DEFENDERS CLOCK
THE PUBLIC OPERATING SIGNAL FOR DEFENDERS
ISSUED 2026-07-27 · 14:00 UTC
THE RUBRIC

Methodology

Each weekly reading answers one question: what materially changed this week, how much does it matter, and what should a responsible defender do about it?

THE FOUR STATES

20–39ROUTINEMaintain normal defensive cadence.
40–59ELEVATEDPrioritize a defined class of exposure or abuse.
60–79HIGH PRESSUREPromptly review relevant controls, detection, and executive awareness.
80–100ACUTEPublic evidence indicates a concentrated, actionable, broadly relevant threat condition.

These are communication states, not breach probabilities.

SCORING PRINCIPLES

  1. 01Bounded claims. Score only what can be described and sourced.
  2. 02Explainability. Publish the rubric and components behind every reading.
  3. 03Conservatism. Uncertain evidence lowers confidence; it never inflates urgency.
  4. 04Revision history. Preserve changes and corrections visibly.
  5. 05No manufactured drama. The reading may remain stable or improve.
  6. 06Separate fact from judgment. Sources establish facts; the editorial reading interprets them.
  7. 07Public-only. No private corporate signal, data, incidents, or perspective.

SIGNALS & SOURCE ROSTER

Active Exploitation

CISA Known Exploited Vulnerabilities, vendor advisories, credible public research and reporting.

CISA KEVVENDOR ADVISORYPUBLIC RESEARCH
Identity & Human Attack Pressure

Government advisories, major vendor research, verified campaign disclosures.

GOV ADVISORYVENDOR RESEARCHCAMPAIGN DISCLOSURE
Intrusion / Ransomware Tempo

Public victim disclosures, regulator notices, law-enforcement advisories, credible incident reporting.

PUBLIC DISCLOSUREREGULATOR NOTICELE ADVISORY

OPERATING RULES

Fixed source roster
Signals are scored from a fixed, published roster of public sources. Roster changes bump the methodology version.
Two-source rule
Two independent source classes are required to raise a signal. One may hold it steady.
Weekly cut-off
Evidence is scored through Friday 00:00 UTC each week.
Immutable readings
A published reading is never silently edited. Corrections append to a visible revision history.
Confidence
Confidence can only be lowered by uncertainty, never raised by it.

CORRECTIONS

When a reading is found to be wrong, the correction is published as a revision entry on that reading — what changed, and why. The original stays visible. If the source roster or the rubric itself changes, the methodology version increments and the change is noted here.