Discuss an engagement
MenuClose

Statistics from The Seam Report 2026.

69 figures from the report, each with its denominator, time window, as-of date, chapter and the data or primary source behind it. Every figure has its own link.

Download CSV Download JSON

Intrusion paths.

11 statistics, from chapters 2 and 5.

  1. 70 of 78 intrusion paths #paths-steps-inside-some-test

    In 70 of 78 publicly documented intrusion paths from 2013 to 2026, every known step on the victim’s own systems fell in a domain that some single-domain test covers.

    Numerator
    70
    Denominator
    78
    As of
    Window
    Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28
    Note
    A purposive sample of well-documented cases, not a random sample of all intrusions. Counts describe these 78 cases only.
    Computed from

    report/data/derived/corpus/stats.json, in the data download.

  2. 33 of 78 intrusion paths #paths-red-team-end-to-end

    A typical red team scope could have followed 33 of 78 publicly documented intrusion paths from first step to last.

    Numerator
    33
    Denominator
    78
    As of
    Window
    Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28
    Note
    Typical scope covers the victim’s own human, identity, edge, internal IT, cloud and value-transfer systems.
    Computed from

    report/data/derived/corpus/figures.json, figure corpus-single-test-coverage, in the data download.

  3. 45 of 78 intrusion paths #paths-left-red-team-scope

    Of 78 publicly documented intrusion paths, 45 left a typical red team scope, 38 of them because a step ran through systems or people the victim did not own, which the victim cannot authorize a tester to touch.

    Numerator
    45
    Denominator
    78
    As of
    Window
    Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28
    Note
    A path can leave the scope for more than one reason: 6 reached operational technology, 4 needed a physical step and 1 ran through an AI system.
    Computed from

    report/data/derived/corpus/figures.json, figure corpus-outside-red-team, in the data download.

  4. 9 of 78 intrusion paths #paths-single-domain-tests

    Single-domain tests could have followed at most 9 of 78 publicly documented intrusion paths from first step to last, a count that runs from 4 to 28 under other reasonable definitions.

    Numerator
    9
    Denominator
    78
    As of
    Window
    Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28
    Note
    Five of the 9 qualify only because the sources do not say how the adversary got in.
    Computed from

    report/data/derived/corpus/figures.json, figure corpus-single-test-coverage, in the data download.

  5. 38 of 78 intrusion paths #paths-through-another-owner

    Of 78 publicly documented intrusion paths, 38 included a step on systems or people the victim did not own, such as a supplier, a customer or an employee’s personal account.

    Numerator
    38
    Denominator
    78
    As of
    Window
    Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28
    Note
    The 95 percent Wilson interval runs from 38 to 60 percent. In 9 of the 38 the first step at a supplier or customer is inferred, not documented.
    Computed from

    report/data/derived/corpus/stats.json, in the data download. Figure corpus-other-owner-by-era is in report/data/derived/corpus/figures.json.

  6. 98 of 151 changes of domain #paths-identity-bends

    Of the 151 changes of domain in 78 publicly documented intrusion paths, 98 ran into or out of identity.

    Numerator
    98
    Denominator
    151
    As of
    Window
    Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28
    Note
    Part of identity’s weight comes from the notation, which codes a stolen password used on a VPN as a step in identity. Identity is the domain on which the two coders agreed least.
    Computed from

    report/data/derived/corpus/transitions.csv, in the data download. Figure corpus-transitions is in report/data/derived/corpus/figures.json.

  7. 40 of 78 intrusion paths #paths-three-domains

    Of 78 publicly documented intrusion paths, 40 touched three or more domains, and the median path had three steps.

    Numerator
    40
    Denominator
    78
    As of
    Window
    Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28
    Note
    Steps are counted after merging consecutive steps in the same domain with the same owner. Bend counts follow from the coding rules and from how much the sources say.
    Computed from

    report/data/derived/corpus/stats.json, in the data download.

  8. 9 of 78 intrusions #paths-harm-by-decision

    In 9 of 78 publicly documented intrusions, harm reached a domain the adversary never touched because the victim or someone downstream shut systems down or could not run without them, and 7 of the 9 reached operational technology.

    Numerator
    9
    Denominator
    78
    As of
    Window
    Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28
    Computed from

    report/data/derived/corpus/stats.json, in the data download.

  9. 48 of 78 intrusions #paths-harm-other-owners

    In 48 of 78 publicly documented intrusions, harm reached owners other than the victim, most often customers.

    Numerator
    48
    Denominator
    78
    As of
    Window
    Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28
    Note
    Other owners include customers, who may be people rather than organizations.
    Computed from

    report/data/derived/corpus/stats.json, in the data download.

  10. 19 of 39 intrusion paths #paths-owner-seams-by-era

    Paths through another owner were 9 of 21 from 2013 to 2018, 10 of 18 from 2019 to 2022 and 19 of 39 from 2023 to 2026, too few cases to show a trend in either direction.

    Numerator
    19
    Denominator
    39
    As of
    Window
    Intrusions with first access or disclosure from 2023-01-01 to 2026-09-28, compared with 2013 to 2018 and 2019 to 2022
    Note
    A finding that cuts against the report’s thesis. One case moves an era’s share by three to six points.
    Computed from

    report/data/derived/corpus/figures.json, figure corpus-other-owner-by-era, in the data download.

