Facts & methodology
Sources, confidence tags and the daily sweep
The definitions of the five tiers, and what each one has to survive before it can carry an entry, are on this page.
Upstream sources and their lag
| Source | Provides | Lag |
|---|---|---|
| CISA Known Exploited Vulnerabilities catalogue | Vulnerabilities with confirmed exploitation and, for many entries, a remediation deadline for federal agencies. | Hours to a few days after publication |
| CISA and national partner advisories | Joint agency advisories on exploited flaws and active campaigns, with technical detail and mitigations. | Same day where it is published |
| NVD (National Vulnerability Database) | CVE records, CVSS base scores and reference links for vendor advisories. | Hours to weeks; scoring backlogs are common |
| Vendor security advisories | First-party details — affected versions, fixed versions, exploitation status and mitigations. | Same day; often earlier than any aggregator |
| EPSS (FIRST.org) | A daily probability estimate that a given CVE will be exploited in the next 30 days. | Daily, re-scored continuously |
| Securities filings recording material incidents | A company's own account of a material cybersecurity incident and its effect on the business. | Within four business days of the materiality determination |
| State attorney-general breach notifications | Victim notices, dates, data categories and affected-population figures submitted under state law. | Days to months after discovery — this is the long tail |
| Named-outlet reporting | Context, interviews and the first public signal when nothing else has been published. | Minutes to hours after the outlet publishes |
| Attacker claim venues | The earliest signal of a claim, and the thing most likely to be wrong. | Immediate — treated as a lead, never as a fact |
- CISA Known Exploited Vulnerabilities catalogue — Tier 1, government primary record. Confirms CVE, date added, deadline, forensic-triage flag.
- NVD — Tier 1, government primary record.
- The Record (Recorded Future News), 16 Oct 2026 · 13:00 UTC — Tier 4, specialist press. Source of the China state-backed attribution.
- BeyondTrust trust centre — vendor advisory.
The five tiers
| Tier | Label | Examples | Weight |
|---|---|---|---|
| Tier 1 | Official filing or regulator | A securities filing recording a material incident, a state attorney-general breach notice, a national agency advisory or catalogue entry, a court record. | Highest weight. A Tier 1 source can carry a 'Confirmed' tag on its own. |
| Tier 2 | Victim organisation's own disclosure | A statement, customer notification, security blog post or status page published by the organisation affected. | High weight, and it is the source that can explain mechanism. Scope claims in it are still read against the evidence. |
| Tier 3 | Named vendor or research team | A vendor security advisory, an incident-response firm's technical write-up, a university or non-profit research publication. | Strong on mechanism and indicators. Attribution published by a vendor is recorded as that vendor's attribution, not as established fact. |
| Tier 4 | Named news outlet | Reporting by a publisher that names itself and its sources in the piece. | Enough to publish at 'Reported'. Never enough on its own for 'Confirmed'. |
| Tier 5 | Attacker claim or criminal forum | A claim post, a leak-site entry, a sample file offered for sale on a forum. | Lowest weight. Published only as 'Claimed' or 'Unverified', always with the fact of the claim stated plainly. |
Confidence tags
Confirmed
The organisation affected, or a regulator or court filing, has acknowledged the incident.
Requires: A first-party statement, a filing, a regulator notice or an enforcement action. Never a media report alone.
Reported
A named outlet or researcher is reporting it, but the organisation has not acknowledged the specifics.
Requires: At least one named publisher or research team on the record, with enough detail to check. Two independent sources to move up a tier.
Claimed
An attacker or broker is claiming it. The claim may be true, partly true, or an outright bluff.
Requires: The claim is published, attributable to a specific handle or group, and is corroborated on at least one checkable detail before we publish at all.
Unverified
It is circulating, it is specific enough to be worth watching, and nothing about it has been established.
Requires: Published by a named outlet or venue, with the conflict between the claims stated on the entry itself.
How an entry is made
Step 01
A disclosure appears in the public record
A filing, an advisory, a vendor statement, a notification, a named report or an attacker claim. Nothing enters the feed from private telemetry, because we have none.
Collected continuously, not on a daily batch. The overnight sweep is for reconciliation and for reading the long tail of state notices.
Step 02
It is read, tagged and dated
The mechanism, the affected systems and the exposure window are written up in plain language, then the confidence tag and source tier are set against fixed rules.
The five required fields — what, when, where, how, who — must all be answerable before an entry publishes. Where a fact is genuinely not public, the entry says 'Not publicly disclosed'.
Step 03
You are told plainly, and told what to check
Each entry carries concrete, checkable steps: read your statement for this, look for this notice, reset this credential. No alarm, no countdown, no vague warning.
