28% and 63%: Prophet Security (ViB, 2026-08-03) 28% of alerts uninvestigated (mean), Crogl (Ponemon Institute, n=649, 2026-03-18) 63% of alerts not investigated (this site's 100 − 37; the survey states that 37% are detected and investigated) and Microsoft (Omdia, n=300, 2026-02-17) 42% of alerts uninvestigated. They ask different questions of different samples, so the range is a level, not a trend, and every sponsor sells a product for the problem.

Against the reports: CrowdStrike Counter Adversary Operations, 2026-10-23: At this time, CrowdStrike Counter Adversary Operations has not observed successful exploitation of these vulnerabilities in the wild or within our honeypot environments. No source in this collection ties a capacity figure to AI by measurement; 4 of the 10 tie the strain to AI in words. All 10 are on Outcomes, quoted, with their labels.

Our read interpretation

Defenders report being past capacity, and none of the counted series in the other layers measures that. In late October 2026 the people who answer breaches said they were turning work away, and three surveys put a large share of alerts unread. Two of the sources tie the strain to attackers using AI, in their own words (Debevoise and Sophos, quoted on Outcomes); this site has no measure of how much of the strain comes from AI or from anything else.

That bears on how to read the breach counts. A breach is counted only after someone finds it, and a breach nobody had time to find never reaches a registry. While defenders report being past capacity, flat breach counts cannot by themselves show that harm is flat.

What the read rests on

✓ at least three incident-response capacity reports from at least three publishers fall within 30 days (5 reports from 3, 2026-10-19 to 2026-10-31)
✓ at least two of them come from sources that sell no remedy (2)
✓ every triage survey puts at least a quarter of alerts uninvestigated (28%, 63%, 42%)
✓ the collection keeps at least one piece of counter-evidence beside the reports (1)
✓ the breach registries stayed within 15% (the victim-outcomes layer)

Rival explanation

A one-month spike tied to one wave of disclosures, not a lasting change in what defenders face. Debevoise itself writes: The truth is that the incident response world was at capacity already even without truly agentic AI attacks. Much of October's demand may be exposure checks rather than intrusions: CrowdStrike, 2026-10-23, had seen no successful exploitation of the month's most-discussed flaws. The triage surveys come from vendors selling AI tools for the SOC and have no earlier reading from the same instrument, so they show that the gap is large, not that it is growing. This read is wrong if incident-response firms report normal capacity within a quarter of the October wave, which would make the strain one event rather than a lasting condition; or the breach registries stay flat for another year while capacity reports continue, which would mean the strain is not keeping breaches from being found.

Evidence grade

documented as reports and vendor surveys; capacity as a series and AI's share of the strain: not yet measurable

Sources

Defender-capacity reports (Substrate) · Debevoise Data Blog · Axios · Sophos blog · Sophos blog · Prophet Security · Crogl · Microsoft Security Blog · CrowdStrike blog

Victim outcomes: no breach series has moved with discovery yet

What the data shows

Jan–Sep 2025 against Jan–Sep 2026, each population on its own and never added together: Ransomware leak-site victims 5,767 → 7,465 (+29%); Breach notices filed with the California AG 419 → 427 (+2%); HIPAA breaches reported to HHS OCR 631 → 594 (−6%); Breaches added to Have I Been Pwned 59 → 102 (+73%); SEC 8-K Item 1.05 filings 11 → 17 (+55%); SEC 8-K Item 8.01 cybersecurity disclosures 14 → 26 (+86%). Extortion groups posting victims averaged 60 a month, then 67. From annual reports, each for its own period: ransomware payments tracked by Chainalysis, both from its latest report: $892M in 2024 as restated, $820M in 2025, an initial estimate. IBM's mean time to identify a breach: 181 days (breaches from March 2024 to February 2025), then 183 (breaches from March 2025 to February 2026). Mandiant's global median dwell time: 14 days in 2025.

Our read interpretation

Discovery doubled, but breach registries, ransom payments and detection times have not moved with it. Extortion listings, active groups and reported fraud losses are up, and no source ties those rises to AI beyond the fraud floors in the next layer. On the data so far, the discovery surge has not shown up in the breach counts. Whether that means it has not reached victims is open: the counts include only breaches someone found, and defenders report being past capacity (the defender-capacity layer above).