  11. 26 of 78 intrusion paths #paths-through-supplier

    Of 78 publicly documented intrusion paths, 26 passed through a supplier, about one in three.

    Numerator
    26
    Denominator
    78
    As of
    Window
    Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28
    Note
    The corpus codes a campaign such as one supply-chain compromise once, however many victims it had.
    Computed from

    report/data/derived/corpus/stats.json, in the data download.

Edge devices.

8 statistics, from chapter 3.

  1. 17.6% of recently published KEV additions #kev-security-controls-share

    Among recently published flaws, products sold as security controls rose from 10.7 percent (13 of 122) of CISA’s Known Exploited Vulnerabilities additions in January to September 2022 to 17.6 percent (36 of 204) in the same months of 2026.

    Numerator
    36
    Denominator
    204
    As of
    Window
    KEV additions 2026-01-01 to 2026-09-28, compared with 2022-01-01 to 2022-09-28
    Note
    Recently published means a CVE published in the year of listing or the year before, which removes CISA’s 2022 backlog of old flaws. Security controls include firewalls, VPN gateways, email and web security gateways, endpoint protection, network access control and privileged access management.
    Computed from

    report/data/derived/kev/summary.json, in the data download. Figure kev-recent-cves-share-by-year is in report/data/derived/kev/figures.json.

    Known Exploited Vulnerabilities catalog, JSON feed, catalogVersion 2026.09.27, Cybersecurity and Infrastructure Security Agency.

    CVE API 2.0, National Institute of Standards and Technology, National Vulnerability Database.

  2. 37 of 244 KEV additions #kev-security-controls-2026-count

    From January 1 to September 28, 2026, CISA added 37 flaws in products sold as security controls to its Known Exploited Vulnerabilities catalog, more than in any full year from 2022 to 2025 (34, 13, 24 and 35).

    Numerator
    37
    Denominator
    244
    As of
    Window
    KEV additions 2026-01-01 to 2026-09-28, compared with full years 2022 to 2025
    Note
    The 37 are 15.2 percent of the 244 additions in the window. The catalog snapshot’s last addition is dated 2026-09-27.
    Computed from

    report/data/derived/kev/summary.json, in the data download.

    Known Exploited Vulnerabilities catalog, JSON feed, catalogVersion 2026.09.27, Cybersecurity and Infrastructure Security Agency.

  3. 15.2% of KEV additions #kev-backlog-correction

    Counting all additions, the security-control share of CISA’s exploited list went from 5.4 percent (28 of 521) in January to September 2022 to 15.2 percent (37 of 244) in 2026, a near tripling that shrinks to a rise of about two thirds once CISA’s 2022 backlog of older flaws is removed.

    Numerator
    37
    Denominator
    244
    As of
    Window
    KEV additions 2026-01-01 to 2026-09-28, compared with 2022-01-01 to 2022-09-28
    Note
    In January to September 2022, 72.4 percent of additions were flaws published two or more years earlier, against 14.3 percent in 2026. A finding that cuts against the raw trend.
    Computed from

    report/data/derived/kev/summary.json, in the data download. Figure kev-recent-cves-share-by-year is in report/data/derived/kev/figures.json.

    Known Exploited Vulnerabilities catalog, JSON feed, catalogVersion 2026.09.27, Cybersecurity and Infrastructure Security Agency.

    CVE API 2.0, National Institute of Standards and Technology, National Vulnerability Database.

  4. 38.7% of recently published KEV additions #kev-internet-facing-share

    Counting only recently published flaws, products built to face the internet went from 29.5 percent (36 of 122) of CISA’s exploited-list additions in January to September 2022 to 38.7 percent (79 of 204) in the same months of 2026.

    Numerator
    79
    Denominator
    204
    As of
    Window
    KEV additions 2026-01-01 to 2026-09-28, compared with 2022-01-01 to 2022-09-28
    Note
    Internet-facing by design adds mail servers, managed file transfer and remote support servers to edge appliances. Moving every debatable product to the other side of the line leaves the 2026 share of all additions between 32.0 and 40.6 percent.
    Computed from

    report/data/derived/kev/summary.json, in the data download. Figure kev-recent-cves-share-by-year is in report/data/derived/kev/figures.json.

    Known Exploited Vulnerabilities catalog, JSON feed, catalogVersion 2026.09.27, Cybersecurity and Infrastructure Security Agency.

    CVE API 2.0, National Institute of Standards and Technology, National Vulnerability Database.

  5. 2 days, median #kev-lag-security-controls

    Flaws in products sold as security controls reached CISA’s exploited list a median of 2 days after publication, against 10 days for all 651 flaws published from 2022 to 2025.

    Numerator
    None
    Denominator
    80
    As of
    Window
    CVEs published 2022-01-01 to 2025-12-31 and added to the KEV by 2026-09-27
    Note
    Of the 80, 30 (37.5 percent) were listed on or before the day of publication. A short lag mostly means the flaw was disclosed because it was already being exploited.
    Computed from

    report/data/derived/kev/summary.json, in the data download. Figure kev-days-publication-to-kev-by-category is in report/data/derived/kev/figures.json.

