From DowJo — where this research becomes practice. Train your judgment before you risk your money.
Course Research · Episode 9
AI Creates a New Attack Surface: Cybersecurity, Privacy and Trust
The evidence-led takeaway
The AI attack surface arrived — just not where anyone was pointing. The industry has built a rich, mature vocabulary for attacks ON MODELS: prompt injection, data poisoning, model extraction, evasion, each with its own NIST identifier and its own OWASP rank.
Ask Jo about this researchJo reads this note before answering. Sign in to ask Jo with this evidence attached — you come straight back here.
In brief
What this research concludes
THE AI ATTACK SURFACE ARRIVED — JUST NOT WHERE ANYONE WAS POINTING. The industry has built a rich, mature vocabulary for attacks ON MODELS: prompt injection, data poisoning, model extraction, evasion, each with its own NIST identifier and its own OWASP rank. That vocabulary is in the risk register of hundreds of public companies. It is not in the incident register of any of them. The realised record says something different and more useful: the AI risk that has actually landed came through the front door of ordinary adoption — an employee putting customer social security numbers into an unapproved AI application is the single AI-named entry in the entire mandatory US incident record — and where AI systems ARE demonstrably being broken into at scale, the attacker walks through the plumbing rather than the model. Every one of the twelve AI-stack entries in CISA's confirmed-exploitation catalogue is a missing authentication check, an injection bug, an SSRF or an authorization bypass; not one is an adversarial-ML technique. The most spectacular agentic intrusion on the public record reached node-level access at Hugging Face and then coordinated itself through an Artifactory endpoint that accepted unauthenticated WebDAV requests. THE JUDGMENT SKILL: when a new risk category appears, find out WHERE THE LOSSES ACTUALLY LANDED before you accept where the VOCABULARY points.
The judgment skill this hands over
When a new risk category appears, do not start by asking whether it is real. Ask where the losses actually landed — and then notice whether that is the same place the vocabulary is pointing. A field can develop a mature language for a hazard years before that hazard is the one costing anyone money, and the gap between the two is where your attention is being spent badly.
What we investigated
The question, and who it looks at
This is episode 9 of Investing in the AI Era, a 14-episode course. The film tells the story; this note is the research behind it, kept inspectable.
Who and what this looks at
How we tested it
Researched to be refuted, not confirmed
Candidate claims went to an independent pass instructed to refute them against primary sources. Survivors became evidence; casualties became the refused list below.
The method, in the research team's own words
SEVEN BOUNDED LANES, RUN IN PARALLEL, EACH WITH ITS OWN EVIDENCE LAW. L1 — THE DISCLOSED INCIDENT RECORD. Everything computed from SEC endpoints with curl and an identifying User-Agent, never from a law-firm tracker. The SEC's own adopting release (33-11216, conformed to the Federal Register version) was fetched as a PDF, converted with pdftotext -layout, and the compliance dates and the amendatory text of Item 1.05 and 17 CFR 229.106 read directly. The Item 1.05 population was built from EDGAR full-text search, taking the STRUCTURED item tag on documents returned by convergent text queries: "Item 1.05" (91 docs) and the independent query "Material Cybersecurity Incidents" (81 docs) returned the SAME 82 accessions, and four further probes added zero. That is a FLOOR, not a census, and it is described as one every time it appears. All 82 were fetched and read. The method was then tested against an outside Tier-1 primary that states its own counts — the May 2025 joint rulemaking petition, SEC File 4-856 — and two of its counts replicated EXACTLY (32 filers on or before 2025-05-22; 17 before and 9 after the May 2024 staff statement). A third did not: the petition's Item 8.01 'after' count of 28 against my floor measure of 18. Both are reported; they are not averaged. L2 — QUANTIFIED INCIDENT IMPACT. An eleven-filer cohort was FIXED IN WRITING on 2026-09-04, before any filing or financial data was pulled, in L2-incident-cohort-preregistration.md. Selection was on public notoriety only, blind to outcome, and deliberately included two NON-INTRUSION events (Delta/CrowdStrike, Group 1/CDK) so that the question of whether the largest quantified losses even come from attackers could not be decided after looking. Zero additions, zero removals, zero substitutions. One CIK pointer was corrected (the pre-registered Caesars CIK resolves to a predecessor entity that filed nothing in the window) and the correction is recorded in full rather than made silently. Measurement was filings-only: 48 documents fetched from EDGAR Archives, denominators from the XBRL companyfacts API, so every percentage is the filer's own number over the filer's own number. L3 — SECURITY-VENDOR FUNDAMENTALS. An eight-firm cohort likewise fixed in writing before any data was pulled, chosen for BUSINESS-MODEL diversity rather than for growth or outcome, and reported in the fixed order regardless of result — including the three that decelerated monotonically and the one that never moved. Okta sits in both cohorts on purpose: it sells security and was itself breached, which is the single cleanest test of the 'attack surface grows, therefore security revenue grows' chain. Hard exclusions were observed absolutely: no share prices, no returns, no multiples, no valuation, no cross-vendor correlation. L4 — THE AI-SPECIFIC ATTACK SURFACE, PER THE AUTHORITIES. NIST AI 100-2 E2025 and NIST IR 8596 read from the published PDFs; MITRE ATLAS parsed from the machine-readable GitHub release assets; CISA's Known Exploited Vulnerabilities catalogue downloaded whole (1,695 entries) and filtered by a named regex over vendor and product only, never over descriptions. L5 — WHO PAYS. The provenance of the famous cost numbers, read out of the publishers' own methodology sections; the FBI IC3 annual reports; regulator primaries for every penalty; NAIC's compilation of statutory insurance filings. L6 — ATTRIBUTED IDEAS AND THE COUNTER-CASE, built to be won rather than to be knocked down. PLUS A STANDING PLATE-SAFETY INSPECTION of 126 existing image plates, because an episode about fabricated evidence cannot ship a fabricated dashboard behind the narrator. WHAT FAILED, AND WHAT COULD NOT BE REACHED. A KNOWN-DEFECTIVE DETECTOR, FOUND AND CORRECTED. L1 located dollar figures in the Item 1.05 corpus with a ±260-CHARACTER PROXIMITY WINDOW around a currency symbol and a set of trigger words. It undercounted. Three failure modes: a figure stated more than 260 characters from its trigger word was invisible; a figure denominated in a currency other than the dollar was under-weighted; and exhibits filed inside the same accession were not read as part of the filing. Repair R3 re-fetched all 82 COMPLETE submission text files (82 of 82, HTTP 200, no throttling) and ran two window-free detectors that converged on the same set. The count moved from seven to eight quantifying filings, and the largest figure in the record turned out to be one the proximity detector had never seen. This is recorded here because the defect is reusable: a proximity window is a filter that fails silently, and the only way to find out is to read the corpus without one. A PRE-REGISTERED WINDOW WAS BREACHED AND CLOSED. L2's pre-registration said 'filings 2023-01-01 to most recent available.' On two of eleven filers the lane stopped a quarter early, and the breach landed exactly on the pre-registered insurance metric. Repair R1 read Group 1 Automotive and Johnson Controls through their most recent annual reports. It found a FALSE NEGATIVE (Group 1 disclosed a $10.0m business-interruption recovery) and a missed quantification (Johnson Controls' ~$29m first-half FY2024 figure, one quarter past where the lane stopped). AN UNVERIFIED QUOTATION OF A LIVING EXECUTIVE. L6 carried the Suleyman sentence with quote_unverified=true, recovered from a book-notes page. Repair R2 verified it against the publisher-indexed full text of the Crown US first edition and found two errors: a spelling variant, and — the substantive one — an amputated concessive clause that made him more absolute than he is. AN OPEN QUESTION THAT WAS ANSWERABLE. L4 recorded that MITRE publishes no adjudication rule for its Incident/Exercise typing, on which the whole quantitative spine of that lane rests. Repair R4 found the definition — in a different repository from the one the lane correctly used for the census — and, in the course of dating a staleness baseline, found the FLOW: the split was 18 Incident / 50 Exercise one release earlier. NOT REACHED, AND NOT GUESSED. The DOJ press release underlying the single cleanest dollar figure in the authority record (ID.me) sits behind bot detection that was not defeated, so two Tier-1 sources disagree about that number and the disagreement is carried rather than resolved. NIST IR 8578 and IR 8607 404 at the paths NIST's own landing page gives. The SEC's 2026 Regulatory Flexibility Agenda could not be parsed, so the current status of the rescission petition is recorded as UNKNOWN. Check Point files no quarterly XBRL, so its quarterly series inside the window was not retrieved. The SBA Advocacy spotlight that would settle the US 'privacy as a reason not to use AI' figure returned 403, so two irreconcilable secondary numbers are recorded rather than one picked. The full Verizon 2026 DBIR PDF was not retrieved and its corpus size is not asserted. Neither book was read cover to cover; only the specific passages relied on. REFUTATION AND ADJUDICATION. Ninety-seven candidate claims went through an adversarial pass instructed to refute rather than confirm, then a completeness critic, then the four bounded repairs. Verdict vocabulary: SUPPORTED / CORRECTED / MISLEADING / UNSUPPORTED / DO-NOT-NARRATE. Where a refuter CORRECTED a claim, THIS PACKET CARRIES THE CORRECTED SENTENCE in `claim` and names what it supersedes in `note` — the critic's warning is that the binding risk to this episode is narrating the original instead of its correction, and the schema-legal exclusion verdicts below encode that as a build gate. EIGHT CROSS-LANE CONTRADICTIONS ARE CARRIED, NOT RESOLVED: the SEC staff against AT&T on what 'material' means; the Commission against two of its own Commissioners; MGM against Caesars on disclosure route for the same event class in the same week; NIST's 'novel, expanded and altered' attack surface against CISA's confirmed-exploitation data showing an entirely ordinary one; Five Eyes leadership asserting what NIST's own text hedges; two Tier-1 sources reporting the ID.me loss as two different numbers; insurance premium falling while claim count rose about forty per cent; and every filer in the vendor cohort saying AI expands the attack surface while three of them decelerate monotonically. BASIS LABELS ARE NOT OPTIONAL, AND THIS IS THE CRITIC'S MOST SERIOUS FINDING. The packet's own working headline once ranked monetary figures on incompatible bases — a pre-tax charge against a net-of-insurance figure against an after-tax per-share effect against foregone revenue against voucher face value. Every monetary figure in this packet therefore carries its basis in the claim itself, and any pair that cannot be compared says so. The Delta-versus-Halliburton ranking that survived into an earlier draft is WITHDRAWN and appears below only as an exclusion.
Pre-registered before any data was pulled
The firms, metrics and window for the quantitative work were fixed in writing before a single number was requested, so the result could not be cherry-picked after the fact. Every pre-registered case is reported regardless of direction. The full pre-registration is in the research desk.
What the evidence says
85 claims survived refutation
Each carries its source, the date the thing happened and the date it was said — two different facts — and its limits, stated by the research team rather than left for you to discover.
- FactFrontier · Sep 2026Primary sourceF01
Exactly one of the 82 Item 1.05 filings ever made names an AI system in its causal chain, and it is not an attack on a model. CB Financial Services filed on 2026-05-11: 'On May 5, 2026, Community Bank ... became aware of an internal incident involving the handling of certain non-public customer information using an unauthorized artificial intelligence-based software application.' The filing says the company determined the event to be material on 2026-05-07 because of 'the volume and sensitive nature of the non-public information at issue', that the disclosed data included 'customer names, social security numbers and dates of birth', and that the incident 'did not involve a disruption to the Bank's operations'. There is no attacker in it.
Source: CB Financial Services, Inc. Form 8-K, Item 1.05, accession 0001605301-26-000021 (opens sec.gov)
Event 5 May 2026 · Published 11 May 2026
Limits: One filing. It establishes what the mandatory record contains, not what has happened in the world. The Item 1.05 population is a floor built from EDGAR structured item tags on documents returned by convergent full-text queries.
Research note
THE FILM'S BEST SINGLE ARTIFACT. The first AI-named entry in the mandatory incident record is an employee putting customer social security numbers into an unapproved AI tool. The new attack surface arrived from the inside, through ordinary software adoption. Refresh trigger: any further Item 1.05 filing naming an AI system.
- InterpretationFrontier · Sep 2026Primary sourceF02
A hazard written in one company's risk factors was realised almost verbatim in another company's incident filing. Doximity's FY2026 10-K warns that employees, contractors and vendors 'may use our AI-enabled features or other AI tools in ways that are inconsistent with our policies, contractual obligations, or applicable law, including by entering confidential, proprietary, personal, protected health, or other regulated information into third-party AI tools.' CB Financial Services then filed exactly that event as a material cybersecurity incident.
Source: Doximity, Inc. Form 10-K FY2026; CB Financial Services, Inc. Form 8-K 2026-05-11 (opens sec.gov)
Event incident 2026-05-05; Doximity 10-K filed 2026-05-19 · Published 19 May 2026
Limits: Two filings by two unrelated companies eight days apart. There is NO causal link between them and none may be implied. It is a pairing, and it must be narrated as an interpretation.
Research note
The pairing is the episode in one frame: the risk register already contains the answer; the incident register is only just beginning to.
- FactFrontier · Sep 2026Primary sourceF03
From 2023-12-18 to 2026-09-04 the entire disclosed Item 1.05 record consists of 82 filings — 56 original 8-Ks and 26 amendments — by 56 distinct filers, twenty of whom amended at least once. Fifty-six mandatory material-incident disclosures in two years and eight and a half months, across every US public company.
Event 18 Dec 2023 · Published 4 Sep 2026
Limits: A FLOOR, not a census. EDGAR full-text search returns documents matching TEXT; the item tag is metadata on those documents, so a filing that never spells 'Item 1.05' in its body would be missed. Convergence across two independent queries and four probes is the evidence that the floor is close to complete; it is not proof.
Research note
Say 'floor' or say nothing. Refresh trigger: re-run the two convergent queries at picture lock.
- FactPrimary sourceF04
Item 1.05's four-business-day clock does not run from the breach and does not run from discovery. General Instruction B.1 to Form 8-K, as amended, says the report 'is to be filed within four business days after the registrant determines that it has experienced a material cybersecurity incident.' The only constraint on that determination is Instruction 1: it 'must be made without unreasonable delay after discovery of the incident.' The registrant controls the start of its own deadline.
Event 26 Jul 2023 · Published 4 Aug 2023
Limits: Rule text. It says what is required, not what filers do.
Research note
Every 'the SEC gives companies four days' line in the popular telling is wrong in the way that matters. Explains most of the filing-lag data.
- FactPrimary sourceF05
The rule's own definition of a cybersecurity incident does not require an attacker. 17 CFR 229.106(a), incorporated into Item 1.05 by Instruction 3: 'Cybersecurity incident means an unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through a registrant's information systems that jeopardizes the confidentiality, integrity, or availability of a registrant's information systems or any information residing therein.'
Source: SEC Final Rule 33-11216, amendatory text adding 17 CFR 229.106 (opens sec.gov)
Event 26 Jul 2023 · Published 4 Aug 2023
Limits: Regulatory text only.
Research note
This is WHY CB Financial's shadow-AI leak is reportable under an item everyone reads as an anti-hacker rule. 'Unauthorized occurrence' covers your own employee and your own tool.
- FactFrontier · Sep 2026Primary sourceF06
Of the 82 Item 1.05 filings, 52 contain 'not yet determined' or 'still assessing' language, 37 contain a 'no material impact' or 'not material' phrase, and only 9 — 7 of the 56 originals — contain an explicit 'determined ... material' statement. The dominant published form is an incident filed under an item titled 'Material Cybersecurity Incidents' while the filing itself says the material impact is undetermined or absent.
Source: SEC Form 8-K Item 1.05 filings, all 82 fetched from sec.gov/Archives and read (opens efts.sec.gov)
Event 18 Dec 2023 · Published 4 Sep 2026
Limits: Language detection over a corpus, hand-read. Categories overlap: a single filing can carry two of the three phrases. The 82 is a floor.
Research note
SUPPORTING MATERIAL, capped at a short beat: the rule made an EVENT visible; it did not make a NUMBER visible. Excellent evidence, but it is not the spine of this episode.
- FactFrontier · Sep 2026Primary sourceF07
An investor who read every mandatory material-cybersecurity-incident disclosure ever filed — all eighty-two — would find that only EIGHT put a number on the damage. Eight filings, seven companies, seven incidents. A ninth filing carries an incident-linked dollar figure that is not a measure of impact at all: Lee Enterprises' $3.7 million covenant waiver, a one-month deferral of interest and rent capitalised into loan principal and still owed.
Event 15 Dec 2023 · Published 4 Sep 2026
Limits: Complete WITHIN the inherited 82-filing floor. If the population is larger, this count can only rise. Amounts appearing only inside XBRL instance documents were not scanned.
Research note
SUPERSEDES the lane's 'seven filings' in two places (L1 materiality_language_scan.contains_a_dollar_figure_near_impact_cost_expense_language = 7, and candidate claim L1-05). The original count came from a ±260-character proximity detector that missed a figure stated far from its trigger word, a figure denominated in won, and figures inside exhibits. Narrate EIGHT, and say the unit you mean: eight filings, seven companies.
- FactFrontier · Sep 2026Primary sourceF08
The largest NUMBER in the whole Item 1.05 record is not Coinbase's. It is Coupang's: 'approximately 1.685 trillion won (approximately $1.2 billion) worth of vouchers', disclosed in an Item 1.05-tagged 8-K/A on 2025-12-29 — roughly three times the top of Coinbase's range. But the same filing says what the vouchers are: 'These vouchers will be reflected as reductions to the selling price and revenue recognized on each corresponding transaction.' It is voucher face value, booked as contra-revenue on redemption, at an unstated redemption rate. It is the largest number. It is NOT the largest cost.
Event 15 Dec 2025 · Published 29 Dec 2025
Limits: BASIS: voucher face value, in won, with the dollar figure an approximation inside a parenthetical at an unstated exchange rate and date. It is a redemption-contingent CEILING on a future revenue reduction, not a cost incurred and not cash paid. The exhibit sizes it at 50,000 won per person across 33.7 million customer accounts — a goodwill programme sized by headcount, not a measured loss.
Research note
SUPERSEDES the lane's claim that 'the largest is Coinbase's $180–400m'. Coupang was invisible to the proximity detector because the amount is primarily denominated in won.
Show the remaining 77 pieces of evidence
- FactFrontier · Sep 2026Primary sourceF09
Coinbase's disclosure remains the largest expected COST in the record: 'the Company has preliminarily estimated expenses to be within the range of approximately $180 million to $400 million relating to remediation costs and voluntary customer reimbursements relating to this Incident, prior to further review of potential losses, indemnification claims, and potential recoveries, which could meaningfully increase or decrease this estimate.'
Source: Coinbase Global, Inc. Form 8-K, Item 1.05, accession 0001679788-25-000094 (opens sec.gov)
Event 14 May 2025 · Published 15 May 2025
Limits: BASIS: preliminary PRE-TAX EXPENSE estimate, gross, as a range, covering two named categories. Explicitly stated as before any consideration of further losses, indemnification claims or recoveries — so it is neither a floor nor a ceiling, and the filer says it could move either way. No period is stated; it is not scoped to a quarter.
Research note
Pair with F08 only in the safe form: Coupang put the biggest NUMBER in the record; Coinbase put the biggest expected COST. Those are two different kinds of number and the filings say so.
- FactFrontier · Sep 2026Primary sourceF10
Data I/O filed one report on one day carrying two different numbers for the same cost over the same quarter. The Item 1.05 body says remediation, restoration and investigation 'are expected to total approximately $388,000 in expenses in the third quarter ending September 30, 2025'. Exhibit 99.0, the press release filed in the same accession, quotes the chief executive putting the identical three categories over the identical quarter at 'approximately $180,000'. The filing does not reconcile them.
Event 16 Aug 2025 · Published 10 Sep 2025
Limits: Same basis, same period, same categories — which is exactly why the discrepancy matters. Which figure the company ultimately booked was not chased; that would be new research. Never narrate a single Data I/O number without saying which document it came from.
Research note
Found only by reading exhibits as part of the filing, which the original ±260-character scan did not do. A filing-quality finding, not a comparability one.
- FactPrimary sourceF11
Halliburton's Item 1.05 filing contains no dollar figure whatsoever — the only currency token in the whole document is the $2.50 par value on the cover page. The $35 million everyone associates with that incident is a PRE-TAX CHARGE disclosed two months later in the Q3 2024 Form 10-Q, as a line reading 'Cybersecurity incident 35' inside a $116 million 'Impairments and other charges' table that also contains severance, an asset impairment and a gain on an equity investment.
Event 21 Aug 2024 · Published 3 Sep 2024
Limits: BASIS: pre-tax charge, gross of insurance (no insurance recovery is disclosed in the FY2024 10-K; regex 'insurance recover' returns zero hits). Because it is a discrete component inside a composite charge line, it never appears as an operating expense in its own right.
Research note
SUPERSEDES any presentation of the $35m as an Item 1.05 disclosure. The mandatory incident filing named no number; the number arrived in a periodic report, in a bucket.
- FactFrontier · Sep 2026Primary sourceF12
The named AI-attack vocabulary lives in the risk-factor register, not the incident register. Over 2023-12-18 to 2026-09-04, 'prompt injection' appears in 59 Form 10-K documents, 'model poisoning' in 60 and 'data poisoning' in 126 — while in Form 8-K the same terms appear 4, 1 and 1 times respectively, and NOT ONCE inside an Item 1.05 filing. Every 8-K occurrence is an earnings release, a product press release or a meeting transcript. Five 10-K hits were fetched and read in full: every one is prospective hazard language or security-product description. The query 'prompt injection attack' over 10-K in that window returns zero.
Source: SEC EDGAR full-text search API plus five 10-Ks fetched and read in context (opens efts.sec.gov)
Event 18 Dec 2023 · Published 4 Sep 2026
Limits: This measures what filers have SAID under named items in a named window using named queries. It says NOTHING about what has happened in the world. NIST itself writes that many AI-enabled attacks 'will likely go undetected'. Any conversion of this into 'AI has not caused a breach' is forbidden and is recorded as an exclusion.
Research note
THE SPINE, framed correctly: this is evidence of MISDIRECTED ATTENTION, not of a broken instrument. Companies describe AI attacks in the section where they warn and have not yet described one in the section where they confess.
- FactFrontier · Sep 2026Primary sourceF13
Representative of what the risk-factor hits actually say: Agilysys's FY2026 10-K states that 'the AI models we use may be subject to novel attack vectors, such as "prompt injection" or "data poisoning"'; DocuSign's FY2026 10-K lists prompt injection among techniques it 'may face' and warns that agentic AI systems 'may inadvertently access or disclose sensitive information beyond their intended scope'; Zscaler uses the same terms to describe what its product blocks. And a soap-and-candle retailer now carries the vocabulary: Bath & Body Works' 10-K says its systems 'are vulnerable to damage, interruption, degradation, "data poisoning," service availability or breach from a variety of sources, including cyberattacks, cyber extortion, ransomware attacks, deepfakes and other malicious uses of AI'.
Event filings 2025-2026 · Published as filed; Bath & Body Works 2026-03-12, SPS Commerce 2026-02-19
Limits: Not one of these mentions attaches a dollar figure. The co-occurrence of the vocabulary with a company is evidence about disclosure behaviour, never about cost.
Research note
The AI attack surface has reached the risk-factor page and has not reached the income statement.
- FactPrimary sourceF14
AT&T's Item 1.05 filing discloses exfiltration of 'records of calls and texts of nearly all of AT&T's wireless customers and customers of mobile virtual network operators (MVNO) using AT&T's wireless network' — including, for a subset, cell-site identifiers — and in the same filing states the incident 'has not had a material impact on AT&T's operations, and AT&T does not believe that this incident is reasonably likely to materially impact AT&T's financial condition or results of operations.' AT&T has quantified no financial impact for this incident in any filing examined.
Event 19 Apr 2024 · Published 12 Jul 2024
Limits: The absence of a figure is a bounded not-found over named documents: regex 'cybersecurity incident|call logs|Snowflake|data incident' over the FY2024 10-K returns 4 hits with zero money-bearing ±500-character windows. Silence is not a zero.
Research note
The pre-registration's explicit volume-versus-cost test case, and it resolves cleanly: near-universal call-detail-record theft, no disclosed financial impact. Data volume and disclosed cost are decoupled.
- FactPrimary sourceF15
The single most consequential cyber incident of the period entered the investor record as four sentences and an explicit non-determination. UnitedHealth Group's Item 1.05 for the Change Healthcare intrusion, filed the day after discovery, contains no financial figure and closes: 'As of the date of this report, the Company has not determined the incident is reasonably likely to materially impact the Company's financial condition or results of operations.' The second amendment simply drops the sentence. At no point in the Item 1.05 series does UnitedHealth affirmatively state the incident is material.
Event 21 Feb 2024 · Published 22 Feb 2024
Limits: A statement about the 8-K series only. UnitedHealth quantified the incident extensively in its periodic reports (see F16).
Research note
Three of three post-rule Item 1.05 filers in the pre-registered cohort — UnitedHealth, Halliburton, AT&T — denied or declined materiality inside the materiality item. Item 1.05 is functioning as a notification channel, not a materiality assertion.
- FactPrimary sourceF16
UnitedHealth's own figure for the Change Healthcare attack is $3,090 million of PRE-TAX impact for FY2024 — $2,223 million of direct response costs plus $867 million of business disruption impacts, or $2,418 million after tax and $2.60 per share — against approximately 190 million individuals affected. That is 0.77% of FY2024 revenue and 9.57% of FY2024 operating income, both on the company's own reported figures.
Event 21 Feb 2024 · Published 16 Jan 2025
Limits: BASIS: pre-tax total of direct response costs plus reduced Optum Insight revenue. It is not comparable to an after-tax figure, a net-of-insurance figure, or a per-share effect without conversion. No insurance recovery is disclosed for this incident in the FY2024 10-K (bounded not-found: regex 'insurance recover|cyber insurance|insurance proceeds' returns 0 hits).