What the read rests on

✓ California AG notices and HHS OCR reports each moved less than 15% (+2% and −6%)
✓ Chainalysis's latest ransomware payment total is within 15% of the year before
✓ IBM's mean time to identify a breach moved less than 10%
✓ leak-site victims rose (+29%)

Rival explanation

Breaches lag disclosure. Intrusions that started in 2026 may not be reported for months, so these series could still be catching up; the hidden-disclosure-lag conjecture tests exactly that and reads no metric yet. The labor-bottleneck conjecture, which predicts more active groups as AI fills operator roles, reads not refuted by this metric. Defenders also report being past capacity (the defender-capacity layer above), and a breach nobody had time to find is never reported, so these series cannot by themselves show that harm is flat. This read is wrong if breach registries step up over the next four quarters with no change in how they count; the read would then be that the effect arrived late, not that it never came.

Evidence grade

not yet measurable: no breach registry, filing or leak-site series records AI

Sources

Monthly breach series (Substrate) · Ransomware leak-site victims · Breach notices filed with the California AG · HIPAA breaches reported to HHS OCR · Breaches added to Have I Been Pwned · SEC 8-K Item 8.01 cybersecurity disclosures · Chainalysis 2026 Crypto Crime Report, ransomware chapter (blog, 2026-02-26): annual ransomware payments total · IBM 2026: mean time to identify a breach

Fraud: where victims themselves report AI

What the data shows

Complaints to the FBI's IC3 carried $20.9B in losses in 2025, against $16.6B in 2024. At least $893M of 2025's losses sat in complaints whose reporter mentioned AI: a floor, not AI's share. In IBM's breach studies, the share of breaches the breached organization called AI-driven was 16% in its 2025 study (breaches from March 2024 to February 2025) and 25% in its 2026 study (breaches from March 2025 to February 2026), also a floor set by what victims noticed. The ledger's quantified AI loss is Arup's deepfaked video call.

Our read interpretation

Fraud is where AI's effect on victims is documented directly, because the victim meets the AI: a cloned voice, a deepfaked executive, a fluent lure. IC3's floor cannot show growth yet, because it added its AI descriptor only for 2025; IBM's self-reported share rose from 16% to 25%, which measures what breached organizations noticed as much as what happened.

What the read rests on

✓ IC3 reports losses in complaints that mention AI

Rival explanation

Awareness: victims now expect AI and say so more often, which can raise an AI-tagged count without any change in the fraud. This read is wrong if IC3's AI-tagged losses stop growing faster than its total losses in the next reports.

Evidence grade

documented (floors)

Sources

2025 IC3 Annual Report: ai-related adjusted losses · IBM 2026: share of malicious attacks that were ai-driven · Outcome reports (Substrate)

Q1 — Is AI changing breaches, losses and attack speed?

Each part of the question is answered from the data at build time: the current reading, how it was computed, its evidence grade (estimated with bounds, a point estimate, no interval computed, documented or not yet measurable) and the instrument that would settle it. No answer sentence is fixed in advance.

Breaches and losses

Reading: Reported losses rose: complaints to the FBI's IC3 carried $12.5B in losses in 2023 and $20.9B in 2025, and US data compromises (ITRC) stepped up 78% in 2023 and held. Of 2025's losses, at least $893M sat in complaints whose reporter mentioned AI, and in IBM's 2026 study 25% of malicious breaches were reported by the breached organization as AI-driven. Both are lower bounds: they count only what victims noticed and reported.
Method: Source totals as each edition states them; AI-tagged figures only where the source carries an AI field. No breach registry, filing series or leak-site count records AI, so none of their movement is attributed to it (attribution needs a source that attributes).
Evidence grade: documented
Missing instrument: A victim-side record of the attacker's tooling. Until one exists, AI's share of breaches and losses cannot be measured, only bounded from below.