    Known Exploited Vulnerabilities catalog, JSON feed, catalogVersion 2026.09.27, Cybersecurity and Infrastructure Security Agency.

    CVE API 2.0, National Institute of Standards and Technology, National Vulnerability Database.

  6. 5 days, median #kev-lag-edge

    Flaws in network edge appliances reached CISA’s exploited list a median of 5 days after publication (80 flaws), against 10 days for all 651 flaws published from 2022 to 2025.

    Numerator
    None
    Denominator
    80
    As of
    Window
    CVEs published 2022-01-01 to 2025-12-31 and added to the KEV by 2026-09-27
    Note
    Internet-facing products as a group were not faster: a median of 11.5 days (206 flaws) against 9 days for the rest (445).
    Computed from

    report/data/derived/kev/summary.json, in the data download. Figure kev-days-publication-to-kev-by-category is in report/data/derived/kev/figures.json.

    Known Exploited Vulnerabilities catalog, JSON feed, catalogVersion 2026.09.27, Cybersecurity and Infrastructure Security Agency.

    CVE API 2.0, National Institute of Standards and Technology, National Vulnerability Database.

  7. 73.2% of scored KEV additions #kev-epss-below-01

    The day before CISA listed them, 447 of 611 scored additions to its exploited list (73.2 percent) had an EPSS prediction score below 0.1.

    Numerator
    447
    Denominator
    611
    As of
    Window
    KEV additions 2023-03-07 to 2026-09-27
    Note
    Of 843 additions in the window, 232 had no score yet, mostly because they were published that day or later. A low score the day before listing does not prove the model wrong about the next 30 days.
    Computed from

    report/data/derived/kev/summary.json, in the data download. Figure kev-epss-day-before-addition is in report/data/derived/kev/figures.json.

    Known Exploited Vulnerabilities catalog, JSON feed, catalogVersion 2026.09.27, Cybersecurity and Infrastructure Security Agency.

    EPSS API, daily scores, FIRST.

  8. 70.4% of KEV additions #kev-forensic-triage

    From July 1 to September 27, 2026, CISA marked 69 of 98 additions to its exploited list (70.4 percent) for forensic triage, telling federal agencies to check for compromise as well as patch within three days.

    Numerator
    69
    Denominator
    98
    As of
    Window
    KEV additions 2026-07-01 to 2026-09-27
    Note
    Three months is a short record. The share was 32 of 39 internet-facing additions and 37 of 59 others.
    Computed from

    report/data/derived/kev/summary.json, in the data download.

    Known Exploited Vulnerabilities catalog, JSON feed, catalogVersion 2026.09.27, Cybersecurity and Infrastructure Security Agency.

    Primary source

    Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk, Cybersecurity and Infrastructure Security Agency, June 10, 2026. Note to Table 1: Remediation Timelines.

    The text “& forensic triage” means that the agency must complete remediation or mitigation action within the timeline (three days) and carry out a forensic triage of the asset to assess whether the system is compromised.

    Checked October 30, 2026, live page.

Ransomware.

4 statistics, from chapters 3 and 7.

  1. 35.7% of KEV additions #kev-ransomware-security-controls

    CISA marks known ransomware use on 35.7 percent (51 of 143) of the flaws it has added to its exploited list since 2022 in products sold as security controls, against 19.5 percent (277 of 1,417) of all additions.

    Numerator
    51
    Denominator
    143
    As of
    Window
    KEV additions from 2022-01-01 to 2026-09-27, catalog version 2026.09.27
    Note
    CISA can add the mark after listing, so older entries have had longer to collect it. Only backup and storage products, at 51.4 percent (18 of 35), carry it clearly more often. Managed file transfer and file sharing is level at 35.7 percent (10 of 28).
    Computed from

    report/data/derived/kev/summary.json, in the data download. Figure kev-ransomware-share-by-category is in report/data/derived/kev/figures.json.

    Known Exploited Vulnerabilities catalog, JSON feed, catalogVersion 2026.09.27, Cybersecurity and Infrastructure Security Agency.

  2. 0.87% of leak-site posts #gulf-leak-share

    Under a broad country rule, ransomware leak-site posts naming Gulf organizations went from 8 of 2,733 (0.29 percent) in January to September 2022 to 68 of 7,790 (0.87 percent) in the same months of 2026.

    Numerator
    68
    Denominator
    7,790
    As of
    Window
    Leak-site posts discovered 2026-01-01 to 2026-09-28, compared with 2022-01-01 to 2022-09-28
    Note
    Much of the rise comes from the tracker: posts carrying a description went from 17 percent in 2022 to 74 percent in 2026, and the broad rule mostly reads descriptions. The strict rule shows no steady trend. Posts are criminal claims, not confirmed incidents, and the country assignment is Bendings’.
    Computed from

    report/data/derived/ransomware/yearly_counts.csv, in the data download. Figure gcc-share-of-global-posts is in report/data/derived/ransomware/figures.json.

    RansomLook API, posts by year, 2021 to 2026 (data licensed CC BY 4.0), RansomLook open-source project.