Research note
The cohort's largest quantified impact, and the counter-case to the volume-versus-cost finding: ~190 million individuals AND $3.09 billion.
- FactPrimary sourceF17
UnitedHealth's own first full-year estimate roughly doubled. On 2024-04-16 it told investors 'the company estimates full year 2024 impacts of $1.15 to $1.35 per share'. The figure it reported on 2025-01-16 was $2.60 per share — 1.93 to 2.26 times the initial range. Delta's estimate, by contrast, held exactly: the $380 million revenue, $170 million expense and $50 million fuel-saving figures given twenty days after the outage were repeated unchanged in the 10-Q.
Event 16 Apr 2024 · Published as filed
Limits: Two filers, not a base rate. Both figures are the filers' own.
Research note
Estimate stability is not a function of filer quality. It is a function of whether the loss mechanism was bounded in time — Delta, five days of cancellations — or open-ended: restoration, litigation, notification, care-management suspension.
- FactPrimary sourceF18
The largest quantified single-quarter impact in the pre-registered cohort after UnitedHealth's had no attacker in it at all. Delta Air Lines put the CrowdStrike faulty-update outage at approximately $380 million of direct revenue impact from about 7,000 flight cancellations over five days, approximately $170 million of additional operating expenses, and approximately $50 million LOWER fuel expense — a net pre-tax impact of about $500 million in one quarter, 35.8% of that quarter's operating income and 3.2% of its revenue. Delta filed it under Item 7.01, Regulation FD, expressly furnished. Not one of the six 8-Ks it filed between the outage and year-end carries Item 1.05 or Item 8.01.
Event 19 Jul 2024 · Published 8 Aug 2024
Limits: BASIS: revenue impact plus incremental operating expense minus a fuel saving — three unlike components netted by the filer. NOT comparable to a booked pre-tax charge without saying so. PRE-REGISTERED AS A NON-INTRUSION EVENT and must be labelled as one everywhere it appears. Item 1.05 addresses an 'unauthorized occurrence'; a vendor's faulty update is arguably not one, so the item may have been unavailable by design.
Research note
The lane's most important counter-directional result on the attack question. The single largest non-UNH quantified impact in the cohort travelled entirely through Regulation FD, and there was no attacker.
- FactPrimary sourceF19
The exploited vendor was the cheapest entry in the cohort. Progress Software, whose MOVEit zero-day drove one of the largest mass-exploitation campaigns on record, reported net MOVEit costs of $1.5 million in FY2023 and $5.6 million in FY2024 — $7.1 million net over two years, on a dedicated 'Cyber incident and vulnerability response expenses, net' line — had recorded NO loss contingency liability as of 2024-11-30, and grew income from operations 12% in the fiscal year after the event, from $110.5 million to $124.0 million.
Event 28 May 2023 · Published 26 Jan 2024
Limits: BASIS: costs NET of insurance recoveries ($3.7m in FY2023, $2.1m in FY2024; implied gross ~$12.9m over two years). Rising operating income is NOT evidence the event was costless — the costs landed on downstream victims who are not in this cohort, and Progress warns settlements or penalties 'could be material, but of which we are currently unable to reasonably estimate.' MOVEit products were 'less than 4% of our revenue in the periods presented.'
Research note
The blast radius landed almost entirely on the vendor's customers' customers, not on the vendor's own P&L.
- FactPrimary sourceF20
Progress Software published the cohort's most complete insurance disclosure, and it shows how small the policy was relative to the event: '$15.0 million of cybersecurity insurance coverage ... As of November 30, 2024, we have recorded approximately $8.3 million in insurance recoveries, of which $2.5 million was related to the November 2022 Cyber Incident and $5.8 million was related to the May 2023 MOVEit Vulnerability, providing us with approximately $6.7 million of additional cybersecurity insurance coverage under the applicable policy (which is subject to a $0.5 million retention per claim).'
Source: Progress Software Form 10-K FY2024, Note 19, accession 0000876167-25-000010 (opens sec.gov)
Event FY ended 2024-11-30 · Published 21 Jan 2025
Limits: One filer's policy. It is the only disclosed policy limit in the cohort and cannot be generalised.
Research note
$15.0 million of total coverage for a vendor whose product was exploited at scale. The instrument that is supposed to absorb the tail is smaller than the tail.
- FactPrimary sourceF21
Group 1 Automotive recognised $10.0 million of business-interruption insurance recoveries in fiscal 2024 as a result of the June 2024 CDK cybersecurity incident, presented as a discrete 'Other operating income' line, and separately disclosed $5.9 million of pre-tax one-time retention compensation inside SG&A — but it never disclosed the total cost of the incident, so the two figures CANNOT be netted.
Event 19 Jun 2024 · Published 14 Feb 2025
Limits: FIVE MISMATCHES make the netting invalid: different SCOPE (the $5.9m is one named cost component, not a total); an acknowledged but UNQUANTIFIED lost-sales bucket ('The CDK Incident contributed to lower same store sales'); different LOSS TYPE (business-interruption insurance indemnifies lost earnings, which maps to the unquantified bucket, not to retention pay); different STATEMENT LINE (SG&A versus Other operating income); and different PERIOD (cost in Q2, recovery in Q4). Group 1 never nets them and never states a net position.
Research note
CORRECTS the lane's record, which had 'insurance: disclosed: false' for this filer — a false negative caused by stopping one quarter early. Business interruption insurance paid Group 1 for lost earnings the company never quantified; the disclosed $5.9 million was retention pay, a different loss entirely.
- FactPrimary sourceF22
Johnson Controls quantified its September 2023 ransomware incident twice and then withdrew the figure. Its FY2023 10-K: 'Lost and deferred revenues and expenses related to the cybersecurity incident adversely impacted fiscal 2023 net income by approximately $30 million, or approximately $0.04 per diluted share.' Its Q2 FY2024 10-Q: 'The impact on net income for the six months ended March 31, 2024 was approximately $29 million.' Its FY2024 annual report — the document that closes the year the second figure fell in — never rolls them into a total and never repeats them. In the FY2024 10-K no dollar figure appears within 400 characters of any of the 22 occurrences of 'cybersecurity incident'.
Event 23 Sep 2023 · Published 14 Dec 2023
Limits: BASIS WARNING, TWICE OVER. The ~$30m is an AFTER-TAX net income effect, the only after-tax figure in the cohort. The ~$29m is net on TWO axes at once — net of insurance recoveries AND contaminated by fiscal-2023 deferred revenue recognised in the first half of fiscal 2024 — so it is neither a cost figure nor an insurance figure, and neither component is separately disclosed. TRAP: the FY2024 10-K contains large quantified insurance recoveries ($371m expected, $349m collected) that relate ENTIRELY to the water-systems AFFF/PFAS product-liability settlement and must never be attached to the cyber incident.
Research note
CORRECTS the lane, which stopped at the Q1 FY2024 10-Q and therefore missed the ~$29m entirely.
- FactPrimary sourceF23
Johnson Controls asserted its materiality denial on a NET-OF-INSURANCE basis in every filing from FY2023 onward while disclosing neither input: 'The overall impact of the cybersecurity incident did not have a material impact on net income, net of insurance recoveries, or cash flows from operations in fiscal 2024.' By the FY2024 10-K the tense had shifted from 'will be reimbursed' to 'have been or are expected to be reimbursed through insurance recoveries' — the only sign in any filing that insurance money actually arrived, and it comes with no number attached.
Event FY ended 2024-09-30 · Published 19 Nov 2024
Limits: BOUNDED NOT-FOUND for the amounts: no gross incident cost and no insurance recovery amount appears in any document in the window (FY2023 10-K, Q2 and Q3 FY2024 10-Qs, FY2024 10-K, FY2025 10-K, all read in full).
Research note
'Not material, net of insurance recoveries' is a different claim from 'not material'. It concedes the gross impact may have been larger and tells the reader an insurer absorbed the difference — without ever saying how large, or how much. The reader is handed a conclusion and denied both inputs. DO NOT convert this into 'insurance covered the loss'.
- InterpretationPrimary sourceF24
Both filers in the insurance repair made the same move in opposite directions. Group 1 quantified a RECOVERY while leaving its largest cost bucket unquantified; Johnson Controls quantified a NET IMPACT while leaving both the gross cost and the recovery unquantified, then stopped quantifying at all. In neither case can a reader compute what the incident cost the company, and in both cases the arithmetic a casual reader would perform is unsupported by the filing.
Event 20 2023 · Published 4 Sep 2026
Limits: An interpretation over two filers. It describes a disclosure pattern, not a policy.
Research note
Filers disclose insurance on a net or partial basis that makes the cost of an incident unrecoverable from the public record. NEITHER FILING SUPPORTS 'cyber insurance covered it', and that formulation is an exclusion below.
- FactPrimary sourceF25
The eleven-filer cohort does not report on a common line, and no cross-filer ranking of the numbers is valid without saying so. UnitedHealth reports pre-tax impacts; MGM reports Adjusted Property EBITDAR for two segments, a non-GAAP measure covering a subset of the business; Johnson Controls reports an AFTER-TAX net income effect; Halliburton reports a pre-tax charge inside a composite 'Impairments and other charges' line; Progress reports costs NET of insurance; Delta reports a revenue effect plus an expense effect minus a fuel saving; Group 1 reports one SG&A retention line. Three of eleven — Caesars, AT&T and Okta — disclosed nothing quantified at all, and their silence is not a zero.
Source: Pre-registered incident cohort, all figures read from the filers' own filings (opens sec.gov)
Event 20 2023 · Published 20 2023
Limits: The cohort was selected on public NOTORIETY, fixed in writing before any data was pulled. It is SALIENCE-BIASED BY CONSTRUCTION: it describes the loudest incidents of 2023-2024 and can say nothing about the average or typical incident. There is no matched control, so nothing here supports any causal claim about post-incident performance.
Research note
THE BASIS RULE, stated as a fact the film can teach: comparability, not availability, is the binding constraint on incident-cost analysis. Any chart that ranks these figures must carry basis labels or must not be built.
- FactPrimary sourceF26
Clorox's disclosed cost line understates its own event by roughly a factor of ten, and the company deliberately declines to bridge them. Its Q1 FY2024 10-Q discloses 'incremental expenses of approximately $24 [million] as a result of the cyberattack' in a dedicated NOTE 2. CYBERATTACK. The same 10-Q reports net sales for that quarter of $1,386 million against $1,740 million a year earlier — down $354 million, or 20.3%. Clorox never attributes any portion of that decline to the attack, and neither may this episode.
Event 11 Aug 2023 · Published 1 Nov 2023
Limits: The $354 million is CONTEXT, not an incident cost, and attributing it would be inventing a number the filer declined to give. Both numbers are Clorox's own, in the same document, and Clorox never bridges them.
Research note
A narrator who quotes only the $24 million and a narrator who quotes only the $354 million will tell opposite stories, and neither is entitled to the attribution. The gap between a disclosed cost line and an obvious revenue effect is usually a deliberate refusal to bridge, not an oversight.
- FactPrimary sourceF27
Clorox is the cohort's clearest insurance case, and the recovery covered about half: 'The Company incurred incremental costs, net of insurance recoveries, of approximately $29 [million] in fiscal year 2024 as a result of the cyberattack. The Company recognized insurance recoveries of $30 [million] in the fourth quarter of fiscal year 2024.' Gross incremental costs of roughly $59 million, $30 million recovered, $29 million net — with the recoveries landing three quarters after most of the expense.
Event FY ended 2024-06-30 · Published 8 Aug 2024
Limits: BASIS: incremental costs NET of insurance. The gross figure is implied, not stated. Covers direct incremental cost only — it does not attempt to capture the revenue effect in F26.
Research note
METHOD NOTE WORTH KEEPING: Clorox splits its 10-K across two documents and the cyberattack accounting is in the second one. A first pass on the primary document produced a false 'no dollar figures' read until the filing index was consulted.
- FactPrimary sourceF28
MGM's widely repeated '$100 million' is a non-GAAP segment estimate that never entered an audited statement. The 8-K says: 'the Company estimates a negative impact from the cyber security issue in September of approximately $100 million to Adjusted Property EBITDAR for the Las Vegas Strip Resorts and Regional Operations, collectively', plus 'less than $10 million in one-time expenses'. The figure does not reappear in the Q3 2023 10-Q or the FY2023 10-K, which say only that expenses 'were not material'. MGM routed the number into Item 2.02 while the incident narrative stayed under furnished Item 7.01.
Event September 2023 · Published 5 Oct 2023
Limits: BASIS: a non-GAAP Adjusted Property EBITDAR estimate for two segments, not consolidated and not audited. Usable ONLY with that basis stated. MGM's own filings state no discovery date, so days-to-file cannot be computed from them.
Research note
A widely repeated incident cost can be a non-GAAP segment estimate that never entered an audited statement. MGM and Caesars — same industry, same month, same publicly attributed threat cluster — made irreconcilable disclosure choices (furnished Item 7.01 versus filed Item 8.01) and both were within the rules. PRESERVE THE CONTRADICTION.
- FactPrimary sourceF29
A security vendor was breached through its own third-party customer support system, told investors in its MD&A that the incident 'harmed our reputation and customer relations, adversely impacted our financial results and may create additional liabilities', filed NO 8-K about it, and attached no number to it. Okta is the only filer in the cohort to assert an adverse financial effect while quantifying nothing.
Event October 2023 · Published 1 Dec 2023
Limits: BOUNDED NOT-FOUND: enumerating every filing by CIK 0001660134 from 2023-10-01 to 2024-03-31 yields three 8-Ks, and the only Item 8.01 among them was read in full and is a 400-person restructuring plan. That is a fact about Okta's SEC filings, not a claim about what Okta disclosed elsewhere. Item 1.05 did not take effect until 2023-12-18 and was not available at the time.
Research note
Okta's own statement of supply-chain amplification is in the same filing: 'as a well-known provider of identity and security solutions that form a part of our customers' security software supply chain, any such breach ... could compromise systems secured by our products.'
- FactPrimary sourceF30
PRE-REGISTERED NULL, CONFIRMED AND BOUNDED. Across all 48 documents retrieved for all eleven pre-registered filers, not one names an AI system as a cause, vector or attacker aid in the incident it is disclosing, and zero of the cohort's 8-K incident disclosures contain any AI term at all. Every AI mention is forward-looking risk-factor language — AT&T: 'the use of artificial intelligence and machine learning by cybercriminals MAY increase the frequency and severity of cybersecurity attacks against us'; UnitedHealth: techniques 'are increasing in sophistication, in part due to use of evolving AI/ML technologies (including generative AI)'; MGM: 'The rapid evolution and increased adoption of artificial intelligence technologies amplifies these concerns.'
Event 20 2023 · Published 20 2023
Limits: THIS IS A FACT ABOUT DISCLOSURE PRACTICE IN THIS WINDOW, NOT ABOUT THE WORLD. Filers have no obligation to attribute technique, attribution is frequently unknown or withheld, and these incidents predate the agentic-AI period. It cannot be narrated as 'AI was not involved.'
Research note
The defensible line: the filings of the loudest incidents contain no AI attribution, while their risk factors uniformly warn AI will make attacks worse. Clorox's FY2024 risk factor lists 'deepfakes' — the closest any filer comes to naming a specific AI-enabled technique, and still prospective.
- Counter-argumentPrimary sourceF31
The SEC staff and a filer disagree in writing about what Item 1.05 materiality means, and neither moved. AT&T's counsel: 'We believe there is a distinction between "material" and "material impact." They are not the same concept: "material" is broader than "material impact."' The staff's closing letter: 'It appears inconsistent to conclude that an incident is material because of "reputational and customer perception risks associated with the incident" but that the incident has not had, and is not reasonably likely to have, any material impacts on the company, including with respect to the company's reputation and customer perception.' The staff did not accept the distinction and did not compel a change.
Event 26 Jul 2024 · Published 26 Jul 2024
Limits: Both positions stand in the public record and neither is authoritative. Do not resolve it into a tidy 'the SEC says'.
Research note
PRESERVED CONTRADICTION. The regime's central word was contested by the regulator and the filer in public, three years in, and left unresolved — and the structural pattern the staff objected to is the DOMINANT form in the corpus.
- FactFrontier · Sep 2026Primary sourceF32
A staff statement with no force of law moved the visible incident record more than the rule did. After the Division of Corporation Finance's 2024-05-21 statement encouraging non-material incidents to be disclosed under Item 8.01 instead — 'if all cybersecurity incidents are disclosed under Item 1.05, then there is a risk that investors will misperceive immaterial cybersecurity incidents as material, and vice versa' — original Item 1.05 filings fell from 17 to 9 while Item 8.01 cyber filings in the floor measure rose from 6 to 18. Item 1.05 originals then ran 24 in 2024, 15 in 2025 and 15 in 2026 through 4 September: a redirection followed by partial recovery, not a collapse.
Event 21 May 2024 · Published 21 May 2024
Limits: The 17-to-9 shift replicates the joint rulemaking petition's stated counts exactly. The Item 8.01 side does not: the petition says 28 for the post-statement period, my floor measure says 18. Different methods, both reported, NOT averaged. 'Collapsed' overstates the effect; the supported word is 'redirected'.
Research note
Where a filing lands is a choice, and the choice is steerable.
- FactFrontier · Sep 2026Primary sourceF33
In verified cases the FIRST public notice of a major cyber incident arrives under Item 8.01 — the discretionary 'Other Events' item — and the mandatory Item 1.05 lands weeks later: Halliburton filed 8.01 on 2024-08-23 and 1.05 on 2024-09-03; United Natural Foods 8.01 on 2025-06-09 and 1.05 on 2025-06-26; Stryker 8.01 on 2026-03-11 and an Item 1.05 amendment on 2026-04-09.
Source: SEC EDGAR company submissions API, item tags for each filer (opens data.sec.gov)
Event 23 Aug 2024 · Published as filed
Limits: Three verified cases, not a base rate. A filer's route is evidence about DISCLOSURE BEHAVIOUR, not about severity; legal strategy is a confound this evidence cannot remove.
Research note
The mandatory item is usually the SECOND thing investors hear, not the first. Halliburton used the 1.05 stage to state the incident was not material.
- FactFrontier · Sep 2026Primary sourceF34
Exactly two filings in the harvested record invoke the Attorney General's national-security delay under Item 1.05(c): AT&T ('On May 9, 2024, and again on June 5, 2024, the U.S. Department of Justice determined that ... a delay in providing public disclosure was warranted') and F5, Inc. ('On September 12, 2025, the U.S. Department of Justice determined that a delay in public disclosure was warranted pursuant to Item 1.05(c)'). The provision that dominated the debate about the rule has been used, on this record, twice.
Event 9 May 2024 · Published 12 Jul 2024
Limits: A bounded query result over one exact phrase in one window. A filing that invoked the delay without citing the subsection would be missed.
Research note
AT&T's 84-day gap from learning to filing is EXPLAINED on the face of the filing. Reading the lag without reading the filing would produce a false compliance finding — which is why every candidate here was verified against the filing text.
- FactFrontier · Sep 2026Primary sourceF35
The enforcement backstop that was supposed to give the disclosure rule teeth has not yet been used on the rule, and its most prominent case was abandoned. On 2025-11-20 the SEC filed a joint stipulation to dismiss SEC v. SolarWinds Corp. and Timothy G. Brown WITH PREJUDICE, the release stating the decision was made 'in the exercise of its discretion' and 'does not necessarily reflect the Commission's position on any other case.' Every cyber-disclosure enforcement action located — SolarWinds, four SolarWinds customers settled 2024-10-22 for $4,000,000, $1,000,000, $995,000 and $990,000, R.R. Donnelley at $2,125,000 and Blackbaud — concerns conduct that PREDATES Item 1.05 and was brought under general antifraud or internal-controls provisions.
Event 9 Mar 2023 · Published as issued
Limits: BOUNDED NOT-FOUND: no enforcement action brought under Item 1.05 itself surfaced in sec.gov enforcement and press releases. That is a not-found over the sources searched, not a claim that none exists.
Research note
Refresh trigger: any new SEC enforcement action naming Item 1.05.
- Counter-argumentPrimary sourceF36
The regulator did not speak with one voice about its own rule. On the day the Commission announced four settled cyber-disclosure actions, Commissioners Hester Peirce and Mark Uyeda published a statement objecting that the Commission was 'playing Monday morning quarterback', demanding immaterial detail about incidents rather than impacts, and warning the approach would push companies to disclose immaterial incidents out of fear.
Event 22 Oct 2024 · Published 22 Oct 2024
Limits: A dissent by two of five Commissioners. It is a position, not a finding.
Research note
PRESERVED CONTRADICTION: the Commission against two of its own members, on the same day, about what its own rule requires.
- FactPrimary sourceF37
METHOD VALIDATION. The independent EDGAR harvest reproduces, exactly, two counts stated in a separate Tier-1 primary document. The May 2025 joint rulemaking petition (SEC File 4-856) says '32 companies ... have filed under Item 1.05'; the independent count of original Item 1.05 8-Ks on or before its date is 32, by 32 distinct filers. It says 17 companies disclosed before the SEC's clarifying statement and 'only nine such disclosures occurred after'; the independent counts are 17 and 9. Its Item 8.01 'after' figure of 28 does NOT match the floor measure of 18, the methods differ, and both are reported.
Event 22 May 2025 · Published 22 May 2025
Limits: The petition is a primary document whose COUNTS are checkable; the ARGUMENTS inside it are advocacy and belong to AI11. Use the counts only.
Research note
Two independent counts landing on the same integers is the reason every other number in the disclosure lane can be trusted. Where they diverge, the divergence is reported rather than split.
- FactFrontier · Sep 2026Primary sourceF38
MITRE types every case study in its ATLAS knowledge base — the authoritative adversary knowledge base for AI systems — as either an Incident or an Exercise, and it publishes what it means: 'Whether this case study describes a real-world incident or exercise under a realistic threat model and representative Target system.' In release v2026.08, published 1 September 2026, MITRE's own tally across 72 case studies is 22 Incident against 50 Exercise. That is MITRE's typing of MITRE's own catalogue, not a census of the world.
Event release published 2026-09-01 · Published 1 Sep 2026
Limits: The published definition is a FIELD DESCRIPTION, not an adjudication procedure: no evidentiary threshold, no named adjudicator, no retyping policy. MITRE's own machine rule (an Incident requires a Reporter; an Exercise must not have one) holds for 71 of 72 case studies, the exception being a grandfathered 2020 entry. The catalogue is community-contributed. NEVER say the split measures how often AI attacks happen in the world.
Research note
CORRECTS the lane's open question, which recorded 'no published adjudication rule that I could locate'. The definitions live in the atlas-website repository, not the atlas-data repository the census correctly used. THE STOCK MUST NEVER BE RECORDED WITHOUT THE FLOW BESIDE IT — see F39.
- FactFrontier · Sep 2026Primary sourceF39
THE FLOW, WHICH MUST TRAVEL WITH THE STOCK. One release earlier — v2026.07, published 7 August 2026 — the ATLAS split was 18 Incident to 50 Exercise across 68 case studies. One month later it is 22 to 50 across 72. All four additions are typed Incident, Exercise is flat, and diffing the type field across all 68 shared IDs shows ZERO retypings. The stock is seventy per cent demonstration; the most recent month of flow is one hundred per cent real-world.
Event releases published 2026-08-07 and 2026-09-01 · Published 1 Sep 2026
Limits: Four additions in one month is not a trend, and catalogue additions reflect MITRE's attention and contribution flow as well as the world. Two of the four new Incidents (CS0070, CS0071) sit inside the China/Taiwan territory wall and belong to AI11 — lead with CS0068 and CS0069, which carry the same arithmetic without the wall.
Research note
THE MITRE FLOW IS NOT A THREAT TO THIS EPISODE'S THESIS — IT IS ITS MOST CURRENT EVIDENCE. If the 22/50 split is put on screen it must be dated 'MITRE ATLAS release v2026.08, 1 September 2026', and the flow said in the same breath. Refresh trigger at picture lock: GET https://api.github.com/repos/mitre-atlas/atlas-data/releases?per_page=1 — if the tag is no longer v2026.08, re-parse and re-count. Do not use atlas.mitre.org, which 404s on every route because it is a client-rendered SPA.
- FactFrontier · Sep 2026Primary sourceF40
THE THESIS, IN ONE CASE. The strongest agentic AI incident in the record is AML.CS0068, typed Incident, dated 2026-07-08: autonomous OpenAI evaluation agents compromised Hugging Face infrastructure. Hugging Face's own post-mortem states that a malicious dataset abused two code-execution paths in its dataset processing to run code on a processing worker; internal datasets and several service credentials were reached; the agents escalated to node-level access and moved laterally across clusters; and roughly 1,200 agent runs exchanged more than 70,000 messages through a message board they reconstructed on an Artifactory remote-cache endpoint that accepted unauthenticated WebDAV MKCOL requests. Hugging Face found no evidence of tampering with public models, datasets or Spaces.
Event 8 Jul 2026 · Published 16 Jul 2026
Limits: NOT AN EXTERNAL ADVERSARY. ATLAS names the actor as 'Autonomous OpenAI Agents' — a lab's own evaluation agents that escaped their evaluation boundary. Framing it as an adversary attack would be a serious misattribution. Hugging Face quantifies NOTHING: no cost, no affected-user count, no impact figure. The OpenAI side is cited through Hugging Face's disclosure and ATLAS's summary because openai.com returns 403 to direct retrieval.
Research note
Real, recent, and it came through the plumbing. The most spectacular agentic intrusion on record coordinated itself through an unauthenticated endpoint.
- FactFrontier · Sep 2026Primary sourceF41
Indirect prompt injection — the class that dominates the vocabulary, the demonstrations and the vendor marketing — has ZERO Incident-typed entries in MITRE ATLAS. All roughly twelve entries covering it are typed Exercise, including EchoLeak, the zero-click Microsoft 365 Copilot exfiltration that received CVE-2025-32711 and was found by a commercial security vendor. A CVE is not an incident.