Attacker speed

Reading: Attacker timelines shortened: CrowdStrike's average eCrime breakout fell from 98 minutes (2021) to 29 (2025), and CrowdStrike asserts that AI accelerated phishing and automated reconnaissance, shortening the time from initial access to impact. (PDF p.2). That is CrowdStrike's own claim, with no measure of how much. 3 event studies, registered retrospectively on 2026-10-22, tested time to exploit around dated releases: closed (Claude 3.5 Sonnet released, 2024-06-21) reads refuted · one event, read after the fact, +13.6d against its pre-trend; open-weight (DeepSeek-R1 released with open weights, 2025-01-20) reads not refuted by this metric · one event, read after the fact, -19.4d against its pre-trend; harness (HexStrike AI MCP agent framework published on GitHub, 2025-07-10) reads not refuted by this metric · one event, read after the fact, -6d against its pre-trend.
Method: Each event study compares the 12 monthly medians after a release with the least-squares line through the 12 before it. The rule and the release dates were registered after these windows had passed, one release per kind of AI tool, and are frozen for every later reading; because the releases were chosen after the outcome data existed, a reading carries less weight than a test registered in advance. Assumption: the pre-release trend would have continued. Uncertainty: one release per tool class and no interval is computed, so a single reading is weak evidence either way, and overlapping releases mean a break cannot be assigned to one class by timing.
Evidence grade: a point estimate, no interval computed
Missing instrument: First-exploitation dates with a recorded method across many vendors, and more releases per tool class, so each test has more than one event.

Documented AI-assisted attacks

Reading: The ledger holds 23 documented AI-assisted attack campaigns, 2024–2026: 6 confirmed by someone other than the model provider, 13 resting only on the model provider's own report and 4 asserted without evidence a reader can check. The attack count reads 14 published documents: 7 model providers' reports (OpenAI, Anthropic and Google GTIG), a victim's own statement (Arup), 2 security researchers' reports (HP Wolf Security and Zenity Labs), a CERT advisory (CERT-UA) and 3 incident-response and threat-intel reports (Wiz, Palo Alto Networks Unit 42 and Cisco Talos). It holds what those documents describe, so it is a partial record, not a census of AI-assisted attacks. 13 involve an attack harness or agent, the class most observers can see. 8 defensive tools and demonstrations are listed separately and not counted.
Method: Primary documents re-read by code; a language model assigns each row's grade, tool class and outcome from its quoted span against written definitions, and no person has yet checked those labels. A campaign reported by several observers counts once. Counts by tool class are what observers saw, never prevalence.
Evidence grade: documented
Missing instrument: Systematic, cross-vendor forensic reporting of the model or tool used in each intrusion, including open-weight models run privately, which no provider can see.

78%

The breach step-up came before the first documented AI-assisted intrusion

US data compromises (ITRC) rose 78% in 2023. The earliest AI-assisted intrusion in the ledger is dated 2024-09-24 (AsyncRAT, graded asserted; ledger dates are when the document was published, not when the attack happened). What the timing shows: no documented AI intrusion predates the step. What it cannot show: the ledger holds only cases someone documented and published, not every case, so the timing neither clears AI nor implicates it.

70%

The attribution vacuum

70% of 2025 US breach notices (2,324) did not say how the attack happened, up from 65% in 2024 (ITRC 2025 Annual Data Breach Report). A dataset that mostly reports the attack vector as unknown cannot confirm or deny an AI effect, and no breach registry has a field for AI at all.

AI-assisted attacks with a quantified loss

Of 23 documented AI-assisted attack campaigns, 1 put a figure on the harm (Arup) and 14 reached an intrusion or named victims. The ledger holds what was documented and could be re-read from a primary source, not a census.

Q2 — If breaches are rising, what are the actual reasons?

Each row names how well the data supports that mechanism.