We say what we know, what we do not know, and what would change the assessment. Silence on our page is not evidence that nothing happened.
How entries get in
- Check. A person opens the source and confirms the item is real, current, and says what it appears to say. The primary source wins over any aggregator repeating it.
- Label. The item is given a confidence tag (Confirmed, Reported, Claimed, or Unverified), and any attribution carries a qualifier. If the source does not say who did it, neither do we.
- Publish. The entry is written as WHAT / WHEN / WHERE / HOW / WHO with an am-I-affected checklist, and the date it goes live is recorded.
Frequently asked questions
The alert desk (Seven questions)
What does the alert desk publish?
Publicly disclosed breaches and exploited software flaws: national advisories, vendor disclosures, regulatory filings and the exploited-vulnerability catalogue.
How do the confidence tags work?
Confirmed means a national agency listing, a vendor's own disclosure, or a court or regulatory filing. Reported means named-outlet reporting with the outlet named; Unverified and Claimed items are published on the site, but they are never sent and never lead.
How often does the sweep run?
The register is reviewed daily at 07:00 America/Denver, reporting Tier 2 and above only.
What does this desk not do?
It reads the public record only. It cannot see inside your accounts, cannot detect a breach, and silence on this site is not evidence of safety.
Why does attribution always carry a qualifier?
Because state sponsorship and AI involvement are frequently inferential from outside. Where a source states a qualifier, it is repeated here exactly as the source phrased it — never softened and never upgraded.
What happens if nothing qualifies?
No alert is sent and no digest is mailed. A quiet week is reported as quiet rather than filled.
How do subscriptions work?
You can follow the whole of SB Sentinel, a single site, or a single section within a site, and you receive only what you chose. The selection can be changed at any time.
Coverage and limits (Six questions)
What sources does BreachWatch cover?
CISA advisories and the Known Exploited Vulnerabilities catalogue, the National Vulnerability Database, vendor security advisories, SEC 8-K material incident filings, state attorney-general breach notices, and reporting from named outlets.
How quickly does an item appear here?
It depends entirely on the source. A CISA KEV addition appears within hours of publication. A breach is often disclosed weeks after the organisation learns of it, and sometimes only when a law requires it. We cannot publish what nobody has disclosed.
Does BreachWatch detect breaches?
No. This service is read-only. It cannot detect an intrusion, see inside any system, or observe traffic. It reads what organisations and agencies have already published.
What does a confidence tag mean?
Confirmed means a primary source or official filing states it. Reported means named journalists or a credible outlet have it. Claimed means a party asserts it and it is not independently corroborated. Unverified means it is circulating without a source we can name.
My details were not in any listing. Am I safe?
Not necessarily. Disclosure lags reality, so an incident you are in may simply not be public yet. Silence here is not evidence of safety — it only means nothing has been published.
How do I know if I am affected?
Each alert carries an am-I-affected checklist with concrete steps you can work through and print. If no alert names a service you use, the practical move is still to act on the basics: unique passwords, multi-factor authentication, and a credit freeze where identity data is at risk.
Subscriptions and the desk tiers (Four questions)
What does a matched alert mean?
A matched alert is one that names an organisation or service on the addresses you asked us to watch. It is not a statement that you were affected. It means the disclosure touched something you told us to watch, and the entry is worth your attention.
How many addresses does a BreachWatch plan cover?
Each plan states what it includes on the card above. A monitored address is one email domain or service you want watched. If you need more than a plan allows, talk to us about a higher plan rather than opening several subscriptions.
How is alert delivery different from the weekly digest?
Alerts are sent as each qualifying disclosure is published, so you hear about it the same day. The weekly digest is one message summarising everything from the previous seven days. Both are included; the digest is for readers who prefer a single weekly read.
How do I cancel?
Cancellation is self-serve from the subscription management link at the bottom of every email we send. No call, no email, no retention step. Access continues to the end of the period you have already paid for and does not renew.
Sources and checking (Two questions)
How is an item checked before it is published?
The entry has to answer what happened, when, where and how, and a source has to be nameable. A claim with no checkable detail — no date, no document, no specific system — does not publish. The confidence tag and the source tier are then set against fixed rules, and both are printed on the entry so the check behind it is visible rather than implied.
What happens when a claim cannot be verified?
It is published only as a claim, or not at all. Where a claim names something checkable it appears tagged Claimed or Unverified, with the fact of the claim stated plainly alongside it. Where there is nothing to check, it stays off the feed entirely, and an entry is never corrected quietly — a correction is made in place and dated on the entry.