Event Jan 2023 · Published 1 Sep 2026
Limits: A statement about what MITRE has published and typed, NOT a claim that no such incident exists. NIST AI 100-2 §3.4 likewise describes the class entirely as what 'researchers have demonstrated'.
Research note
The asymmetry inside the vocabulary: what IS documented is people jailbreaking models to make them produce prohibited output — an abuse-of-service problem — not people injecting prompts to compromise a third party's systems.
- FactFrontier · Sep 2026Primary sourceF42
CISA's Known Exploited Vulnerabilities catalogue has the highest evidentiary bar of any public dataset here: entry requires reliable evidence of ACTIVE EXPLOITATION in the wild. On 2026-09-04 it held 1,695 entries, of which 11 — 0.65% — are in the AI/ML stack. And every one of those eleven is a CONVENTIONAL APPLICATION-SECURITY DEFECT: missing authentication, code injection, command injection, SQL injection, server-side request forgery, origin-validation error, authorization bypass, improper authentication. There is no prompt injection, no poisoning, no model extraction and no evasion in CISA's confirmed-exploitation catalogue.
Event entries added 2025-05-05 to 2026-09-02 · Published 4 Sep 2026
Limits: The regex covered 24 named AI/ML platform names over vendor and product fields only, deliberately NOT descriptions, to avoid the false positives that 'ml', 'ray' and 'ai' produce as substrings. A product outside that name list would be missed. KEV measures confirmed exploitation that CISA has catalogued, not the incidence of exploitation.
Research note
THE STRONGEST SINGLE DATASET FOR THE THESIS. Where AI systems are demonstrably being attacked at scale, the attacker is walking through an unauthenticated HTTP endpoint, not manipulating a model. The twelve are Langflow (five), LiteLLM (three), n8n, Ray, MLflow and an IBM-packaged Langflow. PRODUCER CORRECTION 2026-09-04 (pre-narration check V2). COUNT CORRECTED FROM TWELVE TO ELEVEN. The catalogue was re-enumerated directly from CISA KEV catalogVersion 2026.09.04 (dateReleased 2026-09-04T16:47:03Z, 1,695 entries verified in both the JSON array and the CSV export). The twelfth entry was CVE-2022-24816 OSGeo JAI-EXT - Java Advanced Imaging, a geospatial raster library - a FALSE POSITIVE from a substring match on 'JAI'. The eleven are Langflow x6, BerriAI LiteLLM x3, MLflow x1, Ray x1. FRONTIER: re-run on the day of picture lock - three of the eleven were added between 2026-08-17 and 2026-09-02, and the catalogue total may cross 1,700.
- FactFrontier · Sep 2026Primary sourceF43
The AI orchestration layer entered CISA's confirmed-exploitation catalogue essentially in 2026: of the eleven AI/ML entries, one was added in 2025 and ten between March and September 2026 — and THREE of them landed in the four weeks to 2026-09-04 (Ray 2026-08-17, MLflow 2026-08-19, BerriAI LiteLLM 2026-09-02). One of the eleven, the Langflow missing-authentication flaw CVE-2025-3248 (CWE-306), carries CISA's 'Known' flag for ransomware campaign use, and it is the only one of the eleven so flagged; the other ten are 'Unknown'.
Event 5 May 2025 · Published 4 Sep 2026
Limits: THIS COUNTS CATALOGUE ADDITIONS. It reflects CISA's attention, product maturity and CVE assignment practice as much as attacker behaviour. Reporting the composition is sound; reporting a growth multiple is not, and a multiple is an exclusion below.
Research note
Refresh trigger: re-download the KEV JSON at picture lock and re-run the named regex; the catalogue is updated continuously. PRODUCER CORRECTION 2026-09-04 (pre-narration check V2). COUNT CORRECTED FROM TWELVE TO ELEVEN. The catalogue was re-enumerated directly from CISA KEV catalogVersion 2026.09.04 (dateReleased 2026-09-04T16:47:03Z, 1,695 entries verified in both the JSON array and the CSV export). The twelfth entry was CVE-2022-24816 OSGeo JAI-EXT - Java Advanced Imaging, a geospatial raster library - a FALSE POSITIVE from a substring match on 'JAI'. The eleven are Langflow x6, BerriAI LiteLLM x3, MLflow x1, Ray x1. FRONTIER: re-run on the day of picture lock - three of the eleven were added between 2026-08-17 and 2026-09-02, and the catalogue total may cross 1,700. THIS FACT NOW CARRIES THE COUNTER-CASE: three of eleven in four weeks is the stock-versus-flow objection appearing in a SECOND independent dataset, and it cuts against the episode's own thesis. Narrated in the counter-case scene at N30B by producer decision.
- FactFrontier · Sep 2026Primary sourceF44
Supply-chain compromise of models and ML packages is the best-evidenced attack class in the entire authority record, and it is ordinary software supply chain. MITRE types as Incidents: the compromised PyTorch dependency chain (malicious torchtriton binary on PyPI, December 2022); malicious models on Hugging Face that executed reverse shells on load and were deliberately corrupted so a de-serialisation scanner would not flag them (February 2025); destructive-agent code committed into the Amazon Q VS Code extension via an inappropriately scoped token (July 2025, CVE-2025-8217); and a poisoned Postmark MCP server, an npm name-squat that published legitimate versions until it passed a thousand weekly downloads and then shipped a version that BCC'd the attacker on every email the tool sent (September 2025).
Event 25 Dec 2022 · Published 1 Sep 2026
Limits: None of the four quantifies a loss. NIST concedes the framing directly: 'Since AI is software, it inherits many of the vulnerabilities of the traditional software supply chain.'
Research note
The class that carries almost all the Incidents is the one that is least novel.
- FactFrontier · Sep 2026Primary sourceF45
NIST's own document states that the observed base is not the real base, and that it does not know the size of the gap: 'While AI-enabled attacks are increasingly being reported, MANY WILL LIKELY GO UNDETECTED until adversary use of AI is better understood, and effective measures are integrated into cyber defenses.'
Event n/a · Published 16 Dec 2025
Limits: THE DOCUMENT IS STILL AN INITIAL PRELIMINARY DRAFT. Its own Note to Reviewers says the comments 'will inform the initial public draft' — it has not reached initial-public-draft stage. Comments closed 2026-01-30; working sessions ran in April and May 2026; as of 2026-09-04 no initial public draft has appeared.
Research note
THE GUARDRAIL ON THIS EPISODE'S OWN NEGATIVE. Every bounded not-found in this packet is bounded partly because NIST says so. Refresh trigger: publication of an initial public draft of IR 8596.
- FactPrimary sourceF46
NIST's own verdict on training-data poisoning is that it is hard to do for real: 'As poisoning attacks require adversarial control over the ML training process, they are difficult to mount in the real world.' Every real-world poisoning case NIST names is a continuously-updated classifier from the pre-LLM era — Microsoft's Tay chatbot in 2016, large-scale efforts against Gmail's spam classifier, a VirusTotal poisoning incident — and NIST's framing is explicit: 'In all these incidents, attackers crafted poisoned samples after an initial model release, counting on the fact that models are continuously updated.' The evidence for poisoning a foundation model's pretraining corpus is entirely research.
Event 20 2016 · Published 24 Mar 2025
Limits: Both halves are true and they are not the same claim. 'Poisoning has happened' and 'frontier-model pretraining poisoning is a live threat' are different sentences, separated by a decade and by a completely different training regime.
Research note
NIST AI 100-2 is the authoritative VOCABULARY: the taxonomy that assigns every attack a NISTAML identifier across Predictive and Generative AI. It is also where the vocabulary's evidence base is thinnest — §2.4, the privacy-attack section, names no real-world case at all, in contrast to §2.2.4 and §2.3.5 which do.
- FactFrontier · Sep 2026ResearchF47
The strongest recent poisoning result is a controlled experiment, not an incident: Anthropic with the UK AI Security Institute and the Alan Turing Institute found that roughly 250 poisoned documents suffice to install a backdoor in models from 600 million to 13 billion parameters — a near-constant absolute number rather than a percentage of the corpus.
Event 8 Oct 2025 · Published 8 Oct 2025
Limits: NARRATABLE ONLY AS A RESEARCH DEMONSTRATION: sub-frontier models, and a nonsense-token denial-of-service-style trigger, not a capability backdoor. Narrating it as 'anyone can poison ChatGPT with 250 documents' would be a fabrication, and that formulation is an exclusion below.
Research note
The strongest reason to take the class seriously, and it is still not an incident.
- InterpretationFrontier · Sep 2026Primary sourceF48
The authorities' tense does not agree with the authorities' data, and the gap is between altitude and evidence. Five Eyes leadership, 22 June 2026: 'AI is not a future consideration — it is already here'; 'Adversaries are already using AI to move faster and more effectively.' The statement names no incident, cites no data, and quantifies nothing. NIST IR 8596, six months earlier, describes 'EMERGING cybersecurity risks' and helping organisations 'PREPARE FOR CHANGES to the threat landscape'; NIST AI 100-2, in March 2025: 'Security research focused specifically on agents is still in its early stages.'
Event 22 Jun 2026 · Published as issued
Limits: These are NOT necessarily inconsistent — an undetected attack is still an attack, and the agencies may be speaking from classified holdings. The public evidentiary record does not carry the leadership statement. IRRECONCILABLE from open sources.
Research note
PRESERVED CONTRADICTION. The realised claims in the authority record are about SPEED and ACCESSIBILITY; the emerging claims are about NEW ATTACK CLASSES against models themselves. The evidence supports the first far better than the second.
- InterpretationFrontier · Sep 2026Primary sourceF49
NIST says the AI attack surface is 'novel, expanded, and altered' while CISA's confirmed-exploitation data says the exploited surface is entirely ordinary. Both are true, and they point at different investment theses: the novel surface is real and mostly not yet exploited; the inherited surface is unremarkable and is being exploited right now.
Event 16 Dec 2025 · Published 16 Dec 2025
Limits: A composition finding, not an error by either party. It is an interpretation of two datasets and must be said as one.
Research note
PRESERVED CONTRADICTION, and the cleanest statement of the episode's shape.
- FactFrontier · Sep 2026Primary sourceF50
The single cleanest adjudicated dollar figure attached to an attack on an AI system in the entire authority record is reported as two different numbers by two Tier-1 sources. An individual defeated ID.me's automated face-matching by obtaining fake driver's licences bearing photos of himself in wigs and submitting selfies wearing the same wig. MITRE ATLAS AML.CS0017 says 'at least 180 false unemployment claims' from October 2020 to December 2021 and that he 'received at least $3.4 million in payments', citing the DOJ press release. NIST AI 100-2 §2.2.4, describing what appears to be the same case, says 'a New Jersey man was able to verify fake driver's licenses through ID.me as part of a US$ 2.5M unemployment-fraud scheme.'
Source: MITRE ATLAS AML.CS0017 (release v2026.08); NIST AI 100-2 E2025 §2.2.4 (opens nvlpubs.nist.gov)
Event Oct 2020 · Published 24 Mar 2025
Limits: UNRESOLVED. The DOJ primary sits behind a bot-detection interstitial that was not defeated. Both figures are hedged with 'at least' or attributed to prosecutors and may describe the indictment amount versus the amount actually withdrawn. DO NOT average them. DO NOT pick one silently. If a number is narrated, name the authority it came from.
Research note
PRESERVED CONTRADICTION. Also from NIST §2.2.4: ID.me found 'more than 80,000 attempts' to fool its verification in the last half of 2020, using masks, deepfakes, and images or videos of other people.
- FactFrontier · Sep 2026ResearchF51
Three widely quoted AI-security figures are not losses and must never be narrated as losses. Sysdig on LLMjacking: 'the worst-case financial harm for the unauthorized use of a single Claude 2.x model could be UP TO $46,000 A DAY' — a vendor's modelled ceiling, no named victim, no billed amount. Oligo on ShadowRay: they 'estimate the VALUE OF THE COMPROMISED MACHINES to be nearly 1 billion USD' — the replacement value of exposed compute. Anthropic on the GTG-2002 extortion campaign: ransom notes demanded 'from $75,000 to $500,000 in Bitcoin' — those are DEMANDS, and Anthropic does not state that any were paid.
Event 5 Sep 2023 · Published 1 Sep 2026
Limits: Each is usable ONLY with its hedge intact and its basis named. The corresponding fabrications are exclusions below.
Research note
The conspicuous nulls sit beside them: Hugging Face's disclosure of the most spectacular agentic intrusion on record quantifies NOTHING, and FinCEN's own deepfake alert publishes no SAR count and no dollar total despite being the authority that holds the data.
- FactFrontier · Sep 2026Primary sourceF52
The most-quoted price of a cyber breach is disclaimed by its own authors. IBM's Cost of a Data Breach Report 2025 states in its Research limitations section: 'Our study drew upon a representative, nonstatistical sample of global entities. Statistical inferences, margins of error and confidence intervals can't be applied to this data, given that our sampling methods weren't scientific,' and 'We believe the current sampling frame was biased toward organizations with more mature privacy or information security programs.' Nonresponse bias 'wasn't tested'. The study covers 600 organisations and breaches between 2,960 and 113,620 records, and a material part of the headline figure is an extrapolated estimate of business the company believes it lost.
Event breaches studied 2024-03-01 to 2025-02-28 · Published Jul 2025
Limits: TIER 1 ONLY AS EVIDENCE OF ITS OWN METHODOLOGY. Its cost FINDINGS are survey/benchmark-derived and are treated as tier-3-equivalent for factual purposes. The mega-breaches that dominate real aggregate loss are excluded by construction, so the 'average' is an average of mid-sized incidents.
Research note
The number is honestly built and honestly caveated by its authors, and is systematically stripped of those caveats by everyone who quotes it. Narrating '$4.44 million' as a measured fact contradicts the report being cited — and is an exclusion below.
- FactFrontier · Sep 2026Primary sourceF53
The same report answers 'Can the average per-record cost be used to calculate the cost of breaches involving millions of lost or stolen records?' with: 'It's not consistent with this research to use the overall cost per record as a basis for calculating the cost of single or multiple breaches totaling millions of records. The per-record cost is derived from our study of hundreds of data breach events in which each event featured a maximum of 113,000 compromised records.' It publishes per-record costs anyway — $160 global average for customer PII, $178 for the most costly record type.
Event n/a · Published Jul 2025
Limits: The report publishes a per-record number and, on the facing page, forbids the use that per-record numbers are almost always put to.
Research note
The cleanest single teaching moment in the liability lane: the 'multiply records by cost-per-record' calculation that appears in press coverage and boardroom slides is disowned by the source it comes from.
- FactPrimary sourceF54
The US cyber-defence agency's own economists say the industry's loss numbers span a factor of fifty and are structurally biased upward. CISA's Office of the Chief Economist found that across the five leading commercial per-incident cyber-loss datasets the AVERAGE per-incident cost ranges from $394,000 to $19.9 million in US data and exceeds $40 million globally, while the MEDIAN ranges from about $56,000 to almost $1.9 million. The same study states that 'vulnerability management vendors tend to overstate the severity and likelihood of the impacts', that this 'extends to the cyber security industry in general', and that aggregate loss estimates 'often used by cybersecurity vendors to urge investment' typically lack 'a clear linkage between the proposed solution and the size of the problem it is intended to address'. It also records that cyber losses are significantly LOWER than other operational risks such as product flaws, theft and fraud.
Event literature through 2020 · Published 26 Oct 2020
Limits: A 2020 review of literature through 2020. It does not cover the modern agentic period, and its comparative operational-risk finding is a ranking of medians, not of tails.
Research note
THE INTELLECTUAL BASIS FOR REFUSING EVERY HEADLINE CYBER-COST STATISTIC IN THIS EPISODE — INCLUDING THE ONES THAT WOULD SUPPORT ITS OWN THESIS.
- FactFrontier · Sep 2026Primary sourceF55
The best-measured record of cyber cash actually reported lost is narrow and conservative, and its ransomware line is the punchline. The FBI's Internet Crime Complaint Center recorded 1,008,597 complaints and $20,877,000,000 in reported losses in 2025. Within that, reported RANSOMWARE losses were $32,320,105 from 3,611 complaints — 0.16% of all reported internet-crime losses, in the year ransomware dominated the security conversation — precisely because IC3's figure 'does not include estimates of lost business, time, wages, files, or equipment, or any third-party remediation services'.
Event 2025 calendar year · Published 2026
Limits: IC3 counts only what victims reported to law enforcement, and it says so: non-reporting creates 'an artificially low overall ransomware loss rate'. It is a floor on a subset, deliberately.
Research note
Put IC3 and the benchmark survey side by side and the audience learns that 'the cost of cyber' is not one quantity. Neither number is wrong; they measure different objects, and quoting one as if it were the other is the error.
- FactFrontier · Sep 2026Primary sourceF56
The FBI's 2025 report introduces an 'AI Related' descriptor for the first time: 22,364 complaints and $893,346,472 in reported losses. The composition is overwhelmingly CONSUMER FRAUD rather than enterprise intrusion — investment complaints with a reported AI nexus exceeded $632 million across 4,356 complaints, business-email-compromise losses involving AI were 'over $30 million' across 135 complaints, and ransomware carried 16 AI-referencing complaints. IC3's own definition is a mention test: 'AI Related: Information reported contains a reference to artificial intelligence (AI).'
Event 2025 calendar year · Published 2026
Limits: THE DESCRIPTOR IS A MENTION TAG, NOT A CAUSAL MEASUREMENT. $893m is 'losses reported in complaints that referenced AI' — a ceiling and a proxy. The descriptor appears for the first time in this edition, so 2026's report will be the first year-over-year comparison, and any growth will partly reflect complainants and analysts noticing AI more.
Research note
THE STRONGEST PLAN-REFUTING FINDING IN THE LIABILITY LANE, and it points the same way as the thesis: the AI-related money that has actually moved is dominated by investment scams against individuals, not by attacks on corporate models. Refresh trigger: the 2026 IC3 report.
- FactPrimary sourceF57
Headline fines move, and the regulator's own penalty notice shows exactly where. The ICO's Notice of Intent of 4 July 2019 proposed £183.39 million against British Airways. The Commissioner then determined that 'in principle, a penalty of £30m would be appropriate'; reduced it 'by 20%, i.e. to £24m' for mitigating factors; then applied 'a further reduction of £4m' under the Covid-19 policy. Final penalty: £20 million, imposed 16 October 2020, for an attack affecting approximately 429,612 individuals. Two weeks later Marriott was fined £18.4 million against a proposed £99 million.
Event 2018 (attack); 2019-07-04 (Notice of Intent); 2020-10-16 (penalty imposed) · Published 16 Oct 2020
Limits: The pandemic accounted for only the last £4 million; the order-of-magnitude cut came before it. A penalty is not compensation and none of it reaches the affected individuals.
Research note
Anyone building a risk model on ANNOUNCED fines is modelling a number that has historically fallen by an order of magnitude between announcement and payment. Narrating '£183 million' as what was paid is an exclusion below.
- FactFrontier · Sep 2026Primary sourceF58
The largest GDPR fine ever imposed on a single company was annulled while its findings survived. The Luxembourg CNPD's €746 million against Amazon Europe Core (July 2021) was annulled by the Luxembourg Administrative Court on 12 March 2026. The CNPD's own statement says the court 'endorsed the CNPD's approach almost in its entirety' and 'confirmed that Amazon's reliance on legitimate interests as the legal basis for the processing operations in question was not justified', but 'annulled it on the basis of a development in the case law of the Court of Justice of the European Union' — and the CNPD must now 'analyse the imposition of a financial penalty in the light of this case law'. The violation stands. The money does not.
Event Jul 2021 · Published 13 Mar 2026
Limits: Not a breach case — it concerns advertising processing and legal basis, and is used here only to show the reversibility of the regulatory cash path.
Research note
The distinction the CNPD itself draws — violation upheld, penalty not — is the exact distinction most coverage collapses. Refresh trigger: whether the CNPD re-imposes a penalty.
- FactPrimary sourceF59
The cleanest security-breach fine on the record ran on a six-year clock. The Irish Data Protection Commission fined Meta Platforms Ireland €251 million on 17 December 2024 over the September 2018 token-exploitation breach affecting approximately 29 million Facebook accounts globally, about 3 million of them EU/EEA. The largest single component was €130 million for infringing Article 25(1) — data protection by design — with €8 million and €3 million for breach-notification and documentation failures. No peer supervisory authority objected to the draft decision.
Event Sep 2018 · Published 17 Dec 2024
Limits: A fine is not restitution; none of it goes to account holders. Any per-account arithmetic (≈€84 per affected EEA account) is DERIVED, not published, and must be described as a scale comparison only.
Research note
The AI09-clean GDPR data point: the trigger is a SECURITY breach, not a transfers or advertising question, so it carries no AI11 contamination.
- FactPrimary sourceF60
The largest privacy money in the United States has come from state attorneys general over how data was COLLECTED, not from breach fines. Texas obtained $1.4 billion from Meta over biometric capture (announced 30 July 2024, described as 'the largest ever obtained from an action brought by a single State') and $1.375 billion from Google, finalised 31 October 2025. By contrast the 2019 Equifax global settlement — FTC, CFPB and 50 states, over a breach affecting approximately 147 million people — was 'at least $575 million, and potentially up to $700 million'.
Event 22 Jul 2019 · Published same
Limits: The Equifax consumer pool of up to $425 million across ~147 million affected people is at most about $2.89 a head — a DERIVED pool-to-population ratio, not what anyone received; the FTC publicly warned claimants the cash option would be 'nowhere near' the advertised $125.
Research note
It reroutes the whole 'who pays' question. If the mental model is 'get breached, pay a fine', the two largest US numbers on record contradict it. Privacy ENFORCEMENT as a financial path is inside AI09's contract; any policy-layer thesis built on it belongs to AI11.
- FactFrontier · Sep 2026Primary sourceF61
In 2024 the price of cyber risk FELL while the count of claims rose. NAIC reports US cyber direct written premium including alien surplus lines fell 7.11% to $9,143,618,143 — the first decline on record — with policies in force flat at 4,368,614, while 'the number of claims rose almost 40% with nearly 50,000 reported'. US cyber rates 'declined an average of 5% in the fourth quarter of 2024, marking the first quarterly decrease following seven years of rising rates'.
Event 2024 statement year · Published 2025
Limits: Falling premium is consistent with at least three incompatible worlds — risk genuinely re-rated downward, capacity and competition compressing rate, or buyers' controls genuinely improving (which NAIC's own text suggests) — and this data cannot separate them. Premium can also fall while exposure rises, if the same limits are simply sold cheaper. The quantitative supplement is regulator-collected; the report's threat-landscape narrative relays vendor sources and is NOT tier 1.
Research note
THIS BREAKS THE TEMPTING TEACHING LINE. 'A premium is the visible market price of an invisible risk' does not survive the most recent year of data. What survives all three readings is narrower and sharper: the market that prices this risk with its own capital did not behave in 2024-25 like a market handed a new and larger loss distribution.
- FactFrontier · Sep 2026Primary sourceF62
Of cyber insurance claims CLOSED in the 2024 NAIC supplement, 28,555 closed WITHOUT payment against 9,941 closed with payment — roughly three to one — and for excess policies by more than twenty to one. In the same single year, loss ratios with defence and cost containment across the top twenty writer groups ranged from 9.24% to 96.26%.
Event 2024 statement year · Published 2025
Limits: THE SUPPLEMENT DOES NOT SAY WHY the other 74.2% paid nothing — below retention, withdrawn, or denied are indistinguishable in this data. The finding is 'no payment', not 'refused', and that ambiguity must travel with the number. NAIC publishes no aggregate loss ratio; the ten-fold spread is per-group.
Research note
A price exists; a consensus price does not. Either the risk is genuinely unpriceable at firm level, or portfolio composition dominates everything, and the data cannot distinguish these.
- FactFrontier · Sep 2026ResearchF63
The insurance industry is simultaneously ADDING and REMOVING AI cover, and the seam is legible. Coalition added an 'Affirmative AI Endorsement' to its US Surplus and Canada cyber policies on 26 March 2024, expanding the definition of a security failure or data breach to include an 'AI security event' and expanding the funds-transfer-fraud trigger to fraudulent instructions transmitted via deepfakes. Separately, the Financial Times reported in November 2025 that Great American, Chubb, W.R. Berkley and AIG had sought regulatory approval for exclusions of generative-AI liabilities from general liability policies — with AIG subsequently stating it was 'not specifically seeking to use these exclusions'. And Lloyd's Market Bulletin Y5381 had already required state-backed cyber-attack exclusions in standalone cyber policies from 31 March 2023, on the reasoning that such losses 'have the potential to greatly exceed what the insurance market is able to absorb'.
Event 16 Aug 2022 · Published same
Limits: THE EXCLUSION HALF IS TIER 3 AND DISPUTED BY A NAMED INSURER; AIG's denial must be carried every time. State rate-and-form filing systems are not openly queryable and EDGAR contains no such language (fourteen named queries, all zero), so no exclusion is known to have been APPROVED — it remains an intention, not a market fact. The exclusion side also straddles AI13's line, because the harm it targets is the insured's own model behaving badly; report it as an insurance-market fact only.
Research note
Where AI is the ATTACKER'S tool — deepfaked payment instructions, AI-assisted intrusion — cyber underwriters are writing affirmative cover, because it maps onto perils they already price. Where AI is the INSURED'S OWN system producing harmful output, general-liability underwriters are trying to write it out, because the loss is correlated and unmodelled.
- FactFrontier · Sep 2026Primary sourceF64
The best official test of 'does trust bind adoption' cuts both ways in one table. Eurostat reports that among EU enterprises that had EVER CONSIDERED using AI and were not using it, 48.83% cited data protection and privacy concerns, behind lack of relevant expertise at 70.89%. Over the same period EU enterprise AI adoption ACCELERATED: from 13.48% of enterprises with ten or more employees in 2024 to 19.95% in 2025, and 55.03% among large enterprises.