  3. 1.08% of leak-site posts with a description #gulf-leak-share-described

    Among ransomware leak-site posts that carry a description, the broad Gulf share went from 3 of 475 (0.63 percent) in January to September 2022 to 62 of 5,737 (1.08 percent) in 2026, and it fell in 2023 and again in 2025.

    Numerator
    62
    Denominator
    5,737
    As of
    Window
    Leak-site posts discovered 2026-01-01 to 2026-09-28, compared with 2022-01-01 to 2022-09-28
    Note
    Read as a modest rise in how often Gulf organizations are named, with no steady trend.
    Computed from

    report/data/derived/ransomware/yearly_counts.csv, in the data download. Figure gcc-share-of-global-posts is in report/data/derived/ransomware/figures.json.

    RansomLook API, posts by year, 2021 to 2026 (data licensed CC BY 4.0), RansomLook open-source project.

  4. 82 of 162 leak-site posts #gulf-leak-uae

    Across the January to September windows of 2021 to 2026, UAE organizations were named in 82 of 162 ransomware leak-site posts naming Gulf organizations under the broad rule, and in 37 of 68 in 2026.

    Numerator
    82
    Denominator
    162
    As of
    Window
    Leak-site posts discovered January 1 to September 28 of each year, 2021 to 2026
    Note
    UAE firms may name Dubai or the UAE in public descriptions more often than other Gulf firms. Read the split as a lead, not a risk ranking. Posts naming two or more Gulf states are counted separately.
    Computed from

    report/data/derived/ransomware/figures.json, figure gcc-posts-by-country, in the data download.

    RansomLook API, posts by year, 2021 to 2026 (data licensed CC BY 4.0), RansomLook open-source project.

People and fraud.

6 statistics, from chapter 4.

  1. 23 of 78 intrusion paths #paths-human-step

    A human step appears in 23 of 78 publicly documented intrusion paths and is the first step in 16.

    Numerator
    23
    Denominator
    78
    As of
    Window
    Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28
    Computed from

    report/data/derived/corpus/stats.json, in the data download.

  2. 20,877,000,000 USD #ic3-2025-total

    The FBI’s Internet Crime Complaint Center received 1,008,597 complaints reporting $20.877 billion in losses in 2025.

    Numerator and denominator
    None. A single figure.
    As of
    Window
    Complaints filed 2025-01-01 to 2025-12-31
    Note
    Losses are what complainants reported. Many victims do not file with the FBI.
    Primary source

    Internet Crime Report 2025, FBI Internet Crime Complaint Center, April 6, 2026. IC3 Complaints in 2025, PDF page 6.

    2025 complaint highlights: 1,008,597 complaints; $20.877 billion in losses; 26% increase in losses from 2024

    Checked October 30, 2026, live page.

  3. 14.6% of reported losses #ic3-bec-share

    Business email compromise accounted for 24,768 complaints and $3.05 billion in losses reported to the FBI for 2025, 14.6 percent of all reported losses.

    Numerator
    3,046,598,558
    Denominator
    20,877,000,000
    As of
    Window
    Complaints filed 2025-01-01 to 2025-12-31
    Note
    Bendings’ calculation from the IC3 three-year loss and complaint comparison tables, PDF page 26.
    Computed from

    report/data/derived/convergence/ic3_2025_crime_types.csv, in the data download. Figure ic3-bec-losses-2014-2025 is in report/data/derived/convergence/figures.json.

    Internet Crime Report 2025, FBI Internet Crime Complaint Center.

  4. 94 times #ic3-bec-vs-ransomware

    Business email compromise losses reported to the FBI for 2025 were 94 times reported ransomware losses, $3,046.6 million against $32.3 million.

    Numerator
    3,046,598,558
    Denominator
    32,320,105
    As of
    Window
    Complaints filed 2025-01-01 to 2025-12-31
    Note
    IC3 ransomware losses leave out downtime, recovery and lost business, and many ransomware victims never file with IC3, so the ratio shows where reported losses concentrate, not what ransomware costs.
    Computed from

    report/data/derived/convergence/ic3_2025_crime_types.csv, in the data download. Figure ic3-2025-people-fraud-vs-ransomware is in report/data/derived/convergence/figures.json.

    Internet Crime Report 2025, FBI Internet Crime Complaint Center.

  5. 72% of reported losses #ic3-deception-share

    Six crime types in which a person is deceived reported $15.0 billion to the FBI for 2025, 72 percent of all reported losses.

    Numerator
    15,008,136,845
    Denominator
    20,877,000,000
    As of
    Window
    Complaints filed 2025-01-01 to 2025-12-31
    Note
    The six are investment fraud, business email compromise, tech and customer support fraud, government impersonation, employment fraud and SIM swap. Most of these frauds cross one seam, from a deceived person to a payment.
    Computed from

    report/data/derived/convergence/ic3_2025_crime_types.csv, in the data download. Figure ic3-2025-people-fraud-vs-ransomware is in report/data/derived/convergence/figures.json.

    Internet Crime Report 2025, FBI Internet Crime Complaint Center.