Mechanism	Evidence class	What the data shows
Vulnerability exploitation as entry	documented	The DBIR vector series rose in each edition: ~5% → 14% → 20% → ~31% of DBIR breaches starting with an exploited vuln, the #1 vector in 2026. DBIR's contributor panel changes between editions, so this is the trend in its caseload.
Faster exploitation, slower patching	reported	Mandiant's average time-to-exploit fell from 63 days (2018–19) to 5 (2023); DBIR 2026's median time-to-patch rose from 32 to 43 days. They are different measures on different populations, so the gap between them is illustrative, not a measured exposure window. The public KEV-based measure is charted monthly on the Live page.
Supply-chain concentration	documented	One exploited platform now yields hundreds of breach notices (MOVEit 2023; in 2024 six mega-breaches made up 85% of ITRC victim notices). Third-party involvement in DBIR breaches doubled to 30% in the 2025 edition and was 48% in 2026.
More complete reporting	structural	Notification laws and disclosure culture inflate the reported series over time — same confounder class as CNA expansion on the CVE side. Some of the rise is measurement, not intrusion.
AI attacker uplift	documented cases; scale unmeasured	NCSC, and Microsoft with OpenAI in February 2024, reported productivity gains, not new techniques. The ledger's later rows add cases: two reports dated 2026 document intrusions run with an attack harness or agent, each graded independently confirmed by an observer other than the provider of the model involved (Palo Alto Networks Unit 42 on Hermes and Cisco Talos on UAT-10147). Possibly a contributor to the speed trend above; no public dataset isolates or quantifies its share of breaches or of the speed-up.

Q3 — What do the data actually tell us?

Supported by the data

Disclosure and breach counts both broke pattern, but on different clocks. Breaches stepped up in 2023; the CVE surge is 2024–2026; Microsoft's records are 2026. Different mechanisms, not one wave.
Disclosure grew ~7.5× in a decade; reported US compromises roughly 3×. These are differently scoped counts (global CVEs, US breach reports) with no link between individual events, so they grew at different rates and nothing more follows.
The vuln→breach channel is widening. DBIR's vector series is the one place the two halves of this site measurably connect.
Speed is the most consistently reported change. Average exploitation in days (Mandiant), median patching of 43 days (DBIR 2026), and the same familiar bug classes recurring across 106 months of Patch Tuesday.

What the data cannot answer

Whether AI has caused any measurable share of breaches — attribution is absent from every breach dataset (and 70% of 2025 US breach notices carry no attack information at all, per ITRC).
Whether AI drove the time-to-exploit collapse, or coincided with commodity exploit pipelines maturing.
How much of the 2026 disclosure growth is AI-assisted research rather than counting changes. The discovery layer separates part of it (the growth is spread across 294 authorities, and the shift in weakness classes survives setting the largest growers aside), but no record says which finds used AI beyond the credited floor.
Net effect: AI demonstrably finds real bugs, and exploitation timelines have shortened, though AI's share of that change is unquantified. Which side nets out ahead is not answerable from public data in 2026.

The outcome and AI-involvement record behind these answers

466

Outcome figures, nine report families

Losses, payments, claims, speed and detection from IC3, DBIR, IBM, Chainalysis, Coveware, Coalition, CrowdStrike, Unit 42 and M-Trends, each as its edition states it. 85 are tied to AI by their source, 3 of them only by the vendor's assertion; the 69 that depend on a victim, respondent or detector noticing AI are lower bounds. Outcomes →

Documented AI-assisted attack campaigns

The ledger, graded by evidence and by who could observe it: 6 confirmed by someone other than the model provider, 13 resting only on the model provider's own report and 4 asserted without evidence a reader can check. 8 defensive tools and demonstrations are kept apart. Who can see what →

The attack count reads 14 published documents: 7 model providers' reports (OpenAI, Anthropic and Google GTIG), a victim's own statement (Arup), 2 security researchers' reports (HP Wolf Security and Zenity Labs), a CERT advisory (CERT-UA) and 3 incident-response and threat-intel reports (Wiz, Palo Alto Networks Unit 42 and Cisco Talos). It holds what those documents describe, so it is a partial record, not a census of AI-assisted attacks.

Outcome hypotheses under test

Each with what AI predicts, the best non-AI explanation, a falsifier and an evaluation date between 2027-06-30 and 2028-01-31. The board →

Reports on defender capacity, quoted

5 say incident-response firms are at capacity or turning work away, 4 say security teams cannot triage the alerts they have, and 1 is counter-evidence. 4 tie the strain to AI in words; none measures how much. Collected reports, not a measurement. Defender capacity →

Dated changes in how sources count

From the CNA expansion to the SEC rule and NVD's rationing; 9 are drawn as seams on a chart on this site. Methodology →

405

CVEs crediting a listed AI tool since 2024

A floor from CVE.org credits, 138 in Sep 2026 alone; never AI's share of CVEs. The AI Question →