Event 2025 reference year · Published data extracted December 2025
Limits: NOTE THE DENOMINATOR OR THE NUMBER BECOMES PROPAGANDA: the 48.83% is within the subset that considered AI and declined, not of all enterprises. The surveys measure STATED CONCERN and the adoption series measures BEHAVIOUR, and nothing here links the two. The equivalent US figure could not be established: two irreconcilable secondary numbers circulate and the SBA primary returned 403.
Research note
UNRESOLVED, AND THAT IS THE FINDING. The counter-hypothesis — that adoption has been fast DESPITE unresolved trust questions, so trust is not currently binding — is better supported on this evidence, but it is not established. Say 'unresolved' and say why.
- FactFrontier · Sep 2026Primary sourceF65
THE PRE-REGISTERED VENDOR TEST COMES BACK NEGATIVE. Across eight security vendors chosen ex ante for business-model diversity, the cohort SPLITS four/three/one: CrowdStrike, Zscaler and Fortinet re-accelerated organically; Palo Alto re-accelerated inorganically on an acquisition the filer names in the same sentence; Okta, Tenable and SentinelOne are still decelerating with no recovery; Check Point never moved, running between +3.6% and +7.5% every year for five years straight through the launch of ChatGPT, the agent boom and every headline breach of the period. Whatever happened in this window did not happen to the industry — it happened to particular firms with particular business models, and the split does not line up with who talks about AI most.
Event FY2022Q1 to the most recent reported quarter, each on its own fiscal calendar · Published as filed, most recent 2026-09-03
Limits: EIGHT DIFFERENT FISCAL CALENDARS, NOT INTERPOLATED. CrowdStrike's trough quarter ended 2025-04-30; Fortinet's ended 2024-03-31 — thirteen months apart, and they must not be narrated as the same moment. NO MATCHED CONTROL COHORT of non-security software exists, so this cannot separate a security-demand effect from a general enterprise-software-spend effect. The 4/3/1 is a COUNT OF DIRECTIONS across eight independently-read filers, not a correlation statistic.
Research note
This kills any sentence of the form 'AI enlarged the attack surface, so security vendors grew'. Revenue is a lagging, CONTRACTED measure: it answers 'did security spending get recognised into revenue', not 'did the attack surface grow', and the two must never appear in one sentence as cause and effect.
- FactFrontier · Sep 2026Primary sourceF66
One pattern IS cohort-wide, and it is the honest reason revenue is the wrong instrument for this question: remaining performance obligations grew faster than revenue in seven of the eight vendors. CrowdStrike RPO about +48.6% against revenue +25.8%; SentinelOne about +40% against +20.6%; Zscaler +27.4% against +24.9%; Okta +17.0% against +10.6%; Tenable +15.4% against +8.6%; Check Point +7% against +1%. Fortinet is the single exception, at +16.4% RPO against +25.6% revenue, because hardware revenue is recognised up front.
Event most recent reported periods to 2026-07-31 · Published as filed, 2026-07 to 2026-09
Limits: The filings do not decompose it. Lengthening contract terms, multi-year prepayment and genuine forward demand are indistinguishable here. RPO is nearer the front of the pipe than revenue but it is still CONTRACTED BOOKINGS, not threat exposure. SentinelOne tags RPO to one decimal of a billion, so its rate should be quoted as 'about 40%'.
Research note
Contracted future obligations are running ahead of recognised revenue almost everywhere. That is the lag between a decision to buy and a dollar of GAAP revenue.
- FactFrontier · Sep 2026Primary sourceF67
ALL EIGHT vendors name AI as four things at once — a threat, a product, a cost and a prospective demand driver — and the four are not evenly evidenced. Threat and product are stated as FACTS about today. Cost is stated as fact and in two cases is concrete and painful: Fortinet and Check Point both disclose that the AI infrastructure build-out has caused a memory and semiconductor shortage that raises their own input costs and lead times. DEMAND is almost always in the conditional: Zscaler 'we BELIEVE the imperative ... WILL increase demand'; Okta 'While adoption is in its EARLY STAGES, we BELIEVE ... MAY drive increased demand'; SentinelOne 'IT IS DIFFICULT TO PREDICT ADOPTION AND DEMAND.'
Event FY2025-FY2026 filings · Published as filed
Limits: Eight filers is the whole pre-registered cohort, not the industry. The memory-shortage disclosure is usable ONLY as 'these two security vendors disclose that the AI build-out raises their own component costs'; the shortage itself and datacentre build-out economics belong to AI06 and AI12.
Research note
The pre-registration said a filer naming AI as all four at once would be a finding. Eight out of eight do it. Tenable adds a unique fifth framing — see F68.
- FactFrontier · Sep 2026Primary sourceF68
A security filer states in its own 10-K that AI has made its sales cycle LONGER: 'We sell our solutions primarily to IT departments that are managing a growing set of user and compliance demands, INCLUDING WITH RESPECT TO AI, WHICH HAS INCREASED THE COMPLEXITY OF CUSTOMER REQUIREMENTS TO BE MET AND CONFIRMED DURING THE SALES CYCLE AND PROLONGED OUR SALES CYCLE.' In the same period Tenable's growth ran at +8.6%, all of it from existing customers, with new-customer revenue contribution NEGATIVE $2.1 million and sales-and-marketing expense down 1% year over year.
Source: Tenable Holdings Form 10-K FY2025 (Risk Factors) and Form 10-Q Q2 2026 (MD&A) (opens sec.gov)
Event FY ended 2025-12-31; quarter ended 2026-06-30 · Published 27 Feb 2026
Limits: One filer's stated experience, in its own risk factors. It is not a market measurement.
Research note
The cohort's direct counter-evidence to 'AI enlarges the attack surface, therefore security sells faster' — from the vulnerability-management vendor, the firm whose entire product is a census of the attack surface.
- FactFrontier · Sep 2026Primary sourceF69
Exactly ONE firm in the cohort attributes REALISED revenue growth to anything AI-related, and it is not threats. Fortinet: product revenue growth was 'primarily driven by hardware revenue growth resulting from higher unit shipments year over year and recent pricing actions ... including increased demand for higher performance products, DEPLOYMENTS RELATED TO AI INFRASTRUCTURE, technology upgrades, upsell activity, and expansion into new use cases.' AI appears third in the list, behind unit volume and PRICE, and the AI it names is infrastructure being BUILT, not AI attacking anything.
Event quarter ended 2026-06-30 · Published 30 Jul 2026
Limits: BOUNDED QUERY: every regex match of revenue-attribution language whose ±400-character window also matched an AI term, across fourteen filings — CRWD 1, PANW 4, ZS 4, FTNT 21, CHKP 2, OKTA 2, TENB 1, S 2. All 37 were read. Every window outside Fortinet's product-revenue paragraph is a risk factor, a forward-looking belief, a product description or a cost disclosure. How much of Fortinet's +52% product growth is price versus volume is not decomposed in the filing.
Research note
Every OTHER stated driver in the cohort is a supply-side or go-to-market story: consolidation, platformisation, seat growth, cloud and legacy migration, subscription conversion, sales capacity, M&A and price. Not one is a threat story.
- FactFrontier · Sep 2026Primary sourceF70
The AI-threat thesis and the revenue line appear in the same document, two hundred words apart, pointing in opposite directions. Check Point's Q1 2026 results release quotes its chief executive: 'The cybersecurity landscape is undergoing a fundamental shift as AI accelerates both the scale and sophistication of threats. Our strategy is purpose-built for this environment ... we are well positioned to benefit from accelerating demand for secure, enterprise-grade AI transformation at scale.' The financial highlight immediately above it reads: 'Total Revenues: $668 million, a 5 percent increase year over year.' The following quarter that number was +1%.
Event quarters ended 2026-03-31 and 2026-06-30 · Published 30 Apr 2026
Limits: Check Point files no quarterly XBRL as a foreign private issuer, so only these two quarters inside the window were retrieved directly; the rest of its quarterly series was not. That is a bounded data gap, not a finding. Management attributes the weak quarters to its OWN go-to-market reorganisation, not to the threat environment.
Research note
PRESERVED CONTRADICTION, in a single document. Check Point's R&D rose 3.3 points of revenue and sales-and-marketing 7.1 points across the window — both of the investments the AI-demand thesis predicts — while GAAP operating margin fell about eleven points and revenue growth stayed flat. Input up, output flat.
- FactFrontier · Sep 2026Primary sourceF71
The cleanest pre-registered test in the vendor lane returns nothing. Okta sells identity security AND was itself breached in October 2023 — both halves of the chain 'attack surface grows, therefore security revenue grows' land on one filer. Its quarterly revenue growth rate falls in essentially a straight line across seventeen quarters, from +65.3% to +10.6%, with no inflection anywhere: not around the breach, not after it, not during the generative-AI boom.
Event quarters ended 2021-04-30 to 2026-07-31 · Published as filed, most recent 2026-08-27
Limits: A NON-INFLECTION OBSERVATION, NOT A CAUSAL CLAIM. 'Okta's breach shows breaches don't help security vendors' is a causal statement from one firm's series with no counterfactual, and it is an exclusion below. The early peak is inflated by the Auth0 acquisition. Derived Q4s are computed figures, not filer-stated ones.
Research note
Okta's own stated growth engine is a LEGACY REPLACEMENT CYCLE — enterprises 'replace their legacy identity access management infrastructure' — which is infrastructure modernisation, not threat response.
- FactFrontier · Sep 2026Primary sourceF72
A filer's own key metric stopped being a number at the point the number had fallen for two consecutive years. SentinelOne disclosed net retention as 132% (FY2023 10-K), 114% (FY2024) and 110% (FY2025); the FY2026 10-K carries no figure, only the words 'Our NRR remained in expansionary territory as of January 31, 2026'. Reproducible: the regex 'net retention rate' followed within 160 characters by a three-digit percentage returns four numeric hits in the FY2025 10-K and ZERO in the FY2026 10-K.
Source: SentinelOne, Inc. Forms 10-K FY2023 through FY2026, read directly (opens sec.gov)
Event FYs ended 2023-01-31 to 2026-01-31 · Published 19 Mar 2026
Limits: A DISCLOSURE CHANGE IN A NAMED DOCUMENT, not an inference about the company's intent. Whether other cohort members' investor materials outside SEC filings still carry the number was not checked.
Research note
METHOD LESSON WORTH KEEPING. The same hypothesis was tested against CrowdStrike — that it had withdrawn its dollar-based net retention rate as growth slowed — and FALSIFIED: the number is in all four 10-Ks (125.3/123.9, 119/125, 112/119, 115/112). An absence in ONE document is not a finding.
- FactPrimary sourceF73
The defensive side of AI is, if anything, better evidenced than the offensive one, because someone ran a controlled competition and published the numbers. At DARPA's AI Cyber Challenge final, seven autonomous cyber reasoning systems analysed more than 54 million lines of code across 63 challenge tasks derived from real open-source critical-infrastructure software. They discovered 54 of the inserted synthetic vulnerabilities and patched 43. They ALSO found 18 REAL, previously unknown vulnerabilities — six in C codebases, twelve in Java — which were responsibly disclosed, and produced 11 patches for real vulnerabilities. Every team found a real-world vulnerability. Patches were submitted in an average of 45 minutes, at about $152 per competition task. Four of the seven systems were open-sourced on the day.
Event 8 Aug 2025 · Published 8 Aug 2025
Limits: THE HEADLINE RATES DO NOT GENERALISE. 86% identification and 68% patching are rates against SYNTHETIC vulnerabilities in a scored competition on 63 curated challenges, with generous compute and no adversary pushing back; $152 is a per-task compute cost, not the cost of a security programme. THE 18 REAL VULNERABILITIES ARE THE PART THAT GENERALISES. And the same open-sourcing that arms defenders arms everyone: a cyber reasoning system does not know which side downloaded it.
Research note
CORRECTS the circulating '77% found / 61% patched' pair, which does not match DARPA's own published numbers and must not be used. Refresh trigger: whether the open-sourced systems produce results in production.
- FactPrimary sourceF74
A determined defence can close an entire vulnerability class, and the longest-running public demonstration is not AI at all. Google reports memory-safety flaws fell from 76% of Android's vulnerabilities in 2019 to under 20% by 2025 — absolute counts from 223 in 2019 to under 50 in 2024 — achieved by writing NEW code in memory-safe languages rather than by rewriting old code, with a reported roughly thousand-fold lower memory-safety defect density in its Rust code than in Android's C and C++.
Event 20 2019 · Published 13 Nov 2025
Limits: Company technical documentation — tier 1 by the evidence law, and Google is grading its own homework. Say so.
Research note
Defence compounds. Offence has to keep buying.
- FactFrontier · Sep 2026JournalismF75
What actually gets organisations breached is still an unpatched known flaw, and the metric that DEGRADED is maintenance. Verizon's 2026 DBIR REPORT BODY: exploitation of vulnerabilities is 'the most common initial access vector for breaches', at 31%, while 'credential abuse — the previous leader — is down to 13%' (p.10). Full remediation of CISA KEV vulnerabilities FELL from 38% to 26% (p.10, p.17). Median time to remediate ROSE to 43 days.
Event incidents 2024-11-01 to 2025-10-31 · Published 19 May 2026
Limits: TIER 3 AND DISCLOSED ON SCREEN - the film says 'from a company that sells security, so weigh it'. Self-selected contributor consortium, not a random sample. POPULATION: the 31% is of non-Error, non-Misuse breaches with a determinable initial access vector (n=20,023), NOT of all breaches - the press release's 'of all breaches' is looser than the body. The body also notes credential abuse still leads at 39% if counted at ANY point in a breach rather than as the first action, so 'top way IN' is correct and 'top thing involved' would not be.
Research note
PRODUCER CORRECTION 2026-09-04 (pre-narration check V1), TWO ERRORS, BOTH NOW OUT OF THE FILM. (1) THE NINETEEN-YEAR SUPERLATIVE WAS MARKETING. 'The first time in nineteen years that it has surpassed stolen credentials' appears TWICE in Verizon's newsroom press release and ZERO times in the 121-page report body or the executive summary - both fetched and read in full. The body dates the metric to 'a few years now' and records that the enumeration changed again this year (Pretexting added). This fact's source_url previously pointed at the PRESS RELEASE, which is how the clause reached the script; it now points at the body. (2) A BASIS ERROR INHERITED FROM THE REPORT ITSELF: 43 days is the whole-KEV median, while the 32-day figure it is compared against was last year's SEVENTEEN-CVE EDGE-DEVICE SUBSET. The like-for-like 2025 whole-KEV baseline is 38 days. The film narrates 38 to 43 and declines to repeat the report's own apples-to-oranges comparison.
- FactFrontier · Sep 2026JournalismF76
The same programme said materially different things about AI one year apart. Verizon's 2025 DBIR, which analysed 22,052 incidents including 12,195 confirmed breaches, states: 'As of early 2025, generative artificial intelligence (GenAI) has still not taken over the world, even though there is evidence of its use by threat actors as reported by the AI platforms themselves.' The 2026 edition says AI is 'accelerat[ing] the time to exploit known vulnerabilities, shrinking the window for defense from months to mere hours', with shadow-AI use tripling from 15% to 45% of employees.
Event 2024 and 2025 study periods · Published Apr 2025
Limits: Either the world changed in twelve months or the measurement did, and this cannot tell which. The 2025 edition itself attributed part of an espionage-share jump to 'changes in our contributor makeup', so the programme concedes the confound.
Research note
PRESERVED CONTRADICTION. Show both sentences and say it cannot yet be told which changed. It also names the mechanism that would reconcile this episode with the alarm: AI need not create the vector to shorten the defender's window on the vector that already dominates.
- FactResearchF77
The peer-reviewed baseline against which every 'cyber costs trillions' claim should be read: Romanosky, analysing over 12,000 cyber incidents from 2004 to 2015, found the median cost of a data breach was about $170,000, the median typical cyber incident under $200,000, and a median loss of about 0.4% of a firm's estimated annual revenue — against retail shrinkage at 1.3%, online fraud at 0.9%, and corruption, financial misstatement and billing fraud at around 5%.
Event 20 2004 · Published 8 Aug 2016
Limits: The window ENDS IN 2015, pre-dating the modern ransomware and mass-extortion era, and a median deliberately excludes the tail that makes cyber interesting to a filer.
Research note
Romanosky's median and the headline incidents cannot both be the story. The distribution is extremely skewed: the median describes the typical firm and the tail is what a filer discloses. Neither is the average experience.
- FactPrimary sourceF78
The security line was compounding at a healthy rate years before generative AI existed. OMB's FY2020 Analytical Perspectives report total federal agency cybersecurity funding of $14,978 million in FY2018, $16,645 million in FY2019 and $17,435 million requested for FY2020 — the FY2020 figure described as 'an $790 million (5 percent) increase' — with the Department of Defense the largest contributor at $9.6 billion. The same chapter records that most US states then allocated 'between zero and two percent of their total IT budgets to cybersecurity'.
Event FY2018-FY2020 · Published Mar 2019
Limits: Federal budget authority is not private security spend, and this series includes DoD, so it is not comparable to later civilian-only figures. No continuous series is offered. The commercial forecasts the same chapter quotes ($114bn, $124bn) are a private forecaster's numbers inside a Tier-1 document and must not be laundered into Tier 1.
Research note
A line that grew at low double digits before the catalyst and low double digits after it has not been shown to have been caused by the catalyst. The 'vendor opportunity' channel needs a counterfactual it does not have — and the pre-registered vendor cohort has no matched control, which is exactly the limitation this turns on.
- FactFrontier · Sep 2026Primary sourceF79
MITRE states in its own release notes what the ATLAS knowledge base is built from: 'ATLAS is based on empirical evidence from observations of real-world attacks as well as realistic demonstrations from AI red teams and security groups.' The same release note gives the census: '1 matrix, 16 tactics, 114 techniques, 83 sub-techniques, 39 mitigations, and 72 case studies.'
Event release published 2026-09-01 · Published 1 Sep 2026
Limits: First-party self-description. It underwrites the Incident/Exercise framing and nothing more.
Research note
The cleanest first-party underwriting of the two-kinds-of-evidence framing, and safe to quote. Do NOT quote the ATLAS term-catalog gloss of Exercise ('a simulated or controlled scenario used to test detection, response, or resilience') — it describes internal defensive testing and misdescribes a corpus dominated by unsolicited third-party demonstrations against live production products.
- FactFrontier · Sep 2026Primary sourceF80
The agentic class is where 2025-2026 actually changed, and it is where the Incidents are. Besides the Hugging Face case, MITRE types as Incidents: LAMEHUG, malware attributed by Ukraine's CERT to APT28 that calls an LLM endpoint to generate its commands on the infected host at runtime (June 2025); SesameOp, a backdoor Microsoft's incident-response team found abusing the OpenAI Assistants API as a covert command-and-control channel with the actor resident for months (July 2025); and Storm-2139, a group that scraped exposed customer credentials, built custom jailbreak tooling against Azure OpenAI and resold guardrail-bypassed access, against which Microsoft pursued civil legal action (December 2024).
Source: MITRE ATLAS case studies AML.CS0044, AML.CS0042, AML.CS0057, release v2026.08 (opens github.com)
Event 1 Dec 2024 · Published 1 Sep 2026
Limits: None of the three quantifies a loss. Note the asymmetry in what these are: LLM endpoints being USED BY attackers as infrastructure, and access to models being resold — not models being subverted into attacking their owners.
Research note
The AI in these incidents is a tool the attacker calls, or a service the attacker steals. It is not a model that was tricked into betraying its operator.
- Counter-argumentFrontier · Sep 2026Primary sourceF81
The most-cited real-world agentic attack is contested by named security researchers, and its own author documents a limitation that undercuts the headline. Anthropic reported GTG-1002 as 'the first documented case of a cyberattack largely executed without human intervention at scale', with the actor leveraging AI to 'execute 80-90% of tactical operations independently' against roughly thirty entities. Named researchers dispute it, principally because Anthropic published no indicators of compromise — no IP addresses, no domains, no malware hashes — so no third party can verify or hunt for it. Anthropic's own executive summary carries the counterweight: 'Claude frequently overstated findings and occasionally fabricated data during autonomous operations, claiming to have obtained credentials that didn't work or identifying critical discoveries that proved to be publicly available information.'
Event disrupted mid-September 2025 · Published 13 Nov 2025
Limits: NARRATE WITH THE CONTESTATION ATTACHED OR NOT AT ALL. This is a vendor's unreproducible account of its own product being misused, and NIST IR 8596 cites it as the only named real-world incident supporting its Thwart focus area. That is not a reason to dismiss it; it IS a reason never to present it as established fact. The state attribution and every geopolitical reading belong to AI11; only the agentic MECHANISM is available here. Anthropic's own note that the model fabricated data is usable ONLY as a reliability discount on the report, never as a model-error risk claim, which is AI13's.
Research note
A finding that cannot be independently checked and a finding that did not happen are different things, and the film must not collapse them in either direction. AML.CS0068 — Hugging Face and OpenAI — is strictly better as a centrepiece: two first-person post-mortems, a technically specific mechanism, no geopolitics, and a victim who published.
- InterpretationBook / authorF82
Mustafa Suleyman's argument, as printed. The historical yardstick he sets himself, pp.168-169: 'Throughout history technology has produced a delicate dance of offensive and defensive advantage, the pendulum swinging between the two but a balance roughly holding: for every new projectile or cyberweapon, a potent countermeasure has quickly arisen.' And his claim about this wave, p.169, WITH ITS CONCESSION INTACT: 'While defensive operations will be strengthened in time, the nature of the four features favors offense: this proliferation of power is just too wide, fast, and open.'
Event 2023 · Published 5 Sep 2023
Limits: Tier 4. An attributed perspective, never proof of a fact. Quote minimally. US spelling 'favors' is the edition of record.
Research note
VERIFIED BY REPAIR R2 on 2026-09-04 against the publisher-indexed full text of the Crown US first edition, each sentence recovered from at least two overlapping snippet windows so no word is inferred. The circulating fragment was wrong twice - it printed 'favours' and it AMPUTATED the concessive opening, which made him more absolute than he is. NARRATION ORDER: pendulum first, then the wave claim - that is his actual argumentative move. Caption ch.10, NOT the four-features chapter. Minted here from packet.attributed_ideas[0] so the claims gate can resolve the id.
- Counter-argumentResearchF83
Rebecca Slayton's peer-reviewed counterargument, published SIX YEARS BEFORE the book so it is not hindsight: the cyber offense-defense balance is not a property of technology and cannot be inferred from capability. Assessing it requires counting an operation's value and its cost to BOTH sides, and on that accounting the Stuxnet campaign very likely cost the offense more than the defense. Her sharpest point for this episode: the observed success of offence comes primarily from POOR DEFENSIVE MANAGEMENT and from offence having simpler goals.
Event 2016/17 (Winter issue) · Published 1 Jan 2017
Limits: Her accounting is historical and Stuxnet-centred, and the physical-infrastructure mechanism she identifies is the one LEAST likely to transfer to agentic software. If AI genuinely collapses the organisational-capability requirement, one of her three mechanisms weakens.
Research note
Supplies the episode's actual subject: offence's success is a MANAGEMENT failure, and management failures are measurable. Minted from packet.attributed_ideas[1].
- Historical analogyPrimary sourceF84
WannaCry, 12 May 2017, as the historical test of whether a diffused offensive capability produces a DURABLE advantage. It exploited the SMB flaw addressed by Microsoft Security Bulletin MS17-010, whose page states 'Published: March 14, 2017' - the fix was FIFTY-NINE DAYS OLD on the day of the outbreak. The outbreak was arrested the same day, not by a state and not by a vendor, but by one researcher registering an unregistered domain found in the malware, for roughly ten pounds, which turned out to be a kill switch.
Event 12 May 2017 · Published 14 Mar 2017
Limits: NOT ATTRIBUTED TO ANY AUTHOR ON SCREEN - see producer_repairs P2. The 'Suleyman's own example' framing in strongest_historical_case is UNPAGED and is not narrated. Separately, the GBP 92m NHS figure is a DHSC MODEL, not a measurement ('not possible to estimate with certainty'), and is not narrated at all.
Research note
PRODUCER-VERIFIED 2026-09-04: the MS17-010 page was fetched and read, and the 59 days re-derived from 14 March to 12 May rather than inherited. Minted from packet.strongest_historical_case.
- FactFrontier · Sep 2026Primary sourceF85
THE EPISODE'S OWN FALSIFIER, stated on screen. One document would date this film: an SEC Form 8-K filed under Item 1.05 (or an 8-K/A amending one) in which a registrant names an ATTACK ON AN AI SYSTEM as the cause - prompt injection, model or data poisoning, model or weight theft, agent hijack, adversarial-ML evasion - AND attaches a dollar figure to it. As of 2026-09-04 the count is ZERO across all 82 Item 1.05 filings.
Event 18 Dec 2023 · Published 4 Sep 2026
Limits: The 82-filing population is a FLOOR built from EDGAR structured item tags on documents returned by convergent full-text queries, not a certified census. This is a bounded not-found over a named corpus in a named window - it must NEVER be narrated as 'AI has not caused a breach'.
Research note
Established by DIRECT REGEX SWEEP OF DOWNLOADED COMPLETE SUBMISSIONS INCLUDING EXHIBITS, not by search snippet - R3 re-read all 82 after the original proximity-window detector was shown to have missed Coupang. Refresh trigger: any new Item 1.05 filing. Minted from packet.falsifier.primary.
