DEFENDERS CLOCK
THE PUBLIC OPERATING SIGNAL FOR DEFENDERS
ISSUED 2026-11-02 · 14:00 UTC
THE RUBRIC

Methodology

Each weekly reading answers one question: what materially changed this week, how much does it matter, and what should a responsible defender do about it?

THE FOUR STATES

20–39ROUTINEMaintain normal defensive cadence.
40–59ELEVATEDPrioritize a defined class of exposure or abuse.
60–79HIGH PRESSUREPromptly review relevant controls, detection, and executive awareness.
80–100ACUTEPublic evidence indicates a concentrated, actionable, broadly relevant threat condition.

These are communication states, not breach probabilities.

SCORING PRINCIPLES

  1. 01Bounded claims. Score only what can be described and sourced.
  2. 02Explainability. Publish the rubric and components behind every reading.
  3. 03Conservatism. Uncertain evidence lowers confidence; it never inflates urgency.
  4. 04Revision history. Preserve changes and corrections visibly.
  5. 05No manufactured drama. The reading may remain stable or improve.
  6. 06Separate fact from judgment. Sources establish facts; the editorial reading interprets them.
  7. 07Public-only. No private corporate signal, data, incidents, or perspective.

SIGNALS & SOURCE ROSTER

Active Exploitation

CISA Known Exploited Vulnerabilities, vendor advisories, credible public research and reporting.

CISA KEVVENDOR ADVISORYPUBLIC RESEARCH
Identity & Human Attack Pressure

Government advisories, major vendor research, verified campaign disclosures.

GOV ADVISORYVENDOR RESEARCHCAMPAIGN DISCLOSURE
Intrusion / Ransomware Tempo

Public victim disclosures, regulator notices, law-enforcement advisories, credible incident reporting.

PUBLIC DISCLOSUREREGULATOR NOTICELE ADVISORY

OPERATING RULES

Fixed source roster
Signals are scored from a fixed, published roster of public sources. Roster changes bump the methodology version.
Two-source rule
Two independent source classes are required to raise a signal. One may hold it steady.
Weekly cut-off
Evidence is scored through Friday 00:00 UTC each week.
Immutable readings
A published reading is never silently edited. Corrections append to a visible revision history.
Confidence
Confidence can only be lowered by uncertainty, never raised by it.

THE ACUTE BAR

Acute (80–100) is entered by event, never by drift. Weekly trend accumulation stops at 79. A reading of 80 or above requires, that same week, a qualifying condition the summary can name:

  1. 01Mass exploitation in progress of ubiquitously deployed technology, with government emergency action underway.
  2. 02An intrusion campaign confirmed by a government authority to be disrupting operations across a critical-infrastructure sector.
  3. 03Confirmed systemic compromise of a trust primitive defenders rely on — a major identity provider, certificate authority, or ubiquitous software supply chain — acknowledged by its operator.

An acute reading must also carry a rising, high-confidence signal backed by raised receipts from at least three independent source classes, one of them governmental — a floor the published validator enforces mechanically. The qualifying evidence must be from that week’s window: an old incident newly disclosed cannot make the present acute. All three moves must address the condition. And acute expires by default — each week must re-establish this bar with fresh evidence, or the reading returns to 79 or below regardless of general pressure.

Defined in September 2026 — before first use, so the criteria could not be shaped by any pending event. Methodology v1.1.

CORRECTIONS

When a reading is found to be wrong, the correction is published as a revision entry on that reading — what changed, and why. The original stays visible. If the source roster or the rubric itself changes, the methodology version increments and the change is noted here.

Versions. v1.0 — launch rubric (July 2026). v1.1 — the acute bar defined (September 2026); no change to the source roster or to scoring below 80. Readings from 2026-W40 onward are scored under v1.1.