  6. 76% decline #ic3-sim-swap-decline

    SIM swap losses reported to the FBI fell 76 percent, from $72.7 million on 2,026 complaints in 2022 to $17.4 million on 971 complaints in 2025.

    Numerator
    17,366,758
    Denominator
    72,652,571
    As of
    Window
    Complaints filed in 2025, compared with 2022
    Note
    Losses from accounts taken over after a SIM swap may be filed under other crime types, and the fall may reflect reporting as well as fewer attacks. A finding that cuts against the report’s thesis.
    Computed from

    report/data/derived/convergence/ic3_sim_swap.csv, in the data download. Figure ic3-sim-swap-2022-2025 is in report/data/derived/convergence/figures.json.

    Internet Crime Report 2025, FBI Internet Crime Complaint Center.

    Internet Crime Report 2023, FBI Internet Crime Complaint Center.

Gulf.

3 statistics, from chapters 4 and 7.

  1. 1,244,117,187 AED #uae-fiu-fraud-losses

    The UAE Financial Intelligence Unit estimated fraud losses of AED 1.24 billion for 2021 to 2023, from the fund recall data of 41 financial institutions.

    Numerator and denominator
    None. A single figure.
    As of
    Window
    2021-01-01 to 2023-12-31
    Note
    An estimate built from repatriation and fund recall data, not a count of incidents.
    Primary source

    Organized Financial Fraud (strategic analysis), UAE Financial Intelligence Unit, November 29, 2024. Key findings.

    AED 1,244,117,187 Estimated financial loss

    Repatriation amounts from (41) FIs

    Checked October 30, 2026, live page.

  2. 4 of 15 intrusion paths #gulf-corpus-sources

    Of the 15 Gulf intrusions in the incident corpus, 4 rest on press reports alone and 6 do not disclose the first step.

    Numerator
    4
    Denominator
    15
    As of
    Window
    Gulf intrusions with first access or disclosure from 2013-01-01 to 2026-09-28
    Note
    Gulf authorities publish few incident narratives, and no Gulf company in the corpus published an account of how the attackers got in. The Gulf and US cases rest on different kinds of source and compare only loosely.
    Computed from

    report/data/derived/corpus/stats.json, in the data download.

  3. 70% upper bound #dfsa-third-party-risk

    The Dubai Financial Services Authority’s Cyber Thematic Review 2024 found the firms it supervises below 70 percent in complying with third-party risk management practices.

    Numerator and denominator
    None. A single figure.
    As of
    Window
    Questionnaire responses for the 2024 review
    Note
    Built on a questionnaire to the firms the DFSA supervises. The review gives no exact figure below 70 percent.
    Primary source

    Cyber Thematic Review 2024, Dubai Financial Services Authority, 2024. Executive summary.

    On average, 80-90% of Firms implemented the governance practices mandated by the Rules, except compliance with third-party risk management practices which remains below 70%, consistent with 2022.

    Checked October 30, 2026, saved copy of September 28, 2026; live page refused the request.

SEC filings.

4 statistics, from chapters 5 and 7.

  1. 36 of 135 incidents #sec-third-party

    In 36 of 135 cybersecurity incidents US public companies disclosed on Form 8-K from December 18, 2023 to September 28, 2026, the company said the incident occurred at, or came through, a third party.

    Numerator
    36
    Denominator
    135
    As of
    Window
    Form 8-K and 8-K/A filings 2023-12-18 to 2026-09-28
    Note
    These are filers, not supplier events: seven filings concern one software supplier’s 2024 incident. In 99 of the 135, the first filing states no third-party path.
    Computed from

    report/data/derived/sec8k/stats.json, in the data download. Figure sec8k-third-party-share is in report/data/derived/sec8k/figures.json.

    EDGAR full-text search and filing archives, Form 8-K and 8-K/A cybersecurity incident disclosures, US Securities and Exchange Commission.

  2. 28 of 127 incidents #sec-supplier-events

    Counting each supplier’s breach once, at most 28 of 127 cybersecurity incidents disclosed on Form 8-K, 22 percent, came through a supplier.

    Numerator
    28
    Denominator
    127
    As of
    Window
    Form 8-K and 8-K/A filings 2023-12-18 to 2026-09-28
    Note
    Twenty-one of the 28 do not name the supplier and may overlap, so 28 is a ceiling.
    Computed from

    report/data/derived/sec8k/stats.json, in the data download.

    EDGAR full-text search and filing archives, Form 8-K and 8-K/A cybersecurity incident disclosures, US Securities and Exchange Commission.

  3. 33 of 112 incidents #sec-item-105

    After the SEC staff statement of May 21, 2024, 33 of 112 new cybersecurity incidents (29.5 percent) were first disclosed under Item 1.05 of Form 8-K, against 17 of 23 (73.9 percent) before it.

    Numerator
    33
    Denominator
    112
    As of
    Window
    Incidents first disclosed 2024-05-21 to 2026-09-28, compared with 2023-12-18 to 2024-05-20
    Note
    Quote it as 33 of 112 or 29.5 percent. The exact share is 29.46 percent, so rounding 29.5 again to 30 overstates it. The staff statement said incidents not yet judged material could be disclosed under Item 8.01.
    Computed from

    report/data/derived/sec8k/stats.json, in the data download. Figure sec8k-quarterly-by-item is in report/data/derived/sec8k/figures.json.

