The threat level answers one question: is there unusually much happening right now? It does not count events. It compares current activity with the previous 90 days.
The five components
- Ransomware activity (25%): victims newly claimed on ransomware leak sites in the last 24 hours, from RansomLook. We publish counts only and never name claimed victims, because claims by criminal groups are unverified.
- Actively exploited vulnerabilities (25%): vulnerabilities added to the CISA Known Exploited Vulnerabilities catalogue and critical vulnerabilities published in the NIST National Vulnerability Database over the last 7 days.
- Confirmed data breaches (20%): breaches added to Have I Been Pwned over the last 7 days, weighted by the number of affected accounts, plus the volume of incident reports from security news publishers.
- Official warnings (15%): alerts, advisories and warnings published by the UK National Cyber Security Centre over the last 14 days.
- Community signals (15%): how often breaches, ransomware and zero-days are being discussed by the security community on Hacker News and infosec.exchange over the last 24 hours.
How the score is calculated
- Collect. Every 30 minutes the engine reads each public source. A source that is unavailable is skipped and does not stop the update.
- Compare. For each component, the current value is ranked against the same measurement for every comparable window in the last 90 days. A value higher than on 70% of past days scores 70.
- Weight. The component scores are combined using the weights above. Components without enough history yet are left out and the remaining weights are rescaled. The page always shows how many components the current score is based on.
- Smooth. The result is smoothed over several hours so that a single report does not make the level jump.
Levels
- 0–19 Low: activity below the recent norm.
- 20–39 Guarded: normal background activity.
- 40–59 Elevated: activity above the recent norm.
- 60–79 High: clearly unusual activity in several areas.
- 80–100 Severe: exceptional activity across most components.
Limitations
The threat level is an indicative assessment by Blacknote Intelligence based on public information. It is not an official government threat level and does not describe the risk to any specific organisation. Public sources report with delays, and some attacks are never disclosed.
Sources and attribution
CISA Known Exploited Vulnerabilities catalogue, NIST National Vulnerability Database, ENISA European Vulnerability Database, Have I Been Pwned (CC BY 4.0), RansomLook (CC BY 4.0), NCSC, BleepingComputer, The Record, The Hacker News, infosec.exchange and Hacker News. Headlines in the live feed link to the original publisher.