The Seam Report 2026
Where intrusions bend between the systems you test. Cyber, physical and human attack paths in the United States and the Gulf, measured from public evidence only.
What the report found.
Every number comes from public sources or our own analysis of public data, with its denominator. The report gives the window and the source for each one.
-
Tests cover the steps. They miss the joins.
In 70 of 78 public intrusion paths from 2013 to 2026, every step on the victim’s own systems fell in a domain some single-domain test covers. A typical red team scope could follow 33 end to end. Of the 45 it could not, 38 ran through another organization the victim cannot authorize a tester to touch.
-
Products sold to keep intruders out are a growing way in.
Among recently published flaws, security controls rose from 10.7 percent of CISA’s exploited-list additions in January to September 2022 to 17.6 percent in the same months of 2026. Their median time from publication to listing is two days.
-
Most new SEC incident filings no longer call the incident material.
After the SEC staff statement of May 2024, 33 of 112 new incidents were first filed under Item 1.05, against 17 of 23 before.
-
Whoever resets a password is part of identity.
US advisories from 2023 to 2026 keep naming help-desk staff who reset credentials when a caller asks.
-
Harm reaches further than the adversary goes.
In 7 of 78 documented intrusions, operational technology stopped because IT was lost, against 6 in which the adversary acted in it. In 48, harm reached other organizations.
-
In the Gulf, recovery advice and residency rules pull apart.
After the March 2026 drone strikes, the cloud provider advised recovery in Europe and later said some data held only in the region could not be restored, while Gulf rules keep core records in-country.
-
AI agents under test reached real organizations.
In July and August 2026, three evaluators reported AI systems under cyber testing reaching organizations no one had pointed them at.
-
The fix, not the finding, takes the time.
The PHP project fixed two critical flaws on October 21, 2026, after first seeing signs of one in 2024. The next day 32 UK government services were unavailable and four partly so, largely as a precaution, with no confirmed compromise of central government systems.
-
Testing rules stop at the building, the person and the supplier.
Of 41 US and Gulf testing regimes, 1 requires a physical intrusion test, 5 a test of people and 9 a test of supplier-run systems. None of 50 sets rules for AI-driven testing.
Twelve chapters, one argument.
Intrusions cross from one kind of system, one owner and one country to another. Testing, monitoring and regulation are organized by domain and by owner. The report measures the gap between the two and proposes a way to test across it.
Read the report (PDF)- Intrusions bend at the seams between tests
- Tests cover the steps and miss the joins
- The controls at the edge are now a way in
- Whoever resets a password is part of identity
- Supplier seams are crossed often, tested rarely
- Few tests cross the door, camera or valve
- In the Gulf, a cloud region has a street address
- AI agents under test reached real organizations
- Testing rules stop at the seams attackers cross
- Gulf deadlines fall due hours before US ones
- Banks guard mail but rarely say where to report
- Test the crossings, not only the systems
Built from public evidence only.
The report contains nothing from client engagements. The case files, derived data, analysis scripts and sources are published with it, so every figure can be checked.
- Incident corpus
- 78 public intrusions from 2013 to 2026, coded step by step from advisories, court records, regulators’ decisions and victims’ own filings, with a random sample recoded blind.
- Exploited flaws
- CISA’s Known Exploited Vulnerabilities catalog, 1,728 entries, with publication dates from NVD and prediction scores from FIRST.
- SEC filings
- 185 Form 8-K filings describing 135 cybersecurity incidents at 130 companies since December 18, 2023.
- Rules
- 50 testing regimes and 96 incident notification duties across the United States, the six GCC states and benchmark schemes.
- Measurement
- A passive, aggregate reading of email and vulnerability-reporting posture at 159 banks and authorities.
Raw measurements that would name individual banks or ransomware victims are held back. The scripts show how to collect them again. Download the data and code
Discuss a seam-led test.
Write from your organization's email address. Tell us what is in scope, your deadline and who can authorize testing. Leave sensitive details out of the first message.