    EDGAR full-text search and filing archives, Form 8-K and 8-K/A cybersecurity incident disclosures, US Securities and Exchange Commission.

  4. 5 of 135 incidents #sec-named-attacker

    In only 5 of 135 cybersecurity incidents US public companies disclosed on Form 8-K did the first filing name the attacker or call it state-sponsored.

    Numerator
    5
    Denominator
    135
    As of
    Window
    Form 8-K and 8-K/A filings 2023-12-18 to 2026-09-28
    Note
    SEC rules let companies withhold technical detail.
    Computed from

    report/data/derived/sec8k/stats.json, in the data download.

    EDGAR full-text search and filing archives, Form 8-K and 8-K/A cybersecurity incident disclosures, US Securities and Exchange Commission.

Physical and OT.

4 statistics, from chapter 6.

  1. 1,900 incidents #fbi-atm-jackpotting

    The FBI knew of 1,900 ATM jackpotting incidents reported since 2020, more than 700 of them in 2025, with more than $20 million lost that year.

    Numerator and denominator
    None. A single figure.
    As of
    Window
    Incidents reported to the FBI from 2020 to 2026-02-19
    Note
    The count covers only what was reported to the FBI. Jackpotting attacks the machine and does not open a way into the bank’s network.
    Primary source

    Increase in Malware Enabled ATM Jackpotting Incidents Across United States (FLASH-20260219), Federal Bureau of Investigation, February 19, 2026. Summary.

    Out of 1,900 ATM jackpotting incidents reported since 2020, over 700 of them with more than $20 million in losses occurred in 2025 alone.

    Checked October 30, 2026, live page.

  2. 22 of 1,728 KEV entries #kev-physical-security-devices

    Of the 1,728 entries in CISA’s Known Exploited Vulnerabilities catalog, 22 (1.3 percent) are in cameras, video recorders or access-control systems, and 17 of the 22 were added from January 2024 onward.

    Numerator
    22
    Denominator
    1,728
    As of
    Window
    Whole catalog, 2021-11-03 to 2026-09-27, version 2026.09.27
    Note
    Found by keyword screen and hand review, so the method may undercount. Building management and industrial controllers are excluded.
    Computed from

    report/data/derived/convergence/kev_physical_security_devices.csv, in the data download. Figure kev-physical-security-devices-by-year is in report/data/derived/convergence/figures.json.

    Known Exploited Vulnerabilities catalog, JSON feed, catalogVersion 2026.09.27, Cybersecurity and Infrastructure Security Agency.

  3. 4 of 78 intrusion paths #paths-physical-step

    Only 4 of 78 publicly documented intrusion paths include a physical step, which may say more about what victims disclose than about attacks.

    Numerator
    4
    Denominator
    78
    As of
    Window
    Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28
    Computed from

    report/data/derived/corpus/stats.json, in the data download.

  4. 7 of 78 intrusions #paths-ot-by-decision

    In 7 of 78 publicly documented intrusions, harm reached operational technology only because the victim or someone downstream shut it down or could not run it, against 6 in which the adversary acted in it.

    Numerator
    7
    Denominator
    78
    As of
    Window
    Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28
    Note
    The two groups cannot overlap: harm by decision is counted only in domains the adversary never acted in. Seven against six in a chosen sample is too few to rank one above the other.
    Computed from

    report/data/derived/corpus/stats.json, in the data download.

AI.

7 statistics, from chapters 4, 8 and 9.

  1. 1% of reported BEC losses #ic3-bec-ai-share

    Only $30.3 million of the business email compromise losses reported to the FBI for 2025, about 1 percent, came from complaints with AI-related information.

    Numerator
    30,256,592
    Denominator
    3,046,598,558
    As of
    Window
    Complaints filed 2025-01-01 to 2025-12-31
    Note
    A floor: the tag records only what victims knew and reported.
    Computed from

    report/data/derived/convergence/figures.json, figure ic3-2025-bec-ai-share, in the data download.

    Internet Crime Report 2025, FBI Internet Crime Complaint Center.

    Primary source

    Internet Crime Report 2025, FBI Internet Crime Complaint Center, April 6, 2026. AI References by Complaint Loss, PDF page 42.

    BEC $30,256,592

    Checked October 30, 2026, live page.

  2. 22,364 complaints #ic3-ai-related

    The FBI’s Internet Crime Complaint Center received 22,364 complaints with AI-related information in 2025, reporting $893 million in losses.

    Numerator and denominator
    None. A single figure.
    As of
    Window
    Complaints filed 2025-01-01 to 2025-12-31
    Note
    Mostly investment fraud. The tag depends on what victims knew, so it is a lower bound.
    Primary source

    Internet Crime Report 2025, FBI Internet Crime Complaint Center, April 6, 2026. How AI Could Be Used in Frauds/Scams, PDF page 39.

    22,364 Complaints $893,346,472 Losses

    Checked October 30, 2026, live page.

  3. 10 of 122 evaluation runs #aisi-out-of-scope

    The UK AI Security Institute found that in 10 of 122 runs of one cyber evaluation, AI agents took 19 actions beyond the scope of the test against real people and organizations.