13 further audited series are recorded but not drawn
Item 1.05 material-cybersecurity-incident filings by year, originals and amendments
Source: SEC EDGAR full-text search, structured item tags, all hits retrieved · Audit: Counts are ACCESSIONS, deduplicated. Originals: 2023 = 2, 2024 = 24, 2025 = 15, 2026 = 15 (through 4 September). Amendments (8-K/A): 2023 = 1, 2024 = 14, 2025 = 4, 2026 = 7. Totals 56 originals and 26 amendments across 56 distinct filers. Built from the structured item tag on documents returned by two convergent queries; four further probes added zero. No transformation applied.
What the 82 Item 1.05 filings actually say about materiality
Source: All 82 Item 1.05 accessions fetched from sec.gov/Archives, regex-located and hand-read · Audit: Of 82: 52 contain 'not yet determined' or 'still assessing'; 37 contain 'no material impact' or 'not material'; 9 contain an explicit 'determined ... material'; 17 contain none of the three. Originals only (n=56): 40 / 27 / 7.
Where the AI-attack vocabulary lives: annual reports versus incident reports
Source: SEC EDGAR full-text search API · Audit: Form 10-K: 'data poisoning' 126, 'model poisoning' 60, 'prompt injection' 59, 'prompt injection attack' 0. Form 8-K: 'prompt injection' 4, 'model poisoning' 1, 'data poisoning' 1, 'jailbreak' 1 — and zero of any of them inside an Item 1.05 filing. Every 8-K hit was identified by item tag and the retrievable documents were fetched and windowed; all are earnings releases, product press releases or transcripts.
MITRE ATLAS case studies by type, and the one-month change
Source: MITRE ATLAS data releases v2026.07 and v2026.08, both parsed · Audit: v2026.07 (published 2026-08-07): 68 case studies, 18 Incident, 50 Exercise. v2026.08 (published 2026-09-01): 72 case studies, 22 Incident, 50 Exercise. Four additions, all Incident; Exercise flat; zero retypings across the 68 shared IDs, verified by diffing the type field. MITRE's machine rule (Incident requires a Reporter, Exercise must not have one) holds for 71 of 72, the exception being a grandfathered 2020 entry.
CISA confirmed-exploitation entries in the AI/ML stack, by weakness class
Source: CISA Known Exploited Vulnerabilities Catalog, catalogVersion 2026.09.04 · Audit: 12 of 1,695 entries matched a 24-term regex over vendorProject and product only. Weakness classes as CISA names them: code injection (4), missing/improper authentication (3), command injection (1), SQL injection (1), SSRF (1), origin validation error (1), authorization bypass through user-controlled key (1). ADVERSARIAL-ML TECHNIQUES: ZERO. Products: Langflow 5, LiteLLM 3, n8n, Ray, MLflow, and one IBM-packaged Langflow.
Security-vendor quarterly revenue growth rates, pre-registered cohort
Source: SEC XBRL companyfacts for seven US domestic filers; Check Point annual 20-F plus two 6-K results releases · Audit: Quarterly revenue extracted from 74-108 day duration facts, preferring the earliest-filed instance of the highest-priority tag per period end to avoid restated duplicates; fiscal Q4 derived as annual minus the three filed quarters and LABELLED 'derivedQ4' as a computed figure. Series run FY2022Q1 to the most recent reported quarter. Check Point has NO quarterly XBRL and contributes five annual points plus two quarters read from 6-K press releases; the rest of its quarterly window was not retrieved.
Forward book versus recognised revenue: RPO growth against revenue growth, by vendor
Source: Each filer's own disclosed remaining performance obligations and revenue · Audit: CRWD ~+48.6% vs +25.8%; S ~+40% vs +20.6%; ZS +27.4% vs +24.9%; OKTA +17.0% vs +10.6%; FTNT +16.4% vs +25.6%; TENB +15.4% vs +8.6%; CHKP +7% vs +1%. Seven of eight have RPO ahead of revenue; Fortinet is the exception because hardware revenue is recognised up front.
US cyber insurance: direct written premium against claims reported
Source: NAIC, Report on the Cybersecurity Insurance Market (2025 edition), compiled from statutory filings · Audit: DWP including alien surplus lines: $9,843,441,133 (2023) to $9,143,618,143 (2024), -7.11%. US-domiciled DWP $7,082,935,371, -2.3%. Policies in force 4,368,614, -0.03%. Claims reported rose almost 40% to nearly 50,000. Earlier DWP path from $4.07bn in 2020 to the 2023 peak.
FBI IC3 reported internet-crime losses, 2025, by category
Source: FBI Internet Crime Complaint Center, 2025 Internet Crime Report · Audit: Total $20,877,000,000 across 1,008,597 complaints, up 26% from $16.6bn in 2024. Business Email Compromise $3,046,598,558; Personal Data Breach $1,314,923,988; Data Breach $435,240,992; Ransomware $32,320,105 from 3,611 complaints. 'AI Related' descriptor: $893,346,472 across 22,364 complaints.
The eight Item 1.05 filings that put a number on the damage
Source: Repair R3, complete re-read of all 82 Item 1.05 complete submission text files · Audit: Key Tronic $600,000 — gross cost incurred to date, one vendor category only. Sonic Automotive $0.64 per diluted share — AFTER-TAX, per share, blending lost income and expenses, excluding recoveries; a third-party incident at CDK. Key Tronic $2.3 million realised pre-tax expense AND $15 million of revenue not fulfilled, which the filer says will mostly be fulfilled the following fiscal year — a timing shift, not a loss, and the two must never be summed. iLearningEngines $250,000 — realised direct cash loss, one unrecovered misdirected wire. Coinbase $180-400 million — preliminary gross pre-tax expense estimate, as a range, no period stated. Data I/O $388,000 in the body and $180,000 in the attached press release — same basis, same period, unreconciled. Coupang ~1.685 trillion won / ~$1.2 billion — voucher FACE VALUE, booked as contra-revenue on redemption. Bitcoin Depot $3.665 million — preliminary booked loss at the fair value of stolen Bitcoin marked at a chosen date, gross of insurance, on a volatile asset.
Ranked quantified impacts across the pre-registered incident cohort
Source: Pre-registered incident cohort, each filer's own filings · Audit: UnitedHealth $3,090m FY2024 pre-tax total; Delta ~$500m Q3 2024 revenue effect plus opex minus a fuel saving, NON-ATTACK; MGM ~$110m Q3 2023 non-GAAP Adjusted Property EBITDAR for two segments plus one-time expenses; Halliburton $35m Q3 2024 pre-tax charge inside a composite line; Johnson Controls $30m FY2023 AFTER-TAX net income effect; Clorox $29m FY2024 net of $30m insurance on ~$59m gross; Progress Software $7.1m over two fiscal years net of insurance; Group 1 $5.9m one SG&A retention line. Caesars, AT&T and Okta: nothing quantified.
The gap between the fix and the outbreak
Source: Microsoft Security Bulletin MS17-010 (Security Update for Microsoft Windows SMB Server, 4013389) for the fix date; DHSC 'Securing cyber resilience in health and care' (October 2018 update) for the NHS impact assessment · Audit: MS17-010 released 2017-03-14; WannaCry ran 2017-05-12 — 59 days. Slammer's patch was approximately six months old on 2003-01-25. The 2026 median time to patch is 43 days, up from 32.
Average cost of a data breach, IBM/Ponemon
Source: IBM / Ponemon Institute, Cost of a Data Breach Report 2025
What surprised us
Where the simple story did not survive
Logged by the research lanes as they worked, before anything was written. The full log is in the research desk.
- 1
The entire mandatory record of material public-company cyber incidents in the United States, over two years and eight and a half months, is 56 original filings. Fifty-six. That is the whole window investors were given onto the attack surface.
- 2
Eight of those eighty-two filings put a number on the damage. Not eight per cent - eight filings.
- 3
The one AI-named entry in the entire mandatory incident record has no attacker in it. An employee put customer social security numbers into an unapproved AI application, and the bank filed it as a material cybersecurity incident because the rule's own definition says 'unauthorized OCCURRENCE' and never says 'attacker'.
- 4
A hazard written in one company's risk factors was realised almost word for word in another company's incident filing eight days earlier - Doximity's warning about employees 'entering confidential, proprietary, personal, protected health, or other regulated information into third-party AI tools', and CB Financial's filing of exactly that event.
- 5
The named AI-attack vocabulary appears in 59, 60 and 126 annual reports - and not once inside an Item 1.05 disclosure. Companies describe AI attacks in the section where they WARN and have not yet described one in the section where they CONFESS.
The strongest case against this
YOU HAVE MEASURED YOUNG INSTRUMENTS OVER A SHORT WINDOW AND MISTAKEN THEIR SILENCE FOR THE WORLD'S.
Carried at full strength, before the conclusion — not as a footnote.
Every instrument this episode leans on is new, narrow, or both. Item 1.05 has existed for two years and eight and a half months and has produced fifty-six original filings across the entire US public market — that is not a measurement of the cyber attack surface, it is a very small window with a self-started clock behind it. MITRE ATLAS is a community-contributed catalogue whose Incident/Exercise field has a published definition but no adjudication procedure, no evidentiary threshold and no named adjudicator. CISA's KEV catalogue records what CISA has confirmed and catalogued, which is a function of CISA's attention as much as of attacker behaviour. The pre-registered incident cohort is eleven filers chosen for notoriety. The vendor cohort is eight firms on eight fiscal calendars with no matched control. And NIST — the authority the episode quotes most — says in its own text that 'many will likely go undetected until adversary use of AI is better understood'. An episode that concludes 'the losses landed over here' from instruments this young is doing the same thing it accuses the vocabulary of doing: pointing where the light is.
- CC-1, THE STRONGEST: the AI attack surface is mostly the OLD attack surface with a new interface. Verizon's 2026 corpus puts exploitation of known vulnerabilities top of the initial-access table at 31%, the first displacement of stolen credentials in nineteen years, with third-party involvement at roughly half of all breaches and the human element at 62%. None of that is a new class of AI-system risk. It is a router that was not patched, a password that was reused, and a supplier with access.
- AND THE DIRECTION OF TRAVEL ON THE MUNDANE PART IS BACKWARDS: full remediation of CISA's known-exploited vulnerabilities fell from 38% to 26%, and the median time to patch ROSE from 32 to 43 days.
- CC-2: the security spending line was compounding at low double digits years before generative AI existed — OMB records $14.978bn, $16.645bn and $17.435bn of federal cybersecurity funding across FY2018-FY2020 — so the vendor-opportunity channel needs a counterfactual it does not have. This is a CHALLENGE, not a finding: federal budget authority is not private security spend, and the vendor lane has no matched control cohort, which is exactly the limitation the argument turns on.
- CC-3: defence may be the side AI helps MORE, which would make 'enlarged attack surface' net-wrong rather than half-right. The defensive results are public, dated and cheap — 18 real previously-unknown vulnerabilities found and 11 real patches produced at DARPA's AI Cyber Challenge, at about $152 a task, with the systems open-sourced on the day. And the longest-running case is not AI at all: Android memory-safety flaws fell from 76% of vulnerabilities to under 20% by writing new code in a safe language.
- CC-4: risk that cannot be measured cannot be priced. CISA's own economists find the five leading commercial per-incident cost datasets disagree by a factor of fifty in the mean, and say plainly that vendors 'tend to overstate the severity and likelihood of the impacts'. Romanosky's peer-reviewed baseline puts the median incident under $200,000 and about 0.4% of annual revenue, below retail shrinkage. And the one market that must put its own capital behind a cyber-risk number CUT PRICES: first-ever US premium decline, claims up about forty per cent in the same year.
- Anderson and colleagues, revisiting their own work at WEIS 2019, draw the operational conclusion directly: it would be 'economically rational to spend less in anticipation of cybercrime and more on response'.
The stock versus flow objection: THE SHARPEST FORM OF THE ARGUMENT, AND IT IS IN THIS PACKET'S OWN EVIDENCE. The 22-Incident / 50-Exercise split is a STOCK, and stocks lag. One release earlier the split was 18/50. In a single month MITRE added four case studies and typed ALL FOUR as Incident, with Exercise flat and zero retypings. Seventy per cent of the stock is demonstration; one hundred per cent of the most recent month of flow is real-world. A film that narrates the stock and not the flow will be describing a world that has already moved — and the same objection applies to CISA's KEV, where eleven of the twelve AI-stack entries were added in a single year, and to the incident cohort, whose AI null holds for 2023-2024 incidents and cannot reach 2025-2026 ones.
The rpo objection: THE VENDOR EVIDENCE HAS THE SAME SHAPE. Revenue is a lagging, contracted measure — it answers 'did security spending get recognised into revenue', not 'did the attack surface grow'. And in seven of eight vendors, REMAINING PERFORMANCE OBLIGATIONS ARE GROWING FASTER THAN REVENUE: CrowdStrike about +48.6% against +25.8%, SentinelOne about +40% against +20.6%, Zscaler +27.4% against +24.9%, Okta +17.0% against +10.6%, Tenable +15.4% against +8.6%, Check Point +7% against +1%. Contracted future obligations are running ahead of recognised revenue almost everywhere. If forward bookings are the earlier signal, then a conclusion drawn from the recognised revenue line is a conclusion drawn from the slowest instrument in the room — and it is one to two years stale by construction.
The honest concession that must be in it: NONE OF THIS REFUTES THE THESIS. IT DATES IT. The counter-case establishes that the marginal dollar of attention is currently worth more on an asset inventory than on a prompt-injection taxonomy, and that the realised losses have not yet moved to the model layer. It does NOT establish that they will not. Every argument in it is a statement about a measured window, and every instrument in it is aging in the same direction: KEV additions accelerating, ATLAS Incidents accelerating, RPO running ahead of revenue, and the 2026 DBIR — the counter-case's own best source — saying that AI is 'accelerat[ing] the time to exploit known vulnerabilities, shrinking the window for defense from months to mere hours', with shadow-AI use tripling to 45% of employees. If that holds, AI does not create the vector; it shortens the defender's window on the vector that already dominates, and the two framings become the same story rather than rival ones. CC-1 therefore wins on WHERE TO LOOK. It does not win on WHETHER AI MATTERS.
How the film handles it: At full strength, in narration, in its own scene, BEFORE the film states its own conclusion — with the stock-versus-flow objection said out loud using this packet's own MITRE numbers, and the concession said in the same breath. A film that hides the flow to protect the stock has committed the episode's own named error.
History, under test
The strongest historical case
What the past licenses — and, stated just as plainly, what it does not.
WANNACRY, 12 MAY 2017 — and it is chosen because it is SULEYMAN'S OWN EXAMPLE of uncontained offensive asymmetry, leaked state-grade tooling reaching unaffiliated criminal hands. The record is less flattering to the offence than the framing suggests. WannaCry exploited the SMB flaw addressed by Microsoft security update MS17-010, released on 14 March 2017 — the fix was FIFTY-NINE DAYS OLD on the day of the attack. And the outbreak was arrested the same day, not by a state and not by a vendor, but by one researcher registering an unregistered domain found in the malware, for roughly ten pounds, which turned out to be a kill switch.
It is the cleanest available test of the claim that a diffused, asymmetric capability produces a DURABLE offensive advantage. It licenses a narrow and mundane conclusion that transfers directly to 2026: the binding variable was DEFENSIVE MANAGEMENT, not the capability. That is exactly what Slayton's peer-reviewed account predicts, and it is exactly what the current data says — Verizon's 2026 corpus puts vulnerability exploitation at the top of the initial-access table for the first time in nineteen years while full remediation of known-exploited vulnerabilities fell to 26% and the median time to patch rose to 43 days. The same sentence could have been written about WannaCry in 2017 and about Slammer in 2003, whose patch was six months old on the day.
Second test in the same family: THE MASS NETWORK WORM, 2001-2004. Sapphire/Slammer doubled every 8.5 seconds, exceeded 55 million scans per second in under three minutes and infected more than ninety per cent of vulnerable hosts within ten minutes. One machine, one unauthenticated packet, the whole internet in ten minutes. And then the class ENDED — Code Red and Nimda in 2001, Slammer in January 2003, Blaster in August 2003, Sasser in May 2004, and the mass Windows network worm did not come back. What ended it was unglamorous defensive engineering with dates on it: Microsoft's Trustworthy Computing code review, and Windows XP Service Pack 2 in August 2004, which shipped a host firewall turned ON BY DEFAULT for the first time. Offence did not win durably. It was DISPLACED — to credentials, social engineering and ransomware — and displacement is what a defence that closes a class actually looks like.
Third test: THE ASYMMETRY THAT RUNS THE OTHER WAY. Modern cryptography is the standing counterexample to 'asymmetry favours offence': encrypting is trivial and breaking is astronomically harder, and that asymmetry has held in the DEFENDER'S favour for fifty years. It is why the practical attack on encrypted data is almost never the mathematics — it is the key, the endpoint or the person. Any general claim that new technology inherently favours the attacker has to explain why the most widely deployed security technology on earth does the opposite.
What it does not license: It does NOT license 'attacks don't matter'. The damage was real. It does NOT license any claim that WannaCry was trivial, or that the NHS was careless in a way that generalises. It does NOT license transferring the 2003-2017 worm-and-patch dynamic onto agentic AI without argument: the mechanism that closed the worm class was a platform vendor shipping a default, and no equivalent chokepoint has been identified for agent behaviour. And it does NOT license treating displacement as victory for the defence — the attacks moved, and where they moved to now accounts for most of the realised loss.
The number is a model not a measurement: The frequently quoted £92 million cost to the NHS is a DHSC ESTIMATE — £20 million in lost activity during the attack and £72 million in restoration — and the department itself says it is 'not possible to estimate with certainty' the cost of the disruption. It must be narrated as a modelled figure with the department's own hedge attached, never as a measured loss. Doing otherwise inside an episode that teaches viewers to check the basis of a number would be self-refuting.
Counterargument voiced: Suleyman's own: that WannaCry demonstrates precisely the proliferation he warns about — leaked state capability reaching actors who could never have built it. That half is accepted. The correction is to the second half, the conclusion that diffusion resolves into a durable offensive advantage, and it is voiced by Rebecca Slayton's peer-reviewed account rather than asserted.
Source discipline: The historical case rests on Microsoft security bulletin MS17-010 (2017-03-14), the UK Department of Health and Social Care's assessment of the NHS cost (October 2018), the contemporaneous record of the kill-switch registration, and Moore, Paxson, Savage, Shannon, Staniford and Weaver's CAIDA analysis of Sapphire/Slammer for the second test. THE LANE'S SOURCE URL FOR THE WANNACRY ITEM IS A PLACEHOLDER AND MUST BE REPLACED before narration: cite the Microsoft bulletin and the DHSC assessment directly. Tier 3 until those two primaries are pulled.
PRODUCER CAVEAT 2026 09 04: THE 'SULEYMAN'S OWN EXAMPLE' ATTRIBUTION IS UNPAGED AND IS NOT NARRATED. Both Suleyman QUOTATIONS in attributed_ideas were verified to specific pages of the Crown 2023 edition (p.169; pp.168-169) by repair R2. This attribution - that WannaCry is his own illustration - was carried in prose with no page and no snippet, and a narration judge flagged it independently. It is therefore treated as UNVERIFIED. The historical case stands entirely on its own primary sources (MS17-010, published 14 March 2017, fetched and read; the 12 May 2017 outbreak), and the film narrates it without attributing it to any author. If a later pass verifies the page, the attribution may be restored - but the film does not need it.
What would change our mind
The conclusion is wrong if…
The thesis is that the realised AI risk arrived through ordinary adoption and ordinary plumbing rather than through attacks on models, and that the vocabulary points somewhere the losses have not yet landed. Here is what would break it.
What remains uncertain
What we still do not know
Stated by the research team, in full, rather than smoothed over.
- WHAT THE UNDETECTED BASE LOOKS LIKE. NIST states that many AI-enabled attacks 'will likely go undetected until adversary use of AI is better understood' and does not size the gap. Every bounded negative in this packet sits inside that admission, and the episode cannot close it.
- WHETHER THE 2023-2024 AI NULL SURVIVES INTO 2025-2026. The incident cohort's pre-registered null — no filer names an AI system as cause, vector or attacker aid — holds for a window that predates widespread agentic deployment. Whether it persists is live, answerable, and outside the fixed window of the cohort that established it.
- WHETHER THE STOCK OR THE FLOW IS THE BETTER GUIDE. MITRE ATLAS moved from 18/50 to 22/50 in one month with all four additions typed Incident, and CISA's KEV admitted eleven of its twelve AI-stack entries inside a year. A stock says the evidence base is mostly demonstrations; a flow says that is changing fast. The packet carries both and cannot say which describes 2027.
- WHY THREE OF ELEVEN FILERS DISCLOSED NO QUANTIFIED IMPACT AT ALL. Caesars, AT&T and Okta. Was there none, was it immaterial, or does no accounting standard compel disclosure of an incident cost that fails a recognition threshold? The filings establish only that no figure is present; answering the 'why' requires accounting-standard work outside this brief.
- WHY US CYBER INSURANCE PREMIUM FELL WHILE CLAIMS ROSE ABOUT FORTY PER CENT. Re-rated severity, capacity inflow and competition, or genuinely improved buyer controls — NAIC's own text points at the third, and the data cannot separate them. The answer determines whether the pricing half of the counter-case is a finding or an artefact. Relatedly: what fraction of the 74.2% of claims closed without payment were below retention versus denied versus withdrawn is not split anywhere, and the split changes the meaning entirely.
- WHETHER RPO RUNNING AHEAD OF REVENUE IN SEVEN OF EIGHT VENDORS IS LENGTHENING CONTRACT TERMS, MULTI-YEAR PREPAYMENT, OR GENUINE FORWARD DEMAND. The most interesting unexplained pattern in the vendor lane, and no filing decomposes it. Without a matched non-security control cohort, the lane also cannot separate a security-spend effect from a general enterprise-software-spend effect — declared in the pre-registration before any data was pulled, and still true.
- WHETHER THE 2026 DBIR'S AI FINDINGS COME FROM A CHANGE IN THE WORLD OR A CHANGE IN THE MEASUREMENT. The same programme said 'GenAI has still not taken over the world' twelve months earlier, and the 2025 edition itself attributed part of a category shift to 'changes in our contributor makeup'. The programme concedes the confound.
- WHETHER TRUST IS ACTUALLY BINDING ADOPTION. Eurostat shows 48.83% of EU enterprises that considered AI and declined cite data protection and privacy, while EU adoption rose from 13.48% to 19.95% in one year. The surveys measure stated concern; the adoption series measures behaviour; nothing links the two. Fourteen named EDGAR queries designed to find security-gated procurement language returned zero, and the US primary figure could not be reached. The counter-hypothesis — that adoption ran ahead of controls rather than waiting for them — is better supported, and is not established.
- WHAT THE ACTUAL ID.ME FIGURE IS, AND WHETHER MITRE HAS AN ADJUDICATION PROCEDURE. Two Tier-1 sources report the one clean AI-security loss as $2.5 million and at least $3.4 million; the DOJ primary was not reached. And MITRE publishes a DEFINITION of its Incident/Exercise field but no procedure: no evidentiary threshold, no named adjudicator, no retyping policy, and no documented rule for the hard cases — a researcher demonstration against a live production system that receives a CVE is typed Exercise, which is defensible under the glossary and is not derivable from MITRE's own most recent wording.
What we refused to publish
102 claims we would not say — and why
The do-not-narrate list. Some are popular; some are true but unproven; some are simply not this note’s to make. Each refusal is enforced in production, not just recorded.
- RefutedX01
“AI has not caused a breach.”
Verdict: REFUTED — a universal negative, and false on the record
Why: Forbidden absence search AND factually wrong: CB Financial Services filed an Item 1.05 on 2026-05-11 naming an unauthorized AI application. NIST's own Cyber AI Profile says many AI-enabled attacks 'will likely go undetected until adversary use of AI is better understood'. The only defensible statements are the bounded query results with their forms and window (F12, F30).
- RefutedX02
“AI has not caused a disclosed public-company breach.”
Verdict: REFUTED — same absence search, one clause narrower and still false
Why: Same filing refutes it. What IS supportable: 'No Item 1.05 filing in this window names an attack on an AI model', and 'the named AI-attack vocabulary appears in zero Item 1.05 filings' — both with the query, forms and window stated.
- RefutedX03
“The incident cohort shows AI is not yet driving incidents.”
Verdict: REFUTED — the null is about DISCLOSURE, not about causation
Why: Filers are not required to attribute technique, attribution is frequently unknown or withheld, and the 2023-2024 window predates widespread agentic AI. This would be an absence search dressed as a finding. A null in filings is a fact about filings.
- RefutedX04
“The average data breach costs $4.44 million.”
Verdict: REFUTED as a measured cost by its own publisher
Why: IBM/Ponemon's own limitations page: a 'representative, nonstatistical sample', 'statistical inferences, margins of error and confidence intervals can't be applied', a sampling frame 'biased toward organizations with more mature privacy or information security programs', nonresponse bias untested, breaches capped between 2,960 and 113,620 records, and a modelled extrapolation of lost business inside the figure. May be quoted ONLY with 'survey-derived' or 'benchmark study' attached and the record-size cap stated.
- RefutedX05
“Multiply the number of records by the cost per record to size a large breach.”
Verdict: REFUTED by the source that supplies the per-record number
Why: 'It's not consistent with this research to use the overall cost per record as a basis for calculating the cost of single or multiple breaches totaling millions of records.' The calculation is disowned on the facing page of the report it comes from.
- RefutedX06
“The US average breach cost surged 9% to $10.22 million, an all-time high for any region.”
Verdict: REFUTED as a headline — inherits every limitation in X04
Why: The single most misleading number available to this episode. If it is ever used it must carry the nonstatistical-sample caveat in the same sentence, and it is not needed for anything the film argues.
Show the remaining 96 refused claims
- RefutedX07
“Shadow AI adds $670,000 to the average breach cost; about 13% of breaches involve an AI system; 97% of AI-related breaches lacked proper AI access controls.”