5,379

California AG breach notices, submitted Jan 2012 to Oct 2026

A separate population from the 8,049 HHS OCR reports of US health-data breaches (submitted Oct 2009 to Oct 2026) and the 70 SEC Item 8.01 incident filings (filed Dec 2023 to Oct 2026), each its own series and never summed. Live →

The cross-dataset reads

Tempo

Speed moved most; two sources assert AI sped it, none measures how much

The largest measured changes are in speed: Mandiant's average time to exploit fell from 63 days to 5, CrowdStrike's average eCrime breakout from 98 to 29 minutes, and exploitation became the top breach entry vector in DBIR's caseload. CrowdStrike's 2026 Global Threat Report asserts: AI accelerated phishing and automated reconnaissance, shortening the time from initial access to impact. (PDF p.2). Unit 42's 2026 Global Incident Response Report asserts: AI compresses the attack lifecycle and reduces the manual effort required to operate across multiple targets. (PDF p.7). Those are the vendors' assertions; neither gives a measure of how much of the change AI caused. The event studies on this page test the timing against dated AI releases, and timing alone cannot settle cause. Volume rises have documented structural contributors, and in Jan–Sep 2026 the weakness mix moved: the scanner-era classes went −4% while the other tracked classes went ×3.1 (the discovery layer).

≠

Found ≠ breached

The CVE firehose and the breach series are routinely conflated in public argument. A decade of both on one site shows they move on different clocks: reported US compromises stepped up in 2023, the CVE surge came in 2024–2026. That does not show the two are unrelated. It shows a rising CVE count, on its own, is not evidence of rising compromise.

70%

The measurement is degrading as the stakes rise

Since 15 April 2026 NIST enriches only CVEs that meet its new priority criteria, leaving the rest as lowest priority (NIST), and 70% of 2025 US breach notices carry no attack information (ITRC). Both instruments are losing resolution just as the AI question needs them; the biggest obstacle to answering Q1 is data quality, not data absence.

Conjectures under test

Competing explanations, each written down with the observation that would refute it. The rolling-window conjectures were written with their refutation rules on 2026-10-20; their windows include months already published then, so only readings of months after that date test them in advance. The three release event studies were registered retrospectively on 2026-10-22, after their release windows had passed: one release per kind of AI tool (a closed model, an open-weight model and an attack harness), each with a sourced public date. Because those releases were chosen after the outcome data existed, the event studies carry less weight than a test registered in advance; their dates and thresholds are frozen for every later reading. The status is computed from the live series by code in Substrate, not judged. A reading that fits is labelled not refuted by this metric, never proven, and a reading before a conjecture's evaluation date is marked interim. Every status change is kept, with its date, in that conjecture's history in the dataset.

interim · refutedCashing out is what limits breachesover 12-month windows: not refuted by this metric
interim · not refuted by this metricAI removed the operator-labor limitover 12-month windows: not refuted by this metric
interim · not refuted by this metricExploitation is outrunning defendersover 12-month windows: refuted
interim · no metric yetBreaches already happened but are not yet disclosed
interim · no metric yetNon-financial attackers are rising
interim · no metric yetSignificant incidents double within a year
refuted · one event, read after the factA frontier closed-model release sped up exploitation
not refuted by this metric · one event, read after the factA frontier open-weight release sped up exploitation
not refuted by this metric · one event, read after the factA public offensive AI harness sped up exploitation

For the rolling-window conjectures, status follows the registered rule on six-month windows. The second line re-runs the same rule on 12-month windows, so a disagreement between them means the verdict depends on the window; neither line is a final answer.

Corrected 2026-10-20: the first published leak-site and SEC readings were not like-for-like; the cash-out status changed from consistent to refuted. What changed →

Cashing out is what limits breaches

interim · refuted

Tal Be'ery, "Why the AI Vulnpocalypse Isn't the Breachpocalypse (Yet)" (2026-10) · evaluates on 2027-10-20

Predicts: Financially motivated breaches grow much more slowly than exploited vulnerabilities, because converting access into laundered money is the constraint.

Refuted if: Leak-site victims over the last six complete months grow at least as fast as KEV additions year over year, and by at least 50%.