    Numerator
    10
    Denominator
    122
    As of
    Window
    Evaluation runs reviewed after the incident of July 2026
    Note
    A capability evaluation with safeguards deliberately reduced, not a commercial penetration test. The worst case was an attempt to get malicious code into a public open-source project, caught by the project’s maintainer.
    Primary source

    Incident Report: unsanctioned agent behaviour during cyber testing, UK AI Security Institute, August 4, 2026. What we found.

    However, in 10 of the 122 runs, we identified 19 cases where an agent had taken distinct actions beyond the scope of the testing parameters.

    Checked October 30, 2026, live page.

  4. 83 of 71,430 CVE records #nvd-prompt-injection

    CVE records in the National Vulnerability Database that name prompt injection rose from 2 in 2023 to 83 in the first nine months of 2026.

    Numerator
    83
    Denominator
    71,430
    As of
    Window
    CVEs published 2026-01-01 to 2026-09-28, compared with 2023
    Note
    Keyword counts are a floor: many prompt injection flaws are described in other words. The denominator is all non-rejected CVEs published in the window. An exact-phrase NVD API search gives 78 for 2026; the published 83 uses a regular expression over the NVD JSON feeds.
    Computed from

    report/data/derived/ai/seam_nvd_prompt_injection_by_year.csv, in the data download. Figure ai-nvd-prompt-injection-cves-by-year is in report/data/derived/ai/figures.json.

    CVE API 2.0, National Institute of Standards and Technology, National Vulnerability Database.

  5. 54 of 63 synthetic vulnerabilities found #darpa-aixcc

    In the final of DARPA’s AI Cyber Challenge in August 2025, competing AI systems found 54 of the 63 synthetic vulnerabilities planted across 54 million lines of code, and 18 real ones.

    Numerator
    54
    Denominator
    63
    As of
    Window
    Final Competition, August 2025
    Note
    DARPA first said 70 synthetic vulnerabilities were planted and corrected the figure to 63. The systems patched 43 of the 54.
    Primary source

    AI Cyber Challenge marks pivotal inflection point for cyber defense, DARPA, August 8, 2025. Deep Dive: Final Competition Findings, Highlights; Editor’s note.

    In total, competitors’ systems discovered 54 unique synthetic vulnerabilities in the Final Competition’s 63 challenges. Of those, they patched 43. In the Final Competition, teams also discovered 18 real, non-synthetic vulnerabilities

    teams’ systems attempted to identify and generate patches for synthetic vulnerabilities across 54 million lines of code.

    Upon further review, the competition administrator determined the Final Competition included 63 synthetic vulnerabilities. The number of vulnerabilities competitors’ systems discovered (54) remained unchanged, which means competitors discovered 86% of the synthetic vulnerabilities and patched 68%.

    Checked October 30, 2026, live page.

  6. 32 government services #uk-services-php

    The day after the UK NCSC’s alert of October 21, 2026 on PHP flaws, a UK minister told the House of Lords that 32 government services were unavailable and four partly unavailable, largely from precautionary measures.

    Numerator and denominator
    None. A single figure.
    As of
    Window
    Cross-government reporting on 2026-10-22
    Note
    Dated after the report’s data snapshot. The minister reported no confirmed compromise of central government systems.
    Primary source

    Cyber Security: PHP Vulnerability, House of Lords, volume 860, UK Parliament, Hansard, October 22, 2026. Minister’s answer, contribution 14.

    Currently, the information I have is that 32 government services are unavailable and four are partially unavailable. That is the latest cross-government reporting. That has resulted largely from precautionary measures

    Checked October 30, 2026, saved copy of October 22, 2026; live page refused the request.

  7. None of 47 testing regimes #regimes-ai-testing

    Of 50 testing regimes in the United States, the six Gulf states and nine benchmark schemes, none of the 47 coded regimes with public text sets rules for AI-driven testing, although 30 of the 47 mention automated scanning, continuous testing or the security of AI systems.

    Numerator
    0
    Denominator
    47
    As of
    Window
    Regulator texts as of 2026-09-28
    Note
    The other 3 of the 50 could not be coded on this point because their text is not public. No regime sets scope limits, human approval points or logging for an AI that runs the test.
    Computed from

    report/data/derived/regimes/matrix.csv, in the data download. Figure regimes-seam-matrix is in report/data/derived/regimes/figures.json.

Testing rules.

7 statistics, from chapter 9.

  1. 1 of 41 testing regimes #regimes-physical

    Of 41 US and Gulf testing regimes, only 1 requires a physical intrusion test, Saudi Arabia’s controls for operational technology, and only at the two highest facility levels.

    Numerator
    1
    Denominator
    41
    As of
    Window
    US and Gulf testing regimes as of 2026-09-28
    Note
    Eight more regimes require physical controls to be tested without anyone trying the door. Two of the 41 have no public text.
    Computed from

    report/data/derived/regimes/matrix.csv, in the data download. Figure regimes-seam-stance-us-gcc is in report/data/derived/regimes/figures.json.