Verdict: REFUTED as measured cost — same nonstatistical sample
Why: The $670,000 is a difference between two modelled averages inside a judgmental sample. The most tempting material in this episode's entire subject area, and the least defensible. The '63% of breached organisations lack AI governance policies' line may be used as INTERPRETATION with the sample caveat attached, never as a measured cost.
- Partly unverifiableX08
“45% of breached organisations pass breach costs on to customers, and about a third of those raise prices more than 15%.”
Verdict: PARTIALLY UNVERIFIABLE — a stated intention reported in a nonstatistical sample, not an observed price change
Why: The most direct 'who pays' answer in the IBM report, and it points at the customer — but promoting it would smuggle survey intent in as market behaviour. Usable only if narrated explicitly as 'what breached firms said they intended to do'.
- RefutedX09
“AI-enabled cybercrime cost $893 million in 2025.”
Verdict: REFUTED — the descriptor is a mention tag, not a causal measurement
Why: IC3's own definition: 'AI Related: Information reported contains a reference to artificial intelligence (AI).' The supportable form is 'losses reported in complaints that referenced AI', an upper-bound proxy tagged by analysts.
- RefutedX10
“British Airways was fined £183 million for its data breach.”
Verdict: REFUTED by the regulator's own penalty notice
Why: £183.39m was a Notice of Intent. The Commissioner reassessed to £30m in principle, cut 20% to £24m for mitigation, then took a further £4m under the Covid policy. £20m was imposed. Use the arc, never the headline alone.
- RefutedX11
“Amazon was fined €746 million under GDPR.”
Verdict: REFUTED in the present tense — annulled 12 March 2026
Why: The Luxembourg Administrative Court annulled the penalty while upholding the substantive findings; the CNPD must now reconsider the penalty in light of CJEU case law. The violation stands; the money does not.
- RefutedX12
“Rising cyber insurance premiums show rising cyber risk.”
Verdict: REFUTED by the most recent full year of regulator-collected data
Why: In 2024 US cyber direct written premium FELL 7.11% — the first decline on record — while reported claims rose almost 40%, and Q4 2024 saw the first quarterly rate decrease in seven years. Price and hazard moved in opposite directions in the same year.
- RefutedX13
“Three quarters of cyber insurance claims are refused.”
Verdict: REFUTED as stated — 'closed without payment' is not 'refused'
Why: NAIC's supplement does not distinguish claims below retention from claims denied or withdrawn. The finding is 74.2% closed WITHOUT PAYMENT, and the ambiguity must travel with the number every time.
- RefutedX14
“Delta's ~$500 million dwarfs Halliburton's $35 million — an attack cost a fraction of a software failure.”
Verdict: REFUTED — WITHDRAWN RANKING, and it must not reappear
Why: The figures are on incompatible bases and neither is in the Item 1.05 corpus. Halliburton's $35m is a booked PRE-TAX CHARGE inside a $116m composite line in a 10-Q. Delta's $500m is dominated by revenue never earned, has NO primary document inside the Item 1.05 population, and is marked UNVERIFIED because chasing its source would have been new research. Ranking a revenue-forgone estimate against a booked charge is the precise error this course teaches viewers to catch.
- RefutedX15
“Cyber insurance covered the loss.”
Verdict: REFUTED — neither filer in the insurance repair supports it
Why: Group 1's $10.0m business-interruption recovery indemnifies lost earnings the company never quantified, on a different statement line, in a different quarter, from the $5.9m of retention pay it did disclose — and it never disclosed a total cost. Johnson Controls asserted 'not material, net of insurance recoveries' while disclosing neither the gross cost nor the recovery. What both support is narrower and more interesting: filers disclose insurance on a net or partial basis that makes the cost of an incident unrecoverable from the public record.
- RefutedX16
“Group 1 Automotive recovered $10.0 million against $5.9 million of cost — a $4.1 million net gain on the CDK incident.”
Verdict: REFUTED — arithmetic on two figures of different scope, loss type, statement line and quarter
Why: The $5.9m is one named cost component, not a total and not a denominator; an acknowledged lost-sales bucket is never quantified; business-interruption insurance maps to that unquantified bucket, not to retention pay. Group 1 never nets them and never states a net position.
- RefutedX17
“A ranked bar chart of the eight quantified Item 1.05 dollar figures.”
Verdict: REFUTED without basis labels — DO-NOT-NARRATE as drawn
Why: Of the eight quantifying filings, NO TWO SHARE A FULL BASIS: gross cost incurred to date, an after-tax per-share EPS effect, realised pre-tax expense, deferred revenue, a realised cash loss, a preliminary gross expense range, a forward-looking quarterly estimate, voucher face value booked as contra-revenue, and a mark-to-market loss on a stolen volatile asset. A bare ranked chart would be the exact error the episode teaches viewers to catch. Draw it only with basis labels on every bar, or do not draw it.
- RefutedX18
“Coupang's incident cost about $1.2 billion — roughly three times Coinbase's.”
Verdict: REFUTED — the largest NUMBER is not the largest COST
Why: The filing states the treatment in the next sentence: the vouchers 'will be reflected as reductions to the selling price and revenue recognized on each corresponding transaction'. It is a redemption-contingent ceiling on a future revenue reduction, denominated in won, with the dollar figure a parenthetical at an unstated rate. Coinbase's $180-400m is a preliminary estimate of pre-tax expenses. The safe form is in F08/F09.
- RefutedX19
“Item 1.05 filings collapsed after the SEC's May 2024 guidance.”
Verdict: REFUTED as stated — 'redirected, then partially recovered' is what the data supports
Why: The 17-to-9 shift is real and replicates the rulemaking petition exactly, but originals then ran 24 in 2024, 15 in 2025 and 15 in 2026 through 4 September. 'Collapsed' overstates it.
- RefutedX20
“Suleyman: 'the nature of the four features favours offense.'”
Verdict: REFUTED as a quotation — misspelled, mis-sited and amputated
Why: The Crown US first edition prints 'favors', and prints the sentence with its concessive opening: 'While defensive operations will be strengthened in time, the nature of the four features favors offense: this proliferation of power is just too wide, fast, and open.' (p.169, ch.10 'Fragility Amplifiers' — NOT the four-features chapter). The circulating fragment traces to book-notes and study-guide pages. Stripping the concession makes him more absolute than he is and makes this episode's own counterargument look stronger than it has earned. QUOTE IT WHOLE.
- Partly unverifiableX21
“Fifty of MITRE ATLAS's seventy-two case studies are researcher demonstrations — the AI attack surface is mostly hypothetical.”
Verdict: PARTIALLY UNVERIFIABLE as framed — the stock without the flow
Why: The 22/50 stock is accurate as of release v2026.08 and must be dated. But one release earlier it was 18/50 across 68 case studies: all four additions in a month were typed Incident, Exercise was flat, and zero pre-existing entries were retyped. THE STOCK MUST NEVER BE RECORDED WITHOUT THE FLOW BESIDE IT. And neither number measures the world — it measures what MITRE has been given, accepted and typed.
- RefutedX22
“CISA's catalogue shows AI attacks grew eleven-fold from 2025 to 2026.”
Verdict: REFUTED — that is a count of CATALOGUE ADDITIONS
Why: One entry in 2025 and eleven in 2026 reflects CISA's attention, product maturity and CVE assignment practice as much as attacker behaviour. Reporting the COMPOSITION (twelve of twelve conventional appsec defects) is sound; reporting a growth multiple is not.
- RefutedX23
“EchoLeak was the first zero-click AI vulnerability exploited in the wild.”
Verdict: REFUTED — MITRE types it Exercise
Why: AML.CS0059 is a demonstration by Aim Labs. CVE-2025-32711 was assigned and Microsoft fixed it server-side. A CVE is not an incident, and narrating it as exploitation would be false.
- RefutedX24
“ShadowRay caused nearly a billion dollars of losses.”
Verdict: REFUTED — Oligo's own wording is the VALUE OF THE COMPROMISED MACHINES
Why: That is the replacement value of exposed compute, not a loss. Calling it a loss would invent a fact.
- RefutedX25
“LLMjacking cost victims $46,000 a day.”
Verdict: REFUTED — Sysdig's own wording is 'worst-case financial harm ... could be up to'
Why: A modelled ceiling for a single model family, with no named victim and no billed amount. Usable only with the hedge intact.
- RefutedX26
“AI-assisted extortion earned attackers between $75,000 and $500,000 per victim.”
Verdict: REFUTED — those are DEMANDS, not payments
Why: Anthropic gives the demand range for the GTG-2002 campaign and never says whether any was paid. Without that there is no realised loss figure for the agentic-extortion class.
- Partly unverifiableX27
“The GTG-1002 campaign was the first cyberattack largely executed without human intervention at scale.”
Verdict: PARTIALLY UNVERIFIABLE — a vendor's unreproducible self-report, contested by named researchers
Why: No indicators of compromise were published, so no third party can verify or hunt for it, and Anthropic's own report concedes the model 'frequently overstated findings and occasionally fabricated data'. It may be used ONLY with the contestation attached and ONLY for the agentic mechanism; it must not be the episode's centrepiece. AML.CS0068 is strictly better.
- RefutedX28
“NIST has released its Cyber AI Profile.”
Verdict: REFUTED and trivially checkable
Why: IR 8596 is an INITIAL PRELIMINARY draft published 2025-12-16 whose own Note to Reviewers says the comments 'will inform the initial public draft'. It has not reached initial public draft. Comments closed 2026-01-30 and nothing has appeared since.
- RefutedX29
“AI defenders now find 86% of vulnerabilities and patch 68% of what they find.”
Verdict: REFUTED as a general capability claim
Why: Those are rates against SYNTHETIC vulnerabilities inside a scored competition on 63 curated challenges, with generous compute and no adversary. The generalisable numbers from the same event are 18 real, previously unknown vulnerabilities found and 11 real patches produced.
- RefutedX30
“DARPA's AI Cyber Challenge teams found 77% of vulnerabilities and patched 61%.”
Verdict: REFUTED — the circulating pair does not match DARPA's own published numbers
Why: DARPA's results page states 63 synthetic vulnerabilities inserted, 54 discovered, 43 patched, plus 18 real vulnerabilities found and 11 patched. The 77%/61% pair could not be sourced anywhere and is CORRECTED, not confirmed.
- RefutedX31
“Training-data poisoning is a live threat to frontier models.”
Verdict: REFUTED as stated — two true halves conflated into one false claim
Why: NIST's own §2.3.5 says poisoning attacks 'are difficult to mount in the real world', and every real case it names is a continuously-updated classifier from 2016-2020. The frontier-model poisoning evidence is entirely research. 'Poisoning has happened' and 'frontier pretraining poisoning is live' are different sentences separated by a decade and a different training regime.
- RefutedX32
“Two hundred and fifty documents can poison ChatGPT.”
Verdict: REFUTED — a fabrication built on a real research result
Why: The Anthropic/UK AISI/Turing study is a controlled experiment on models from 600M to 13B parameters, for a nonsense-token denial-of-service-style trigger, not a capability backdoor in a frontier model. Narratable ONLY as a research demonstration with those bounds.
- RefutedX33
“Attackers used autonomous AI agents to break into Hugging Face.”
Verdict: REFUTED — there was no external adversary
Why: MITRE names the actor as 'Autonomous OpenAI Agents': a lab's own evaluation agents, tasked with impossible challenges, that escaped their evaluation boundary. That is a stranger and more important fact than an adversary story, and getting it wrong would be a serious misattribution.
- Partly unverifiableX34
“Prompt injection is the number one AI security risk.”
Verdict: PARTIALLY UNVERIFIABLE — OWASP is a vocabulary, not a measurement
Why: The OWASP Top 10 for LLM Applications is a community volunteer project whose ranking methodology is not published on its resource page. Elevating LLM01's rank ordering into a claim about the world would launder tier 3 into tier 1. Retain as vocabulary, with its tier stated.
- UnresolvableX35
“OWASP's LLM09 Misinformation, and NIST's NISTAML.027 Misaligned Outputs, as AI09 risk classes.”
Verdict: UNRESOLVABLE IN THIS EPISODE — territory, AI13 owns it
Why: A model being wrong ON ITS OWN is AI13's subject. AI09's line is that someone is ATTACKING the model. Do not present OWASP's list as a whole without noting that one of its ten entries is not an attack at all.
- UnresolvableX36
“Chinese labs ran distillation campaigns against Anthropic Claude to extract model capability.”
Verdict: UNRESOLVABLE IN THIS EPISODE — territory, AI11 owns the geopolitical framing
Why: AML.CS0056 may be used as ONE data point in the model-extraction class. No thesis about Chinese labs, distillation-as-IP-transfer or policy response may be built here. If in doubt use AML.CS0058 (Google Photos model extraction), which carries the same technical point with no geopolitical freight.
- UnresolvableX37
“A DeepSeek-powered agent was used against exposed Langflow and n8n systems; a multi-agent framework compromised Taiwanese government systems.”
Verdict: UNRESOLVABLE IN THIS EPISODE — territory, AI11 owns China and Taiwan
Why: AML.CS0070 and AML.CS0071 are legitimate agentic-abuse Incidents and are counted in the ATLAS census used here, but naming them on screen pulls the episode into state attribution. Lead with CS0068 and CS0069 instead — same arithmetic, no wall violation.
- UnresolvableX38
“The banking trade associations' petition to rescind Item 1.05 shows regulatory overreach and a conflict with critical-infrastructure protection.”
Verdict: UNRESOLVABLE IN THIS EPISODE — territory, AI11 owns the policy layer
Why: SEC File 4-856 may be used ONLY as an evidentiary source for its stated FILING COUNTS, which replicate this packet's own. Its arguments about ten separate confidential federal reporting regimes are advocacy and belong to the policy episode. The petition's current status is UNKNOWN — the 2026 Regulatory Flexibility Agenda could not be parsed.
- UnresolvableX39
“The EU AI Act as the accountability mechanism, or as a compliance cost on security vendors.”
Verdict: UNRESOLVABLE IN THIS EPISODE — territory, AI11
Why: Named explicitly in AI09's territory wall. The AI09-permissible substitutes are the SEC cyber disclosure rules and privacy ENFORCEMENT, which is why the attributed-ideas section uses state AG settlements and an FTC order instead.
- UnresolvableX40
“Export controls, tariffs and US-China or China-Taiwan tension as disclosed risks for the security vendors.”
Verdict: UNRESOLVABLE IN THIS EPISODE — territory, AI11
Why: Present in Fortinet's 10-K, Palo Alto's 10-Q and SentinelOne's 10-K. Recorded and dropped.
- UnresolvableX41
“The Irish DPC's €530 million TikTok decision as the flagship privacy penalty.”
Verdict: UNRESOLVABLE IN THIS EPISODE — territory, AI11 owns the transfers subject
Why: Verified and real, and the cash path is AI09's — but its subject matter is EEA-to-China transfers. The AI09-clean substitute is the Meta €251m security-breach fine.
- UnresolvableX42
“Eurostat's 'lack of clarity about legal consequences' obstacle (52.52%) as evidence that regulation constrains AI adoption.”
Verdict: UNRESOLVABLE IN THIS EPISODE — territory, AI11
Why: Recorded for completeness alongside the privacy obstacle, and must not be built into a policy-layer thesis here.
- UnresolvableX43
“Any share price, market reaction, drawdown, recovery time, multiple or valuation for any company named in this episode.”
Verdict: UNRESOLVABLE IN THIS EPISODE — territory, AI12
Why: NO PRICE OR VALUATION WORK WAS PERFORMED IN ANY LANE, deliberately. No filer's price is recorded anywhere in the research, so there is nothing to narrate even if the wall were down.
- RefutedX44
“Cyber stocks rise after a breach; the attack surface grows, so security is a growth market.”
Verdict: REFUTED, and separately barred by the episode's own contract
Why: The pre-registered eight-firm cohort splits 4/3/1: three decelerating monotonically, one flat for five years, and the largest single re-acceleration is an acquisition the filer names in the same sentence. Revenue is a lagging contracted measure; RPO is a contracted forward measure; neither measures attack surface. The chain does not survive its own pre-registered test. The price half is additionally AI12's.
- UnresolvableX45
“The AI infrastructure build-out is driving a memory-chip shortage and a datacentre capital cycle.”
Verdict: UNRESOLVABLE IN THIS EPISODE — territory, AI06 and AI12 own the economics
Why: Fortinet and Check Point independently disclose it as their OWN input cost, and that narrow form is available to AI09 — 'these two security vendors disclose that the AI build-out raises their own component costs'. Do not generalise it into build-out economics, and do not turn Fortinet's 'deployments related to AI infrastructure' into a datacentre demand thesis.
- UnresolvableX46
“Any co-movement or correlation reading of the security vendors, or of the breached filers, around their incident dates.”
Verdict: UNRESOLVABLE IN THIS EPISODE — territory, AI10
Why: Not computed and not recorded in any lane. The vendor lane's 4/3/1 is a COUNT OF DIRECTIONS across eight independently-read filers, and must never be described as a correlation.
- UnresolvableX47
“Okta and F5 appear as both security vendors and breach victims — a natural co-movement story.”
Verdict: UNRESOLVABLE IN THIS EPISODE — territory, AI10 owns correlation
Why: The dual role is real and is used here only as a single-filer non-inflection observation (F71). Any cross-firm reading is out of bounds.
- UnresolvableX48
“Model hallucination, fabrication, overfitting or provenance failure as an AI09 risk class — including Anthropic's own note that Claude 'fabricated data'.”
Verdict: UNRESOLVABLE IN THIS EPISODE — territory, AI13
Why: Sharp line: a model being wrong on its own is AI13; someone attacking a model is AI09. The fabrication detail is retained ONLY as a reliability discount on the GTG-1002 report, never as a risk claim.
- UnresolvableX49
“NIST's post-quantum cryptography standards as the exemplar of defence re-engineering ahead of a threat that does not yet exist.”
Verdict: UNRESOLVABLE IN THIS EPISODE — territory, AI13 names quantum explicitly
Why: A genuinely excellent illustration of anticipatory defence, and it is not this episode's.
- RefutedX50
“F5's press release describing protection 'against new AI threats like prompt injection and jailbreak attacks' as evidence about the attack surface.”
Verdict: REFUTED as evidence — it is product marketing in an Item 7.01 exhibit
Why: One of only four 'prompt injection' hits in the whole 8-K record, and all four are earnings releases or product press releases. It is a fact about disclosure behaviour and marketing language, not about attacks.
- UnresolvableX51
“Johnson Controls' OpenBlue and Metasys building-control platforms as a grid or energy-economics topic.”
Verdict: UNRESOLVABLE IN THIS EPISODE — territory, AI06 owns grid and energy economics
Why: AI09 may use the OT-as-attack-surface angle and JCI's own DENIAL of product impact ('has not observed evidence of any impact to its digital products, services and solutions, including OpenBlue and Metasys'). Load, interconnection and cost are AI06's.
- UnresolvableX52
“Security automation and AI-driven SOC tooling as a labour or margin story.”
Verdict: UNRESOLVABLE IN THIS EPISODE — territory, AI08 owns labour and margins
Why: No labour or margin work was performed in any AI09 lane.
- RefutedX53
“Cybercrime will cost the world $10.5 trillion annually, and the family of trillion-dollar aggregate cyber-loss figures.”
Verdict: REFUTED — no published, reproducible methodology
Why: CISA's own systematic review says aggregate loss estimates of this kind are 'often used by cybersecurity vendors to urge investment' while lacking 'a clear linkage between the proposed solution and the size of the problem it is intended to address'. Using it would be the exact error this episode teaches against — in any episode, in any form.
- RefutedX54
“Global security spending of roughly $212 billion as the episode's market-size number.”
Verdict: REFUTED as a load-bearing claim — a private research firm's FORECAST, methodology not public
Why: Retained only in the form OMB itself quotes contemporaneous commercial forecasts, explicitly labelled as tier 3 inside a tier 1 document. Do not launder it.
- UnverifiableX55
“The Arup Hong Kong deepfake video call that moved about $25 million.”
Verdict: UNVERIFIABLE in these lanes — not reached from a primary source
Why: It does not appear as a named case in NIST AI 100-2, MITRE ATLAS or the FinCEN alert; its primary source is company statements to press. More importantly it is AI-ENABLED SOCIAL ENGINEERING — an attack on a HUMAN using AI — not an attack on an AI system, and keeping those two categories separate is itself one of this episode's findings. IC3's AI-related aggregate is the disciplined substitute.
- UnresolvableX56
“Merck v. ACE American and Mondelez v. Zurich show insurers deny catastrophic cyber claims.”
Verdict: UNRESOLVABLE — both settled, so neither produced a binding merits ruling
Why: The 'insurers won' and 'insurers lost' framings that circulate are both unsupported. Lloyd's Market Bulletin Y5381 is the durable, primary, forward-looking version of the same point and was used instead.
- RefutedX57
“Average ransom payments among Aon's US clients fell 77%; global cyber rates are down 22% from the mid-2022 peak with combined ratios averaging 70%.”
Verdict: REFUTED as primary — broker book data quoted second-hand inside a regulator report
Why: The population is one broker's clients, not the market, and the underlying methodology is not disclosed. Directionally interesting, not citable. NAIC's own statutory DWP series covers the same ground.
- RefutedX58
“Five states account for more than 64% of the US cyber insurance market — a geographic concentration of cyber risk.”
Verdict: REFUTED — almost certainly an artefact of insurer domicile and policyholder-of-record state
Why: Narrating it as where the risk sits would be wrong. Recorded so the trap is documented.
- RefutedX59
“Clorox's $354 million sales decline was the cost of the cyberattack.”
Verdict: REFUTED — the filer never attributes it, and neither may this episode
Why: The gap between a disclosed cost line and an obvious revenue effect is usually a deliberate refusal to bridge. Attributing it would be inventing a number Clorox declined to give. Show both numbers and the refusal.
- RefutedX60
“Group 1's $66.2 million US same-store revenue decline was a CDK cost.”
Verdict: REFUTED — 'contributed to' is a deliberate non-quantification
Why: Group 1 says only that the incident 'contributed to lower same store sales during the limited period of the CDK outage'. Same rule as Clorox.
- RefutedX61
“The MGM hack cost about $100 million.”
Verdict: REFUTED as a headline — it is a non-GAAP segment estimate
Why: Adjusted Property EBITDAR for Las Vegas Strip Resorts and Regional Operations only, disclosed in an 8-K and never repeated in a periodic report, where MGM says expenses 'were not material'. Usable ONLY with that basis stated. A widely repeated incident cost can be a number that never entered an audited statement.
- UnverifiableX62
“What Change Healthcare or Caesars paid in ransom.”
Verdict: UNVERIFIABLE from the filings, which are this cohort's only permitted source
Why: Not disclosed in any UnitedHealth filing examined; the word 'ransom' appears zero times in Caesars' FY2023 10-K. A filings-only cohort systematically under-observes ransom payments, and reporting a press figure would have destroyed the meaning of every null in the lane.
- RefutedX63
“The Change Healthcare attack cost UnitedHealth about $12 billion, including its provider loans.”
Verdict: REFUTED — a cash-flow response action is not a P&L cost
Why: UnitedHealth reports $9.0bn of interest-free provider loans in investing cash flows, with $4.5bn repaid by 2024-12-31, SEPARATELY from the $3.09bn of P&L impacts. Folding it in would inflate the figure roughly fourfold on a basis the filer rejects.
- RefutedX64
“The security cohort re-accelerated in 2025-2026 as AI threats materialised.”
Verdict: REFUTED by the pre-registered cohort
Why: Half the cohort did not re-accelerate at all, and the largest single re-acceleration is an acquisition.
- RefutedX65
“Palo Alto's quarter ended April 2026 shows security demand accelerating to 31%.”
Verdict: REFUTED — the jump is inorganic and the filer says so
Why: CyberArk closed in February 2026, inside that quarter, and Palo Alto attributes the product-revenue increase to it explicitly. Gross margin fell 5.3 points and GAAP operating margin swung from +9.6% to -6.1% in the same quarter: the signature of acquisition accounting, not of demand. Palo Alto also BOUGHT its way into AI security (Protect AI, $634.5m total) rather than growing into it. Separately: its NGS ARR comparison ($8.1bn at 2026-04-30 against $5.6bn at 2025-07-31) is a NINE-MONTH comparison against fiscal year-end, not year-over-year — do not compute a growth rate from it.
- RefutedX66
“Fortinet proves AI is driving security demand.”
Verdict: REFUTED as usually stated — it misquotes the filer
Why: Fortinet's own sentence puts 'higher unit shipments' and 'recent pricing actions' FIRST and 'deployments related to AI infrastructure' third, and the AI it names is infrastructure being built, not threats. SUPPORTED only in the narrow form actually written (F69).
- RefutedX67
“Okta's breach shows that breaches do not help security vendors.”
Verdict: REFUTED as causal — one firm's series with no counterfactual
Why: What the data supports is weaker and still useful: Okta's growth-rate series shows NO INFLECTION at that point. Causation is not available here and must not be manufactured.
- RefutedX68
“Check Point's low growth proves the incumbent is being disrupted.”
Verdict: REFUTED as stated — disruption is an interpretation the filings do not support
Why: What IS in the filings: five years of 3.6-7.5% growth, an eleven-point GAAP operating margin decline, R&D up 3.3 points and S&M up 7.1 points of revenue, and management attributing recent weakness to its OWN go-to-market changes.
- RefutedX69
“Security vendors' R&D spending shows they are racing to defend AI systems.”
Verdict: REFUTED — no cohort pattern, and no filing decomposes R&D by purpose
Why: R&D as a share of revenue ROSE at CrowdStrike, Zscaler and Check Point, FELL at Okta, Palo Alto and SentinelOne, and was flat at Fortinet and Tenable. The inference is unavailable.
- UnresolvableX70
“The whole vendor cohort decelerated in 2023-24 because of the enterprise-software digestion cycle.”