Interim reading: Leak-site victims posted within 30 days of month end +64% (3022 → 4961); KEV additions +25% (126 → 158), 2026-03–2026-08 vs 2025-03–2025-08.

Caveat: Leak-site victims are mostly organizations that did not pay: a leak site lists a victim to pressure or punish non-payment, so this series counts extortion attempts that failed to collect, not breaches that paid out. Coveware's own caseload, a different population from leak-site victims, paid in 19% of cases in Q2 2026, the latest quarter here (Coveware).

refuted at or above 50%6-month reading 64.2%0%80%20%40%60%12-month check 35.7%

leak-site victim growth

Window check, not the rule: over 12-month windows this reads not refuted by this metric. Leak-site victims posted within 30 days of month end +36% (6727 → 9128); KEV additions +14% (247 → 281), 2025-09–2026-08 vs 2024-09–2025-08.

What tells AI apart from the rival explanation: If cashing out is the limit, payment rates and laundering throughput fall or stay flat while access (KEV additions) grows; if access were the limit, leak-site victims would track KEV additions.

Confounders (3)

2024-02-20 · Operation Cronos: NCA-led disruption of LockBit. LockBit's disruption moved affiliates and victims between leak sites, changing counts with no change in access or cash-out. Source
2023-05-27 · MOVEit mass exploitation by CL0P. One mass campaign put hundreds of victims on one leak site within weeks, which can dominate a year-ago window. Source
2025-10-24 · Ransom payment rate at a historical low (Coveware). A falling payment rate changes who ends up on a leak site, since sites list victims who have not paid. Source

Paired series, Ransom payment rate (Coveware quarterly): Share of Coveware's extortion cases, across all impact scenarios, in which the victim paid. Coveware's population is its own incident-response caseload, not leak-site victims.

2025-Q2 26%
2025-Q3 23%

These two quarters were paired when the conjecture was registered; the latest is 19% in Q2 2026. The full quarterly payment rate from Coveware's reports is charted on Outcomes.

AI removed the operator-labor limit

interim · not refuted by this metric

The Defender's Initiative, "From this point on, it only gets rougher" (2026) · evaluates on 2027-10-20

Predicts: Attackers were held back by a shortage of skilled operators; as AI fills it, the number of distinct extortion groups active each month rises.

Refuted if: Average distinct leak-site groups per month over the last six complete months is less than 10% above the same six months a year earlier.

Interim reading: Average distinct groups posting within 30 days of month end 51.2 → 64.8 (+27%), 2026-03–2026-08 vs 2025-03–2025-08.

refuted below 10%6-month reading 26.7%0%30%10%20%12-month check 20.9%

growth in active groups

Window check, not the rule: over 12-month windows this reads not refuted by this metric. Average distinct groups posting within 30 days of month end 49.4 → 59.8 (+21%), 2025-09–2026-08 vs 2024-09–2025-08.

What tells AI apart from the rival explanation: An AI-driven labor effect adds new groups without a takedown preceding them; a law-enforcement-driven effect shows a takedown followed by rebrands that absorb the same affiliates.

Confounders (2)

2024-02-20 · Operation Cronos: NCA-led disruption of LockBit. Takedowns split affiliates into new brands, raising the count of distinct groups without adding operators. Source
2023-05-27 · MOVEit mass exploitation by CL0P. A single group's mass campaign changes victim counts per group, which shifts which groups are active in a month. Source

Exploitation is outrunning defenders

interim · not refuted by this metric

vulnerabilitydata.io working hypothesis · evaluates on 2027-10-20

Predicts: The time from a CVE's publication to CISA confirming exploitation keeps shrinking.

Refuted if: The median days from CVE publication to KEV listing over the last six complete months is not lower than the same six months a year earlier.

Interim reading: Median days from CVE publication to KEV listing 10 → 8 (n=97 → 163), 2026-04–2026-09 vs 2025-04–2025-09.

refuted at or above 10d6-month reading 8d0d15d5d10d12-month check 10da year earlier 10d

median days, CVE to KEV listing

Window check, not the rule: over 12-month windows this reads refuted. Median days from CVE publication to KEV listing 10 → 10 (n=209 → 275), 2025-10–2026-09 vs 2024-10–2025-09.

