Coverage & limits
What this does and does not do
The SB Sentinel BreachWatch is one record inside the larger SB Sentinel network. SB Sentinel is the umbrella; BreachWatch is the incident desk within it, and other desks cover the national alerts, the daily briefing, the global incident tracker and the open comment tracker.
What is polled
- CISA advisories and the Known Exploited Vulnerabilities catalogue
- NVD (National Vulnerability Database) CVE records
- Vendor security advisories, trust centres and status pages
- SEC filings recording a material cybersecurity incident
- State attorney-general breach notifications
- Named-outlet reporting, with the outlet named on the entry
- Attacker claims published on criminal forums and leak sites — as claims
Categories
Credit & Banking Booking & Travel Retail & Websites Cloud & Big Tech Healthcare Government & Infrastructure Telecom Social & Identity AI & Autonomous Systems
How the record is kept
| Practice | How it works |
|---|---|
| Collection | Continuous — advisory, filing and news sources are polled through the day. |
| Reconciliation sweep | 07:00 America/Denver daily. |
| Register update | The indicator dashboard follows the 07:00 America/Denver daily sweep. |
| Vulnerability scores | CVSS base and EPSS figures refresh once a day. |
| Corrections | Entries are corrected in place and the correction is dated on the entry itself. |
| Retention | Published entries are not quietly deleted. Withdrawn entries are marked withdrawn and stay visible. |
What this site cannot do
- Detect breaches. We have no sensors, no agents and no telemetry on any network.
- See inside a company. We cannot read intrusion logs, cloud trails or endpoint data.
- Tell you about an incident before it is disclosed. That is the whole constraint: we are downstream of the public record, by design and by capability.
- Say that an organisation is safe because no alert names it. Silence is not evidence of safety — it usually means a disclosure obligation has not yet attached.
- Remove your data from anywhere, recover it, or chase a victim organisation for a missing notice. Those are different jobs done by other organisations.
- Estimate the number of people affected from a claimed file size. Numbers come from filings and notices, or they are labelled as claims.
The desk also publishes its own limits, which is unusual in this field and deliberate. SB Sentinel reads public disclosures. It cannot see inside your accounts, it cannot detect a breach, and a quiet week is not evidence that you are safe. Saying that plainly is what makes the rest of the record worth reading.
Silence is not evidence of safety.