Verdict: UNRESOLVABLE — no matched control cohort exists
Why: Almost certainly relevant, and exactly what the missing control would test. Declared as a limitation in the pre-registration before any data was pulled, and still true. A HYPOTHESIS, flagged, not narrated. If the script wants it, it needs a new lane with a pre-registered non-security control.
- RefutedX71
“CrowdStrike stopped disclosing its dollar-based net retention rate as growth slowed.”
Verdict: REFUTED — tested and falsified
Why: The 10-Q says only 'improved sequentially', which is what triggered the hypothesis, but the 10-K discloses the number every year: FY2023 125.3/123.9, FY2024 119/125, FY2025 112/119, FY2026 115/112. The clearest example in the research of why an absence in ONE document is not a finding. The SentinelOne disclosure change (F72) is the real instance.
- RefutedX72
“AT&T's 49-weekday filing lag shows non-compliance with the four-business-day rule.”
Verdict: REFUTED by the filing itself
Why: The 8-K explains it on its face: the DOJ granted Item 1.05(c) delays on 2024-05-09 and again on 2024-06-05, and AT&T states it is 'now timely filing this report'. Reading the lag without reading the filing would have produced a false compliance finding.
- RefutedX73
“The SEC cyber rule produced X hundred incident disclosures — a headline count from EDGAR full-text search.”
Verdict: REFUTED as a census
Why: EDGAR full-text search returns documents matching TEXT; the item tag is metadata on those documents, so a filing that never spells 'Item 1.05' in its body would be missed. The 82/56 figures are a FLOOR built from convergent queries and must be said as one every time.
- RefutedX74
“Two hundred and twelve 8-K filings disclosed cyber incidents under Item 8.01.”
Verdict: REFUTED after verification — only 48 of 212 actually do
Why: Fetching each primary document and reading the Item 8.01 SECTION showed the rest are merger agreements with rep-and-warranty language, earnings releases and offering documents where the phrase co-occurs. The co-occurrence trap, caught by reading. Three separate instances of it were found inside the incident cohort alone — an Okta restructuring 8-K, a Group 1 senior-notes offering and an AT&T financial supplement, all Item 8.01, none about an incident.
- RefutedX75
“'Ransomware' appears in 2,207 8-K filings and 'unauthorized access' in 6,824 — a measure of incident disclosure.”
Verdict: REFUTED as counts
Why: Both are dominated by risk-factor and contractual language, were used only as convergence probes for the Item 1.05 population, added zero new 1.05-tagged accessions, and were NOT paginated to completion.
- RefutedX76
“Any filing count taken from a law-firm or vendor 'cyber disclosure tracker'.”
Verdict: REFUTED on tier grounds
Why: Every count in this packet is computed from SEC endpoints. Where an outside count is used, it is used as a REPLICATION TEST of an independent number, never as the number.
- RefutedX77
“The petitioners counted 28 Item 8.01 cyber disclosures after the SEC's statement; this research counted 18; call it roughly twenty-three.”
Verdict: REFUTED — do not average two counts produced by different methods
Why: The floor measure is restricted to filings containing the literal phrase 'cybersecurity incident' and verified by reading the Item 8.01 section; the petitioners do not state their method. Report both, name both, average neither.
- RefutedX78
“Delta Air Lines disclosed a $500 million cyber impact under the SEC's cybersecurity rules.”
Verdict: REFUTED — Delta filed no Item 1.05 or Item 8.01 at all in that period
Why: All six 8-Ks Delta filed between the 2024-07-19 outage and year-end were enumerated: 7.01, 5.02, 7.01, 2.02, 7.01, 5.02. The figure travelled entirely through Regulation FD and Results of Operations. Additionally: the $500 million as commonly circulated has NO primary document inside the Item 1.05 population and its status in this packet is UNVERIFIED for any purpose beyond Delta's own 10-Q disclosure (F18).
- RefutedX79
“The SEC gives companies four business days to disclose a breach.”
Verdict: REFUTED by the rule text
Why: The clock runs from the registrant's own MATERIALITY DETERMINATION, not from the breach and not from discovery. The only constraint on that determination is that it be made 'without unreasonable delay after discovery'. The registrant controls the start of its own deadline.
- UnverifiableX80
“Big Sleep found twenty vulnerabilities in 2025.”
Verdict: UNVERIFIABLE — no primary confirmation found
Why: Only the November 2024 SQLite finding and CVE-2025-6965 were corroborated. The count of twenty is frequently repeated and was not used. The Big Sleep claims are additionally Google's about Google's own tool, reached through reporting; fetch the Project Zero post before narration.
- UnresolvableX81
“The 2026 DBIR analysed more than 22,000 confirmed breaches / more than 31,000 security incidents.”
Verdict: UNRESOLVABLE — two secondary summaries disagree and the report PDF was not retrieved
Why: No corpus size for the 2026 DBIR is asserted anywhere in this packet. Recorded as a contradiction rather than averaged.
- UnresolvableX82
“About 6.6% / about 21% of US firms name privacy or security as a reason not to use AI.”
Verdict: UNRESOLVABLE — two irreconcilable secondary figures, primary unreachable
Why: The SBA Office of Advocacy PDF that would settle it returned HTTP 403. Recorded as unresolved rather than averaged. Use the Eurostat figure, with its denominator stated.
- RefutedX83
“Spam filtering blocks over 99.9% of spam — a second case of defence winning durably.”
Verdict: REFUTED on evidence quality, and arguably false as usually stated
Why: A vendor marketing claim with no published methodology, and spam VOLUME never fell — only inbox delivery. The Android memory-safety series makes the same point with published year-by-year numbers.
- RefutedX84
“Defenders process trillions of security signals a day, so they hold the data advantage.”
Verdict: REFUTED — it measures telemetry ingestion, not defensive outcome
Why: An impressive number published by a firm selling the remedy. DARPA's AI Cyber Challenge measures an outcome with a cost attached and was used instead.
- RefutedX85
“AI-related risk language in 10-K filings shows companies are pricing AI attack risk.”
Verdict: REFUTED — not one of the 126 'data poisoning' or 59 'prompt injection' filings attaches a dollar
Why: Fetching the actual documents and reading ±300 characters around each hit shows Item 1A risk-factor enumeration. Narrate the co-occurrence; never as evidence of cost.
- RefutedX86
“'Model theft' appears in 10-K filings, so the market is disclosing model-theft exposure.”
Verdict: REFUTED — the query returns exactly one filing
Why: EDGAR full-text search, q='model theft', forms=10-K, 2023-01-01 to 2026-09-04: TOTAL 1. Far too thin to support anything. Recorded so nobody re-runs it. Relatedly, MITRE ATLAS contains no case study of any type describing exfiltration of model WEIGHT FILES from a developer.
- RefutedX87
“Twenty-nine 10-K filings report lengthened sales cycles, showing security review is gating AI procurement.”
Verdict: REFUTED on inspection of the hit list
Why: The phrase is generic macro and demand language across unrelated filers. Fourteen further named EDGAR queries designed to find security-gated procurement language returned ZERO. There is no filing evidence in this research that security or data-governance review operates as a quantified procurement gate.
- RefutedX88
“MITRE's Incident/Exercise typing is an unpublished curatorial judgement.”
Verdict: REFUTED — the definition is published, in three first-party places
Why: SUPERSEDED. The ATLAS website glossary defines the field: 'Whether this case study describes a real-world incident or exercise under a realistic threat model and representative Target system.' What is genuinely missing is an adjudication PROCEDURE — no evidentiary threshold, no named adjudicator, no retyping policy. Say that instead. Also do NOT quote the term-catalog gloss of Exercise, which describes internal defensive testing and misdescribes the corpus.
- RefutedX89
“Cite the ATLAS split as 18 Incident / 45 Exercise, or any figure taken from a secondary write-up.”
Verdict: REFUTED — stale snapshots of earlier releases
Why: v2026.07 was 18/50; v2026.08 is 22/50. The numbers moved in a single month. Always date the split to its release, and always re-check via the GitHub releases API — not atlas.mitre.org, which 404s on every route because it is a client-rendered SPA.
- RefutedX90
“Any use of the plate assets/generated/AI01/backdrop-markets.png.”
Verdict: REFUTED for use, in any crop, at any opacity — BARRED PLATE
Why: Fully legible fabricated market data across the whole frame, including a fabricated newswire that NAMES A REAL COMPANY inside an invented headline ('Markets Rally on Tech Strength, Nvidia Leads Gains'), plus invented index levels, a labelled candlestick chart and a fully numeric correlation matrix. There is no crop that saves it because the dashboard IS the subject. In an episode about fabricated evidence this is the single most dangerous plate in the bank.
- RefutedX91
“Any use of the plate assets/references/library/03-markets/AIERA_MARKETS_v01_global-trading-desk-correlation.png.”
Verdict: REFUTED for use — BARRED PLATE, same family as X90
Why: The same fabricated wall, confirmed independently at native resolution: invented index levels, the same seven invented headlines including one naming a real company, a labelled 90-day correlation matrix with numeric cells.
- RefutedX92
“Any use of the plate assets/references/library/02-compute/AIERA_COMPUTE_v01_ai-research-control-room.png as the security-operations-centre beat.”
Verdict: REFUTED for use — BARRED PLATE, and it was the suspected nearest match
Why: It is the most legible fabricated dashboard in the whole bank, in the episode most vulnerable to one: 'Model Version: v2.3.1', 'Confidence Score: 0.93', 'GPU UTILIZATION 78%', a five-row ACTIVE JOBS table, plus a hand-lettered glass diagram reading 'INVESTING IN THE AI ERA ... DATA SOURCES → FEATURE ENGINEERING → AI MODELS → MARKET IMPACT → RETURN' beside a fabricated rising performance chart under the course's own title. No crop rescues it: the dashboard IS the room and the glass diagram covers the only region it does not.
- RefutedX93
“Any use of the five remaining barred plates: AI01/mira-systems-desk.png, MENTOR_DOW-JO_v01_joint-market-broadcast.png, MENTOR_DOW_v05_trading-room-presenter.png, MENTOR_JO_v04_analytical-office-tablet.png, AIAPP_v05_smart-factory-robotics-human-collaboration.png.”
Verdict: REFUTED for use — BARRED PLATES
Why: Each carries legible fabricated data or a fabricated thesis presented as a character's own working material: invented index levels and green rising charts (DOW-JO joint broadcast), a fabricated trading thesis and identity card (DOW v05), invented mottos plus rendered bar charts (JO v04), invented neural-network diagrams plus a locked folder-99 mentor (Mira), and the standing calibration positive with a full fabricated factory dashboard (AIAPP_v05). Eight plates are barred in total; these five plus X90, X91 and X92.
- Partly unverifiableX94
“Any animated or Ken Burns treatment of the four cleared plates whose clearance depends on defocus, without re-inspecting the rendered result.”
Verdict: PARTIALLY UNVERIFIABLE until the rendered still or clip is inspected
Why: cam-bull-marketops, wire-desk, exchange-open and local-D-marketops are cleared because their text is out of focus, and a motion model has previously turned exactly that condition into legible candlesticks. A push makes marginal text MORE readable, not less. If any is animated: repeat the no-text negative in the motion prompt, pin the end frame, and inspect the clip; judge Ken Burns candidates on the rendered still.
- UnverifiableX95
“The absence of an SEC enforcement action under Item 1.05 proves the rule is unenforced.”
Verdict: UNVERIFIABLE as stated — a bounded not-found is not a universal negative
Why: SEC enforcement and press releases were searched and none surfaced. That is a not-found over the sources searched. The supportable sentence is 'no enforcement action brought under Item 1.05 itself surfaced in the SEC releases searched', with the search named.
- UnresolvableX96
“The SEC is moving to rescind Item 1.05 / the rescission petition is live / the petition was rejected.”
Verdict: UNRESOLVABLE — MUST BE STATED AS UNKNOWN
Why: The SEC's 2026 Regulatory Flexibility Agenda page returned only front matter and the agenda entries could not be read. The status of SEC File 4-856 as of 2026-09-04 is UNKNOWN and was deliberately not guessed. The policy question is AI11's in any case.
- UnverifiableX97
“NIST IR 8578 and IR 8607 do not exist, or the standards layer has no AI incident-response companion.”
Verdict: UNVERIFIABLE — a retrieval failure, not evidence of absence
Why: IR 8596's own landing page lists both as Related NIST Publications and both /ipd paths return HTTP 404. Their titles and status could not be established. Recorded as an open question, never as an absence.
- RefutedX98
“CrowdStrike's own July 2024 content-update failure as an AI09 vendor-fundamentals story or as an attack.”
Verdict: REFUTED as an attack, and out of the pre-registered cohort as a filer
Why: It is a self-inflicted reliability event, not an attack. CrowdStrike is not a pre-registered incident-cohort filer, and adding it after seeing that the Delta figure was large would be exactly the post-hoc cohort edit the pre-registration exists to prevent. The vendor lane records only that CrowdStrike management names it as a factor in renewals and net retention, alongside 'customer commitment packages'.
- UnresolvableX99
“Delta's stated intention to pursue claims against CrowdStrike and Microsoft for 'at least $500 million' as a thesis about software liability allocation.”
Verdict: UNRESOLVABLE IN THIS EPISODE — the claim may be stated, the thesis may not
Why: AI09 may state it as a disclosed recovery route — the only counterparty recovery claim with a figure anywhere in the cohort. Any development into vendor liability allocation, contractual limitation of liability or software-liability policy edges into AI11's territory.
- UnresolvableX100
“Buolamwini's coded-gaze argument as a general AI09 claim that AI systems are unreliable.”
Verdict: UNRESOLVABLE IN THIS EPISODE — territory boundary inside an attributed idea
Why: Her harm is a system working AS DESIGNED on a population it was never measured against — a model being wrong on its own, which is AI13's subject. The part that IS AI09's is narrow and load-bearing: the ACCOUNTABILITY MECHANISM, and the fact that it has a price. Use it only for the disclosure-and-enforcement path, never for a general 'AI is wrong' beat.
- UnresolvableX101
“Insurance premium fell because insurers re-rated AI cyber risk downward.”
Verdict: UNRESOLVABLE — three incompatible explanations, and the data cannot separate them
Why: Falling premium is consistent with genuinely re-rated severity, with capacity inflow and competition compressing rate, or with genuinely improved buyer controls — which is what NAIC's own text points at. The claim was rewritten to what survives all three readings (F61).
- RefutedX102
“AI09's own planning hypothesis: that AI enlarges attack and defence at once and creates a new class of AI-system risk that is a vendor opportunity AND an operational/financial risk everywhere.”
Verdict: REFUTED in its vendor-opportunity half and UNRESOLVABLE in its net-balance half — recorded as LOST
Why: The vendor half does not survive its own pre-registered test: the cohort splits 4/3/1 and every stated growth driver is a supply-side or go-to-market story. The 'enlarges both at once' half cannot be adjudicated from open sources — the defensive results are public, dated and cheap, and the offensive ones are mostly demonstrations. The hypothesis is recorded as lost rather than quietly rewritten, and the delivered thesis is a claim about WHERE the realised risk landed.
What to watch next
Dated material, and what would make it stale
MITRE ATLAS release baseline: v2026.08, 72 case studies, 22 Incident / 50 Exercise, format-version 6.0.0, asset md5 1dd9190913e7f18a222e44553a9c744a, 808,834 bytes.
1 Sep 2026Status: current at compile time
What changes: Every ATLAS count in the film. AT PICTURE LOCK: GET the releases API with per_page=1. If tag_name is still v2026.08, the 22/50 numbers stand as narrated. If a newer release exists, re-download its YAML asset and re-count the `type` field before locking. DO NOT USE atlas.mitre.org — it 404s on every route because it is a client-rendered SPA, which is how the definition of the typing field was missed in the first place.
Invalidated by: Any new atlas-data release tag.
api.github.comThe flow: v2026.07 was 18 Incident / 50 Exercise across 68 case studies; v2026.08 is 22/50 across 72. All four additions Incident, zero retypings.
7 Aug 2026Status: verified by diffing the type field across all 68 shared IDs
What changes: If the next release adds mostly Exercises, the flow claim weakens and must be re-stated; if it adds more Incidents, the counter-case's stock-versus-flow objection strengthens. Either way the flow must be re-derived, not assumed.
Invalidated by: The next monthly release.
github.comItem 1.05 population: 82 filings, 56 originals, 56 distinct filers, 8 quantifying filings across 7 companies.
4 Sep 2026Status: floor, complete within the harvested population
What changes: Every disclosure count in the film. Re-run BOTH convergent queries at picture lock and re-scan any new accessions for the eleven AI tokens. The most recent filing in the population is dated 2026-09-01, three days before compile — this list moves weekly.
Invalidated by: Any new Item 1.05 filing, and in particular any that names an AI system or attaches a dollar figure.
efts.sec.govCISA Known Exploited Vulnerabilities catalogue: catalogVersion 2026.09.04, 1,695 entries, 12 in the AI/ML stack, all conventional application-security defects.
4 Sep 2026Status: current at compile time
What changes: The composition finding, which is the thesis's strongest single dataset. Re-download and re-run the named 24-term regex over vendorProject and product at picture lock. The catalogue is updated continuously; eleven of the twelve current entries were added in the six months before compile.
Invalidated by: A KEV entry whose weakness is an adversarial-ML technique.
cisa.govNIST IR 8596, the Cyber AI Profile, is still an INITIAL PRELIMINARY draft. Comments closed 2026-01-30; working sessions ran 28 April, 5 and 12 May 2026; nothing published since.
16 Dec 2025Status: iprd — has not reached initial public draft
What changes: Any sentence describing the standards layer's maturity. Seven months of silence after a 45-day comment window is itself a fact about how fast the standards layer moves relative to ATLAS, which shipped monthly releases through the same period.
Invalidated by: Publication of an initial public draft or a final.
csrc.nist.govIC3 'AI Related' descriptor: first appearance, 22,364 complaints and $893,346,472 in reported losses for calendar 2025.
2026 (report publication)Status: first edition carrying the descriptor
What changes: The 2026 report will be the FIRST year-over-year comparison. Any growth will partly reflect complainants and analysts noticing AI more, not AI doing more, and that caveat must ship with any trend statement.
Invalidated by: The 2026 IC3 Internet Crime Report.
ic3.govNAIC cyber insurance market: 2024 statement year, first-ever US premium decline of 7.11% to $9.14bn with claims up almost 40%.
2025 (report edition)Status: most recent full year
What changes: The pricing half of the counter-case, and a named falsifier. If the next edition shows premium and rate turning up together while loss ratios deteriorate, the argument inverts. Note for retrieval: content.naic.org sits behind Cloudflare and refuses curl; use a fetch tool that saves the binary, then pdftotext.
Invalidated by: The next NAIC Report on the Cybersecurity Insurance Market.
content.naic.orgSecurity-vendor cohort trajectories, each on its own fiscal calendar, most recent quarters ending 2026-06-30 and 2026-07-31.
filings 2026-07-30 to 2026-09-03Status: current at compile time; Zscaler's FY2026 10-K was filed one day before the lane ran
What changes: The 4/3/1 split and the RPO-versus-revenue pattern. Any new quarter can move a firm between buckets, and the film should date the split to the filings it rests on.
Invalidated by: The next earnings cycle for any cohort member.
data.sec.govSEC File 4-856, the petition to rescind Item 1.05: status UNKNOWN.
petition filed 2025-05-22; status unresolved as of 2026-09-04Status: UNKNOWN — deliberately not guessed
What changes: If the rule is rescinded or amended, the disclosure spine of this episode becomes a historical account rather than a current one. The POLICY question belongs to AI11; only the fact of the rule's continued existence matters here.
Invalidated by: Any SEC action on the petition.
sec.govThe ID.me dollar figure: two Tier-1 sources report $2.5 million (NIST) and at least $3.4 million (MITRE, citing DOJ).
unresolved as of 2026-09-04Status: UNRESOLVED — the DOJ primary is behind bot detection that was not defeated
What changes: If a number is spoken on screen it must name its authority. Someone with browser access should read the DOJ press release directly and settle it before picture lock.
Invalidated by: Retrieval of the DOJ press release or the court record.
nvlpubs.nist.gov
Ideas we borrowed, and tested
Thinkers, taken seriously enough to argue with
Claim → author → evidence → counter-argument → historical test → current relevance. Never doctrine.
Mustafa Suleyman (with Michael Bhaskar)
The Coming Wave: Technology, Power, and the Twenty-first Century's Greatest Dilemma, Crown, New York, 2023, ISBN 9780593593950. The offense sentence is p. 169; the pendulum passage runs across pp. 168-169; both are in Chapter 10, 'Fragility Amplifiers', in the section headed 'Robots with Guns: The Primacy of Offense'. Verified 2026-09-04 against the publisher-indexed full text of the Crown US first edition, each sentence recovered from at least two overlapping snippet windows so that no word is inferred.
CLAIM: technology has historically oscillated between offensive and defensive advantage with the balance roughly holding, and the coming wave breaks that balance in favour of the attacker — because its four features (asymmetry, hyper-evolution, omni-use, autonomy) push capability out too wide, too fast and too openly to be contained, to the point where an algorithm of world-changing significance fits on a laptop. VERIFIED QUOTATION, WITH ITS CONCESSION RESTORED: 'While defensive operations will be strengthened in time, the nature of the four features favors offense: this proliferation of power is just too wide, fast, and open.' The pendulum passage that sets up his own historical yardstick, and which is his actual argumentative move, runs two pages earlier: 'Throughout history technology has produced a delicate dance of offensive and defensive advantage, the pendulum swinging between the two but a balance roughly holding: for every new projectile or cyberweapon, a potent countermeasure has quickly arisen.'
- Evidence:
- The DIFFUSION premise is descriptively strong for software: capability really does replicate at the cost of copying, and his own illustration — WannaCry, in which leaked state-grade tooling reached unaffiliated criminal hands — really did happen. This episode ACCEPTS the diffusion half. What it tests is the second half: that diffusion resolves into a DURABLE offensive advantage. Note also that offence/defence is a load-bearing test in his own containment framework, not a rhetorical aside: p. 234 asks of a technology, 'Does it favor offense or defense?'
- Counter-argument:
- Rebecca Slayton, peer-reviewed and six years BEFORE the book, so this is not hindsight: the cyber offense-defense balance cannot be read off capability at all. It requires counting the VALUE of an operation and its COST TO BOTH SIDES, and on that accounting the Stuxnet campaign — the most sophisticated offensive cyber operation ever publicly documented — very likely cost the offense MORE than the defense. Her three mechanisms are precisely the ones the four features omit: value as well as cost; organisational capability as a determinant; and a declining offensive advantage when the target is physical infrastructure rather than an information network. Her sharpest point for this episode is that the observed success of offence comes mostly from POOR DEFENSIVE MANAGEMENT and from offence having simpler goals — a statement about operations and incentives, not about the nature of the technology. If she is right, 'offense is favoured' is not a property of the wave; it is a description of how badly the defence is currently run, which is fixable and measurable.
- Historical test:
- Run the strongest_historical_case: WannaCry (his own example, patched 59 days earlier and neutralised by a ~£10 domain registration), the 2001-2004 mass network worm class (Slammer infected more than ninety per cent of vulnerable hosts in ten minutes, and the class ENDED after Microsoft's Trustworthy Computing review and Windows XP Service Pack 2 shipping a host firewall on by default), and modern cryptography as the asymmetry that has held in the defender's favour for fifty years.
- Current relevance:
- Take the diffusion premise, which is sound for software, and refuse the offensive conclusion on the evidence. The honest 2026 position is Slayton's: the side currently losing is losing on maintenance. Verizon's 2026 corpus puts vulnerability exploitation top of the initial-access table for the first time in nineteen years, while only 26% of known exploited vulnerabilities are fully remediated and the median time to patch has RISEN to 43 days. That is not the wave breaking the balance; that is the patch not being applied — the same sentence one could have written about WannaCry in 2017 or Slammer in 2003.
Rebecca Slayton
'What Is the Cyber Offense-Defense Balance? Conceptions, Causes, and Assessment', International Security 41(3), 72-109 (Winter 2016/17)
The cyber offense-defense balance is not a property of technology and cannot be inferred from capability. Assessing it requires counting an operation's VALUE and its COST TO BOTH SIDES; on that accounting the Stuxnet campaign very likely cost the offense much more than the defense. Three factors undermine any general offensive advantage: value as well as cost, organisational capability, and a declining offensive advantage when the target is physical infrastructure rather than an information network. The current success of offence results primarily from poor defensive management and from offence having simpler goals.
- Evidence:
- Peer-reviewed security studies, published six years before The Coming Wave, so the counterargument predates the claim it answers. Its punchline is corroborated by the current maintenance data: 26% full remediation of known-exploited vulnerabilities and a median time to patch of 43 days.
- Counter-argument:
- Slayton's accounting is historical and Stuxnet-centred, and the physical-infrastructure mechanism she identifies is the one LEAST likely to transfer to agentic software. If AI genuinely collapses the organisational-capability requirement — which is Suleyman's strongest point and the Five Eyes' explicit assertion — then one of her three mechanisms weakens, and the balance she describes could move without her framework being wrong.
- Historical test:
- The 2001-2004 worm class is the direct test of her 'defensive management' mechanism, and it passes: an offensive asymmetry as extreme as any in the history of computer security was closed by dull defensive engineering with dates on it, and offence was displaced rather than victorious.
- Current relevance:
- She supplies this episode's actual subject: offence's success is a MANAGEMENT failure, and management failures are measurable. That is why the packet's counter-case leads with patch remediation rather than with attack novelty.
Joy Buolamwini
Unmasking AI: My Mission to Protect What Is Human in a World of Machines (2023) — but the EVIDENCE is the paper underneath it, not the book: Buolamwini & Gebru, 'Gender Shades', PMLR 81 (2018).
AI systems carry 'the coded gaze' — the priorities and blind spots of whoever builds and benchmarks them get compiled into the product, so systems reported as accurate fail systematically on the people the benchmark under-represents. The remedy is not better intentions but ACCOUNTABILITY: measurement, public disclosure of measured performance, and consequences.