What tells AI apart from the rival explanation: If exploitation is outrunning defenders, the gap shrinks across vendors and bug classes; if a few zero-day campaigns or a KEV policy change drive it, the drop concentrates in a few vendors or starts at the policy date.

Confounders (2)

2026-06-10 · BOD 26-04 replaces BOD 22-01; KEV inclusion criteria unchanged. Falls inside the windows this rule compares until late 2027. CISA states the criteria for adding a vulnerability to KEV did not change, so it should not change what CISA lists; it is kept as a dated event to check against a break, not a known cause of one. Source
2023-05-27 · MOVEit mass exploitation by CL0P. A cluster of zero-days listed within days of disclosure pulls a month's median down with no general change in speed. Source

Breaches already happened but are not yet disclosed

interim · no metric yet

The "submerged breaches" alternative that Be'ery argues against · evaluates on 2027-10-20

Predicts: Material-incident 8-Ks filed later report intrusions that began in 2026 Q2–Q3.

Refuted if: 8-K Item 1.05 filings over the following four quarters report intrusion start dates spread evenly, with no cluster in 2026 Q2–Q3.

Interim reading: Intrusion start dates are not yet extracted from filing text. For context, Item 1.05 filings were 9 → 14, 2026-04–2026-09 vs 2025-04–2025-09.

What tells AI apart from the rival explanation: A disclosure lag shows as intrusion start dates clustered months before filing dates; a reporting-rule effect shows as filings rising from the rule's start date regardless of when intrusions began.

Confounders (1)

2023-12-18 · SEC Form 8-K Item 1.05 disclosures begin. The disclosure rule itself started the series, so its early growth is partly firms learning to file. Source

Non-financial attackers are rising

interim · no metric yet

Caveat in Be'ery's own post; vulnerabilitydata.io working hypothesis · evaluates on 2027-10-20

Predicts: Attacks with no ransom or payment goal (disruption, sabotage, state activity) rise, untouched by the cash-out constraint.

Refuted if: No rise in destructive or disruptive incidents without a ransom demand over the next four quarters.

Interim reading: No public machine-readable series measures this yet.

What tells AI apart from the rival explanation: A real rise shows in incidents with no ransom demand across several sources; a visibility effect shows only in sources whose reporting rules changed.

Confounders (1)

2023-12-18 · SEC Form 8-K Item 1.05 disclosures begin. Public companies began disclosing material incidents of any motive, so disruptive incidents became more visible without becoming more common. Source

Significant incidents double within a year

interim · no metric yet

vulnerabilitydata.io working hypothesis (2026-10-20) · evaluates on 2027-10-20

Predicts: Incidents that take a critical service (fuel, healthcare, payments, a major retailer or a city) down for days double from their prior annual rate by 2027-10-20.

Refuted if: The count of such incidents from 2026-10-20 to 2027-10-20 is less than twice the 2025 count.

Interim reading: No public machine-readable series measures this yet.

What tells AI apart from the rival explanation: An AI effect raises the count across many unrelated actors; a single mass campaign or a disclosure-rule change raises it through one actor or one reporting channel.

Confounders (2)

2023-05-27 · MOVEit mass exploitation by CL0P. One campaign can produce many qualifying incidents in a single year. Source
2023-12-18 · SEC Form 8-K Item 1.05 disclosures begin. Disclosure requirements make outages at public companies visible that were previously unreported. Source

A frontier closed-model release sped up exploitation

refuted · one event, read after the fact

vulnerabilitydata.io event study (registered 2026-10-22) · event study · window closed 2025-07-01, read retrospectively

Predicts: After the release, the monthly median days from CVE publication to KEV listing falls below the line projected from the 12 months before it (a level or slope break toward faster exploitation).

Refuted if: Over the 12 complete months of KEV listings after the release month, the mean of (observed monthly median days from CVE publication to KEV listing − the pre-trend projection) is zero or above. The pre-trend is the least-squares line through the monthly medians of the 12 months before the release month. Months with fewer than 5 KEV entries are gaps and are skipped; fewer than 8 usable months in either window reads too early.

Release: Claude 3.5 Sonnet released, 2024-06-21 (closed)

Reading: Release 2024-06-21 (closed). Post-release months ran +13.6 days on average against the pre-trend projection; slope -0.5 → 1 days per month (pre 2023-06–2024-05, 12 months; post 2024-07–2025-06, 12 months). Registered retrospectively on 2026-10-22; a break in timing is not evidence of cause.

refuted at or above 0drefuted ›12-month reading 13.6d0d20d5d10d15d

mean days vs pre-trend, 12 months after

What tells AI apart from the rival explanation: A capability effect from closed models shows as a break near the release that does not also appear at unrelated dates; a break during a zero-day campaign points to that campaign instead.

Confounders (1)

2025-01-20 · Overlapping release: DeepSeek-R1 released with open weights (open-weight). A release of another tool class falls inside this study's window, so a break cannot be assigned to one class by timing alone. Source

A frontier open-weight release sped up exploitation

not refuted by this metric · one event, read after the fact

vulnerabilitydata.io event study (registered 2026-10-22) · event study · window closed 2026-02-01, read retrospectively

Release: DeepSeek-R1 released with open weights, 2025-01-20 (open-weight)

Reading: Release 2025-01-20 (open-weight). Post-release months ran -19.4 days on average against the pre-trend projection; slope 2 → 0.4 days per month (pre 2024-01–2024-12, 12 months; post 2025-02–2026-01, 12 months). Registered retrospectively on 2026-10-22; a break in timing is not evidence of cause.

refuted at or above 0d12-month reading -19.4d-30d10d-20d-10d0d

mean days vs pre-trend, 12 months after

What tells AI apart from the rival explanation: Open-weight use leaves no provider telemetry, so the series is the only instrument; a break that also appears at the closed-model date cannot be assigned to open weights.

Confounders (2)

2024-06-21 · Overlapping release: Claude 3.5 Sonnet released (closed). A release of another tool class falls inside this study's window, so a break cannot be assigned to one class by timing alone. Source
2025-07-10 · Overlapping release: HexStrike AI MCP agent framework published on GitHub (harness). A release of another tool class falls inside this study's window, so a break cannot be assigned to one class by timing alone. Source

A public offensive AI harness sped up exploitation

not refuted by this metric · one event, read after the fact

vulnerabilitydata.io event study (registered 2026-10-22) · event study · window closed 2026-08-01, read retrospectively

Release: HexStrike AI MCP agent framework published on GitHub, 2025-07-10 (harness)

Reading: Release 2025-07-10 (harness). Post-release months ran -6 days on average against the pre-trend projection; slope 1 → -0.1 days per month (pre 2024-07–2025-06, 12 months; post 2025-08–2026-07, 12 months). Registered retrospectively on 2026-10-22; a break in timing is not evidence of cause.

refuted at or above 0d12-month reading -6d-8d2d-6d-4d-2d0d

mean days vs pre-trend, 12 months after

What tells AI apart from the rival explanation: A harness effect should concentrate in bug classes the harness automates; a general break at the same time points to a common cause instead. The KEV directive was replaced inside this window, though CISA says what qualifies for KEV did not change.

Confounders (2)

2026-06-10 · BOD 26-04 replaces BOD 22-01; KEV inclusion criteria unchanged. Falls inside this study's post-release window. CISA states the criteria for adding a vulnerability to KEV did not change, so it should not change what CISA lists; a break that starts in 2026-06 should still be checked against it. Source
2025-01-20 · Overlapping release: DeepSeek-R1 released with open weights (open-weight). A release of another tool class falls inside this study's window, so a break cannot be assigned to one class by timing alone. Source

How the readings are computed

Readings compare six months with the same months a year earlier: the last six complete months, except the leak-site readings, which use the last six months whose 30-day posting window has closed, so both windows have had the same time to fill in. Each card also shows the same rule over 12-month windows, as a check on whether the verdict depends on the window.

Rules and computation: the code that computes each status, public in Substrate · status as of 2026-10-26.

How this page stays honest

These are standing questions, re-asked every time a dataset is added or updated — the build fails if a data file has no section here (it checks coverage, not that each number agrees). The figures above come from the site's data files; Sources lists each one and says whether it is public in the Substrate repo. Where the data can't say, that is the answer that ships. Sources → · Methodology →