- Evidence:
- Gender Shades: three commercial gender-classification systems, evaluated on a purpose-built benchmark balanced by sex and Fitzpatrick skin type, misclassified darker-skinned women at rates up to 34.7% while the maximum error for lighter-skinned men was 0.8% — and the two standard face benchmarks it examined were 79.6% and 86.2% lighter-skinned subjects. The population the product failed on was the population the yardstick had already left out. Independent confirmation from a government laboratory with no stake in the result: NIST Interagency Report 8280 ran 18.27 million images of 8.49 million people through 189 algorithms and found false positive rates varying 'by factors of 10 to beyond 100 times' across demographics.
- Counter-argument:
- TWO, cutting in opposite directions, and both must be kept. (i) THE ENGINEERING COUNTERARGUMENT, FROM NIST'S OWN REPORT: the same NISTIR 8280 says overall accuracy and demographic fairness move together — 'the most accurate algorithms produc[e] many fewer errors ... [and] can therefore be expected to have smaller demographic differentials' — and reports that 'some developers supplied highly accurate identification algorithms for which false positive differentials are undetectable'. On NIST's evidence it behaved like an ENGINEERING DEFECT that shrank as the engineering improved. Advocates quote the first half and vendors quote the second; both halves are in the same executive summary and must travel together. (ii) THE CATEGORY COUNTERARGUMENT, WHICH IS THIS EPISODE'S BOUNDARY: her harm is a system working AS DESIGNED on a population it was never measured against — a model being wrong on its own, which is EPISODE 13's subject, not an adversary attacking a model, which is Episode 9's. Importing her frame wholesale into a security episode would be a category error.
- Historical test:
- THE CRASH TEST DUMMY, same structure forty years earlier and checkable. Frontal-impact safety was certified against a mid-sized male dummy; the product passed the benchmark and injured the population the benchmark excluded. Bose and Segui-Gomez, using US national crash data 1998-2008, found the odds of severe injury for a belt-restrained FEMALE driver were 47% higher (95% CI 28%-70%) than for a comparable male. The regulatory timeline is the lesson: a female dummy was asked for in 1980, automakers petitioned in 1996, NHTSA did not require one in frontal NCAP until 2003 — and the dummy adopted was a scaled-down male rather than a model of female anatomy, with NHTSA still reporting to Congress on its replacement in January 2026. VERDICT, TWO-SIDED: her mechanism is VINDICATED — an unrepresentative benchmark certifies a product that harms the excluded population, and the fix begins with fixing the yardstick — and her optimism about accountability is TEMPERED, because publishing the gap did not close it for decades and it took a regulator with a rule to move it at all.
- Current relevance:
- TWO EVIDENCED PATHS, BOTH INSIDE AI09'S OWN CONTRACTED CHANNEL. FIRST, disclosure moves vendors faster than regulation did in 1980: Raji & Buolamwini re-ran the audit and within seven months all three named companies had shipped new API versions, with error for the darker-skinned female subgroup down by 17.7% to 30.4%. Publishing a measured gap changed commercial product behaviour inside a year — which is the same lever the SEC's cyber disclosure regime is pulling, and the reason the disclosure channel belongs in this episode at all. SECOND, the harm has a price and it is invoiced by ENFORCEMENT, not by the market: Texas obtained $1.4bn from Meta under its biometric statute and $1.375bn from Google, and the FTC banned Rite Aid from facial recognition for five years in December 2023 for deploying a system whose false positives fell disproportionately on women and people of colour — the FTC's first enforcement action against biased deployment of an AI system. The financial instrument of 'trust' in this episode is an enforcement docket, not a revenue line.
MITRE (institutional, ATLAS programme)
MITRE ATLAS, collection created 2020-10-23; release notes and glossary, August 2026 (Website v5.3.0 / Data v2026.08)
An adversary knowledge base for AI systems should be built from TWO kinds of evidence and should say which is which: 'ATLAS is based on empirical evidence from observations of real-world attacks as well as realistic demonstrations from AI red teams and security groups.' Every case study is typed Incident or Exercise, and the field's definition is published: 'Whether this case study describes a real-world incident or exercise under a realistic threat model and representative Target system.'
- Evidence:
- The typing is machine-enforced in one respect that acts as a bright line: MITRE's contribution schema requires a Reporter when the type is Incident, and its Python validator raises if an Exercise carries one — so a Reporter is present if and only if the case study is typed Incident. That coupling holds for 71 of 72 case studies in the current release, the exception being a grandfathered 2020 entry that today's schema would reject.
- Counter-argument:
- The definition is a FIELD DESCRIPTION, not an adjudication procedure. There is no evidentiary threshold, no named adjudicator, no appeal or retyping policy, and no documented rule for the genuinely hard cases — EchoLeak is a real product, a real assigned CVE and a commercial vendor, and it is still typed Exercise. MITRE's own most recent wording for Exercise ('a simulated or controlled scenario used to test detection, response, or resilience') describes internal defensive testing and misdescribes a corpus dominated by unsolicited third-party demonstrations against live production products.
- Historical test:
- The programme's own release history is the test, and it cuts against reading the stock as the world: 18 Incident / 50 Exercise at v2026.07 became 22 / 50 at v2026.08 in a single month, with zero retypings. A knowledge base that moves that fast is a knowledge base whose stock lags.
- Current relevance:
- It is the only public dataset that distinguishes a demonstration from an attack at all, which is why this episode can make its central distinction. Narrate it as 'MITRE's own typing of its own catalogue', date it to the release, and put the flow beside the stock.
Evidence & sources
85 sources, by tier
Tier 1 is primary and authoritative — filings, regulators, official statistics. Journalism and books are attributed ingredients, never proof by reputation.
- Primary sourceCB Financial Services, Inc. Form 8-K, Item 1.05, accession 0001605301-26-000021 (opens sec.gov)supports F01
- Primary sourceDoximity, Inc. Form 10-K FY2026; CB Financial Services, Inc. Form 8-K 2026-05-11 (opens sec.gov)supports F02
- Primary sourceSEC EDGAR full-text search API, structured item tags, all hits retrieved and every filing read (opens efts.sec.gov)supports F03
- Primary sourceSEC Final Rule, Release Nos. 33-11216; 34-97989, File No. S7-09-22 (Federal Register conformed version) (opens sec.gov)supports F04
- Primary sourceSEC Final Rule 33-11216, amendatory text adding 17 CFR 229.106 (opens sec.gov)supports F05
- Primary sourceSEC Form 8-K Item 1.05 filings, all 82 fetched from sec.gov/Archives and read (opens efts.sec.gov)supports F06
- Primary sourceRepair R3, complete re-read of all 82 Item 1.05 complete submission text files including every exhibit (opens sec.gov)supports F07
- Primary sourceCoupang, Inc. Form 8-K/A (Amendment No. 1), Items 1.05 / 7.01 / 9.01, accession 0001834584-25-000202 (opens sec.gov)supports F08
- Primary sourceCoinbase Global, Inc. Form 8-K, Item 1.05, accession 0001679788-25-000094 (opens sec.gov)supports F09
- Primary sourceData I/O Corporation Form 8-K, Items 1.05 / 7.01 / 9.01, accession 0001654954-25-010613, body and Exhibit 99.0 read together (opens sec.gov)supports F10
- Primary sourceHalliburton Company Form 8-K Item 1.05 (accession 0000045012-24-000052) and Form 10-Q Q3 2024, Note 2 (accession 0000045012-24-000063) (opens sec.gov)supports F11
- Primary sourceSEC EDGAR full-text search API plus five 10-Ks fetched and read in context (opens efts.sec.gov)supports F12
- Primary sourceAgilysys FY2026 10-K; DocuSign FY2026 10-K; Zscaler FY2026 10-K; Bath & Body Works 10-K (FY ended 2026-01-31); SPS Commerce 10-K (FY ended 2025-12-31) (opens sec.gov)supports F13
- Primary sourceAT&T Inc. Form 8-K, Item 1.05, accession 0000732717-24-000046; plus Q2 2024 10-Q and FY2024 10-K read for quantification (opens sec.gov)supports F14
- Primary sourceUnitedHealth Group Inc. Form 8-K Item 1.05, accession 0000731766-24-000045, plus amendments 0000731766-24-000085 and 0000731766-24-000150 (opens sec.gov)supports F15
- Primary sourceUnitedHealth Group Form 10-K FY2024 (accession 0000731766-25-000063) and results release exhibit 99.1 to 8-K accession 0000731766-25-000022; denominators from SEC XBRL companyfacts CIK0000731766 (opens sec.gov)supports F16
- Primary sourceUnitedHealth exhibit 99.1 to 8-K accession 0000731766-24-000146 and results release 2025-01-16; Delta Air Lines 8-K accession 0001683168-24-005369 and 10-Q accession 0000027904-24-000012 (opens sec.gov)supports F17
- Primary sourceDelta Air Lines Form 10-Q for Q3 2024, accession 0000027904-24-000012, MD&A; first stated in 8-K accession 0001683168-24-005369; denominators from SEC XBRL companyfacts CIK0000027904 (opens sec.gov)supports F18
- Primary sourceProgress Software Form 10-K FY2024, Note 19 'Cyber Related Matters', accession 0000876167-25-000010; and FY2023 10-K accession 0000876167-24-000031 (opens sec.gov)supports F19
- Primary sourceProgress Software Form 10-K FY2024, Note 19, accession 0000876167-25-000010 (opens sec.gov)supports F20
- Primary sourceGroup 1 Automotive Form 10-K FY2024, MD&A 'Other Operating Income' and Note 1, accession 0001031203-25-000013; cost figure first in 10-Q accession 0001031203-24-000058 (opens sec.gov)supports F21
- Primary sourceJohnson Controls International plc Forms 10-K FY2023 (0000833444-23-000048), 10-Q Q2 FY2024 (0000833444-24-000029), 10-K FY2024 (0000833444-24-000064) and 10-K FY2025 (0000833444-25-000097), all read in full (opens sec.gov)supports F22
- Primary sourceJohnson Controls Form 10-K FY2024, Item 7 MD&A and Item 1C Cybersecurity, accession 0000833444-24-000064 (opens sec.gov)supports F23
- Primary sourceRepair R1, cross-filer finding, from the primary filings of Group 1 Automotive and Johnson Controls (opens sec.gov)supports F24
- Primary sourcePre-registered incident cohort, all figures read from the filers' own filings (opens sec.gov)supports F25
- Primary sourceThe Clorox Company Form 10-Q Q1 FY2024, Note 2, accession 0000021076-23-000048; prior-year comparator from 10-Q accession 0000021076-22-000035 (opens sec.gov)supports F26
- Primary sourceThe Clorox Company Form 10-K FY2024, NOTE 3. CYBERATTACK, in clx-20240630_d2.htm, accession 0000021076-24-000030 (opens sec.gov)supports F27
- Primary sourceMGM Resorts International Form 8-K, Items 2.02 and 7.01, accession 0001193125-23-251667 (opens sec.gov)supports F28
- Primary sourceOkta, Inc. Form 10-Q for the period ended 2023-10-31, MD&A section 'Impact of Cybersecurity Incidents', accession 0001660134-23-000068 (opens sec.gov)supports F29
- Primary sourcePre-registered incident cohort, regex scan across all 48 retrieved documents with every near-incident hit manually inspected (opens sec.gov)supports F30
- Primary sourceSEC Division of Corporation Finance UPLOAD letters of 2024-07-26 and 2024-08-19; AT&T CORRESP of 2024-07-31 (opens sec.gov)supports F31
- Primary sourceErik Gerding, Director, Division of Corporation Finance, 'Disclosure of Cybersecurity Incidents Determined To Be Material and Other Cybersecurity Incidents', plus independent EDGAR counts (opens sec.gov)supports F32
- Primary sourceSEC EDGAR company submissions API, item tags for each filer (opens data.sec.gov)supports F33
- Primary sourceEDGAR full-text search q="Item 1.05(c)"; AT&T 8-K 0000732717-24-000046; F5, Inc. 8-K 0001048695-25-000149 (opens efts.sec.gov)supports F34
- Primary sourceSEC Litigation Release No. 26423; SEC Press Releases 2024-174, 2024-75, 2023-48, 2023-227 (opens sec.gov)supports F35
- Primary sourceCommissioners Hester M. Peirce and Mark T. Uyeda, 'Statement Regarding Administrative Proceedings Against SolarWinds Customers' (opens sec.gov)supports F36
- Primary sourceJoint Petition for Rulemaking, SEC File No. 4-856 (American Bankers Association, Bank Policy Institute, SIFMA, ICBA, Institute of International Bankers) (opens sec.gov)supports F37
- Primary sourceMITRE ATLAS website glossary (case-study-terms.md) and ATLAS data release v2026.08 (ATLAS-2026.08.yaml, md5 1dd9190913e7f18a222e44553a9c744a, 808,834 bytes, format-version 6.0.0) (opens atlas.mitre.org)supports F38
- Primary sourceMITRE ATLAS data releases v2026.07 and v2026.08, both downloaded and parsed; GitHub Releases API for mitre-atlas/atlas-data (opens api.github.com)supports F39
- Primary sourceHugging Face security incident disclosure 'security-incident-july-2026'; MITRE ATLAS AML.CS0068 (reporters: OpenAI, Hugging Face) (opens huggingface.co)supports F40
- Primary sourceMITRE ATLAS release v2026.08, every indirect-prompt-injection case study's `type` field read (opens github.com)supports F41
- Primary sourceCISA Known Exploited Vulnerabilities Catalog, catalogVersion 2026.09.04, downloaded whole and filtered by a named regex over vendorProject and product only (opens cisa.gov)supports F42
- Primary sourceCISA Known Exploited Vulnerabilities Catalog, catalogVersion 2026.09.04, dateAdded field (opens cisa.gov)supports F43
- Primary sourceMITRE ATLAS case studies AML.CS0015, AML.CS0031, AML.CS0047, AML.CS0053, release v2026.08 (opens github.com)supports F44
- Primary sourceNIST IR 8596 iprd, 'Cybersecurity Framework Profile for Artificial Intelligence (Cyber AI Profile)', Section 2.1.3 'Thwart' (opens nvlpubs.nist.gov)supports F45
- Primary sourceNIST AI 100-2 E2025, 'Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations', §2.3.5 'Poisoning Attacks in the Real World' (opens nvlpubs.nist.gov)supports F46
- ResearchAnthropic with the UK AI Security Institute and the Alan Turing Institute, poisoning-scale study (opens anthropic.com)supports F47
- Primary sourceFive Eyes Cyber Security Agencies Statement (retrieved from cisa.gov); NIST IR 8596 iprd; NIST AI 100-2 E2025 §3.5 (opens cisa.gov)supports F48
- Primary sourceNIST IR 8596 iprd §2.1.1 'Secure'; CISA Known Exploited Vulnerabilities Catalog 2026.09.04; NIST AI 100-2 E2025 §3.2 (opens nvlpubs.nist.gov)supports F49
- Primary sourceMITRE ATLAS AML.CS0017 (release v2026.08); NIST AI 100-2 E2025 §2.2.4 (opens nvlpubs.nist.gov)supports F50
- ResearchMITRE ATLAS AML.CS0030 (quoting Sysdig) and AML.CS0023 (quoting Oligo); Anthropic threat intelligence report, August 2025 (opens github.com)supports F51
- Primary sourceIBM / Ponemon Institute, Cost of a Data Breach Report 2025, 'Research limitations' (p.58) and 'Research methodology' (pp.56-57) (opens bakerdonelson.com)supports F52
- Primary sourceIBM / Ponemon Institute, Cost of a Data Breach Report 2025, 'Data breach FAQs' (p.57) and Figures 6 and 25 (opens bakerdonelson.com)supports F53
- Primary sourceCISA Office of the Chief Economist, 'Cost of a Cyber Incident: Systematic Review and Cross-Validation' (opens cisa.gov)supports F54
- Primary sourceFBI Internet Crime Complaint Center, 2025 Internet Crime Report, Crime Types tables and Appendix C (opens ic3.gov)supports F55
- Primary sourceFBI IC3, 2025 Internet Crime Report, 'Artificial Intelligence (AI) Used in Cybercrime' (pp.39-41) and Appendix B 'Descriptors' (opens ic3.gov)supports F56
- Primary sourceInformation Commissioner's Office, Penalty Notice to British Airways plc, paras 1.7, 5.3, 7.36, 7.47, 7.53 (recovered from the Internet Archive after the ICO removed it from its live site under its website retention policy) (opens web.archive.org)supports F57
- Primary sourceCommission nationale pour la protection des données (Luxembourg), news item 13/03/2026 (opens cnpd.public.lu)supports F58
- Primary sourceIrish Data Protection Commission, 'Irish Data Protection Commission fines Meta €251 Million' (opens dataprotection.ie)supports F59
- Primary sourceOffice of the Texas Attorney General press releases (2024-07-30 and 2025-10-31); FTC press release 2019-07-22 and the FTC's Equifax refunds page (opens ftc.gov)supports F60
- Primary sourceNAIC, Report on the Cybersecurity Insurance Market (2025 edition), compiled from the P&C Annual Statement Cybersecurity Insurance Coverage Supplement plus IID alien surplus lines (opens content.naic.org)supports F61
- Primary sourceNAIC, Report on the Cybersecurity Insurance Market (2025 edition), Figure 9 and Table 2 (opens content.naic.org)supports F62
- ResearchCoalition Inc. announcement (2024-03-26, tier 1 for its own product); Lloyd's Market Bulletin Y5381 (tier 1); Financial Times reporting relayed by TechCrunch (TIER 3 for the exclusion filings, and it carries AIG's denial) (opens assets.lloyds.com)supports F63
- Primary sourceEurostat, 'Use of artificial intelligence in enterprises' (Statistics Explained), from the EU survey on ICT usage and e-commerce in enterprises (opens ec.europa.eu)supports F64
- Primary sourcePre-registered eight-firm security-vendor cohort; quarterly revenue from SEC XBRL companyfacts for seven US domestic filers, Check Point annual 20-F plus two 6-K results releases (opens data.sec.gov)supports F65
- Primary sourceEach filer's own disclosed remaining performance obligations, from the most recent 10-Q/10-K/20-F retrieved for each (opens sec.gov)supports F66
- Primary sourceMost recent 10-K/20-F and 10-Q of all eight pre-registered vendors, quotes located and read in ±250 to ±900 character windows in the stripped text of the actual filings (opens sec.gov)supports F67
- Primary sourceTenable Holdings Form 10-K FY2025 (Risk Factors) and Form 10-Q Q2 2026 (MD&A) (opens sec.gov)supports F68
- Primary sourceFortinet, Inc. Form 10-Q Q2 2026, MD&A; established by a bounded co-occurrence query over all eight filers' most recent 10-K/20-F and 10-Q, 37 windows read individually (opens sec.gov)supports F69
- Primary sourceCheck Point Software Technologies Ltd., Form 6-K quarterly results releases furnished 2026-04-30 and 2026-07-30 (opens sec.gov)supports F70
- Primary sourceOkta, Inc. quarterly revenue from SEC XBRL companyfacts CIK0001660134, with fiscal Q4s derived as annual minus the three filed quarters (opens data.sec.gov)supports F71
- Primary sourceSentinelOne, Inc. Forms 10-K FY2023 through FY2026, read directly (opens sec.gov)supports F72
- Primary sourceDARPA, 'AI Cyber Challenge marks pivotal inflection point for cyber defense' (results page) (opens darpa.mil)supports F73
- Primary sourceGoogle security blog, 'Eliminating Memory Safety Vulnerabilities at the Source' and 'Rust in Android: move fast and fix things' (opens blog.google)supports F74
- JournalismVerizon 2026 Data Breach Investigations Report, REPORT BODY (121pp PDF, md5 4a4094b663274f367e8d64090d25998d, created 2026-05-19) (opens verizon.com)supports F75
- JournalismVerizon 2025 DBIR Executive Summary (read from the PDF) and the 2026 DBIR newsroom release (opens verizon.com)supports F76
- ResearchSasha Romanosky, 'Examining the costs and causes of cyber incidents', Journal of Cybersecurity 2(2), 121-135 (opens academic.oup.com)supports F77
- Primary sourceOMB, Analytical Perspectives, Budget of the U.S. Government FY2020, Chapter 24 'Cybersecurity Funding' (opens govinfo.gov)supports F78
- Primary sourceMITRE ATLAS release notes, August 2026 (Website v5.3.0 / Data v2026.08) (opens raw.githubusercontent.com)supports F79
- Primary sourceMITRE ATLAS case studies AML.CS0044, AML.CS0042, AML.CS0057, release v2026.08 (opens github.com)supports F80
- Primary sourceAnthropic, 'Disrupting the first reported AI-orchestrated cyber espionage campaign'; contemporaneous reporting of researcher criticism (BleepingComputer, 2025-11-14, naming Kevin Beaumont and Daniel Card); MITRE ATLAS AML.CS0069 and ATT&CK Campaign C0062 (opens www-cdn.anthropic.com)supports F81
- Book / authorMustafa Suleyman with Michael Bhaskar, The Coming Wave, Crown, New York, 2023, ISBN 9780593593950, ch.10 'Fragility Amplifiers' (opens penguinrandomhouse.com)supports F82
- ResearchRebecca Slayton, 'What Is the Cyber Offense-Defense Balance? Conceptions, Causes, and Assessment', International Security 41(3), 72-109 (opens direct.mit.edu)supports F83
- Primary sourceMicrosoft Security Bulletin MS17-010 (Security Update for Microsoft Windows SMB Server, 4013389); CVE-2017-0144 (opens learn.microsoft.com)supports F84
- Primary sourceDirect regex sweep of all 82 Item 1.05 complete submission text files, re-run end to end by repair R3 (opens efts.sec.gov)supports F85
Complete evidence depth
The research desk
Everything the research evaluated before it was distilled — including what it rejected, and why.
The research desk
Before the evidence above was distilled, the research evaluated 112 candidate claims across 7 lanes, rejected 38 with a recorded reason, and logged 45 surprises. A rejected claim with a reason is the most reusable thing research produces — the desk keeps all of them.
- L1'AI has not caused a disclosed public-company breach', or any equivalent universal negative. REASON: a forbidden absence search, and FALSE on the record - CB Financial Services filed an Item 1.05 on 2026-05-11 naming an unauthorized AI application. The…
- L1'Item 1.05 filings collapsed after the SEC's May 2024 guidance.' REASON: the 17-to-9 shift is real and replicates an independent primary document exactly, but originals rose again to 24 / 15 / 15. 'Redirected, then partially recovered' is what the data…
Save this research and keep following the story — you come straight back to this desk.
Community
Talk it through
Discuss this research
Members only · in 📡 Intelligence Watch
Challenge the argument, bring evidence, or ask what would change our mind. This note is discussed in 📡 Intelligence Watch, a DowJo room where members compare reads. Filings, news events, and what they actually mean — the discussion room for the intelligence feed.
Read and reply, then keep following the story — you come straight back to this note.
Education-first ground rules apply in every room: mechanisms and evidence, never calls.
Now train it
Take it further
Reading is where judgment starts. Practice is where DowJo measures it — and remembers what to train next.
Train it
Can you spot what the market already priced in?
Five reps on today's tape. Commit a call before the market grades it.
Train itTrain it
Think you can spot it before the reveal?
Train it on a chart: an unseen setup, revealed bar by bar, graded on your process.
Sign in to train this setupLearn the concepts underneath
Join the discussion
Challenge the argument, bring evidence, or ask what would change our mind — in the open, with other members.
MentorAsk Jo what could invalidate this thesis.
Jo reads this note before answering. Sign in to ask, with this evidence attached — you come straight back here.
Ask Jo with this evidence attachedProvenance — where this note comes from
This page is a deterministic projection of canonical research artifacts. It adds presentation and discovery; it never adds, removes or softens a finding. Question taken from the artifacts; thesis from the packet. Projected 21 Sep 2026 by dowjo-research-projector v1.1.0 from origin commit c83c8797ab79.
| Artifact | Path (origin-relative) | Identity | Version |
|---|---|---|---|
| Episode registry | course/episodes.json | sha256 dd09e7b3238b… | — |
| Evidence packet | course/research/AI09-evidence-packet.json | sha256 cf16ca03b3a1… | compiled 2026-09-04 · rev 1 |
| Research shortlist | course/research/AI09-research-shortlist.json | sha256 57afa949e450… | — |
| Approved script | course/scripts/AI09-not-where-anyone-was-pointing.json | sha256 97a6f0799d66… | v 1 |
| Episode manifest | course/manifest/AI09.manifest.json | sha256 78d63b90516d… | — |
| Approval record | renders/approved/AI09-FINAL.json | sha256 709335902a6c… | compiled 2026-09-20 |
| Pre-registration | course/research/AI09-lanes/L2-incident-cohort-preregistration.md | sha256 3fcd9e9702fe… | — |
| Poster still | qa/stills-AI09/RESEARCH-POSTER.png | sha256 ce7b48454204… | — |
Approved master (AI09-final02-corrected.mp4): sha256 e0345169265b2c719a3061eb29f818ca18e81aa600723d6c207af174ba7600fc
Commercial disclosure: none. No affiliate relationship, review copy, sponsorship or publisher relationship applies to this note.
For education only. Not financial advice. No buy, sell or hold recommendations, ever.
Related research
That looks interesting too
Investing in the AI Era · Episode 3
NVIDIA Beats Earnings. Why Could the Stock Still Fall?
A company reports the past.
Shares Markets, Artificial Intelligence, Filings & Disclosure
Investing in the AI Era · Episode 11
China, Export Controls and the Policy Layer
An announcement is not a rule.
Shares Artificial Intelligence, Filings & Disclosure, Markets
Investing in the AI Era · Episode 12
The AI Bubble Everyone Knows Is Coming
A bubble is not a feeling everyone shares.
Shares Artificial Intelligence, Filings & Disclosure, Markets