    Primary source

    Operational Technology Cybersecurity Controls (OTCC-1:2022), National Cybersecurity Authority, Saudi Arabia, 2022. Subcontrol 2-13-1-9.

    Physical security capabilities and readiness must be periodically tested by performing simulation exercises (such as social engineering).

    Checked October 30, 2026, live page.

  2. 5 of 41 testing regimes #regimes-people

    Of 41 US and Gulf testing regimes, 5 require a test of people such as social engineering, and 12 more permit one.

    Numerator
    5
    Denominator
    41
    As of
    Window
    US and Gulf testing regimes as of 2026-09-28
    Note
    Permission is often only as awareness training. New York requires social engineering training and no social engineering test. Counted on the September coding as corrected on October 30, 2026; see the /testing-rules change log. Recounted from /testing-rules/data.json for the same 41 regimes, so report/data/derived/regimes/matrix.csv gives the PDF’s number. The PDF gives 13 that permit one.
    Computed from

    report/data/derived/regimes/matrix.csv, in the data download. Figure regimes-seam-stance-us-gcc is in report/data/derived/regimes/figures.json.

  3. 9 of 41 testing regimes #regimes-supplier

    Of 41 US and Gulf testing regimes, 9 put systems a supplier runs inside the test, 7 of 12 in the United States and 2 of 29 in the Gulf, where 11 rely on supplier assurance alone.

    Numerator
    9
    Denominator
    41
    As of
    Window
    US and Gulf testing regimes as of 2026-09-28
    Note
    Supplier assurance means contract rights, supplier reports or audits, with supplier systems outside the firm’s own test. The EU’s DORA is the only text found that lets a pooled test cross a supplier seam no single customer could authorize. Counted on the September coding as corrected on October 30, 2026; see the /testing-rules change log. Recounted from /testing-rules/data.json for the same 41 regimes, so report/data/derived/regimes/matrix.csv gives the PDF’s number. The PDF gives 10 in the Gulf.
    Computed from

    report/data/derived/regimes/matrix.csv, in the data download. Figure regimes-seam-stance-us-gcc is in report/data/derived/regimes/figures.json.

  4. 23 of 39 testing regimes #regimes-no-seam

    Of the 39 US and Gulf testing regimes with public text, 23 require none of the human, physical, supplier, OT or cloud seams.

    Numerator
    23
    Denominator
    39
    As of
    Window
    US and Gulf testing regimes as of 2026-09-28
    Note
    Counts measure texts, not strictness: a federal regulation and an accreditation standard each count once.
    Computed from

    report/data/derived/regimes/matrix.csv, in the data download. Figure regimes-seam-matrix is in report/data/derived/regimes/figures.json.

  5. 31 of 41 testing regimes #regimes-ot

    Of 41 US and Gulf testing regimes, 31 do not address operational technology.

    Numerator
    31
    Denominator
    41
    As of
    Window
    US and Gulf testing regimes as of 2026-09-28
    Note
    Kuwait’s central bank framework requires annual penetration tests of IoT and OT and names CCTV and building management systems.
    Computed from

    report/data/derived/regimes/matrix.csv, in the data download. Figure regimes-seam-stance-us-gcc is in report/data/derived/regimes/figures.json.

  6. None of 7 US financial testing regimes #regimes-threat-led

    None of seven US financial testing regimes requires threat-led red teaming, while Saudi Arabia’s central bank sets a cycle of at least once every three years and Kuwait’s at least once a year.

    Numerator
    0
    Denominator
    7
    As of
    Window
    US and Gulf testing regimes as of 2026-09-28
    Note
    US bank supervisors may expect red teaming at large banks in ways that are not public; none could be confirmed. A third-party copy of the Saudi framework limits the three-year cycle to systemically important banks; the central bank’s own rulebook copy applies it to every member organization.
    Computed from

    report/data/derived/regimes/matrix.csv, in the data download. Figure regimes-threat-led-red-team is in report/data/derived/regimes/figures.json.

    Primary sources

    Financial Entities Ethical Red-Teaming, Version 1.0, Saudi Central Bank (SAMA), May 2019. Section 1.6, Periodicity of the Red Teaming tests.

    Each Member Organization within the Financial Sector of Saudi Arabia and are regulated by SAMA should be tested, as a minimum once every three (3) years, in line with this framework.

    Checked October 30, 2026, live page.

    Cyber and Operational Resilience Framework for All Local Banks and Financial Institutions, v1.0, Central Bank of Kuwait, December 3, 2025. 5.13.2.7.

    Red teaming exercises shall be conducted at least once a year or as required based on changes to the threat landscape, critical systems, or regulatory requirements.

    Checked October 30, 2026, live page.

  7. 16 of 41 testing regimes #regimes-cross-border

    Of 41 US and Gulf testing regimes, 16 say something about other jurisdictions, and none provides for a joint, pooled or mutually recognized test.

    Numerator
    16
    Denominator
    41
    As of
    Window
    US and Gulf testing regimes as of 2026-09-28
    Note
    They extend rules to foreign branches, affiliates, functions or systems abroad, let foreign bank branches rely on head office functions, or limit where testers and others with access to the systems may sit. Counted on the September coding as corrected on October 30, 2026; see the /testing-rules change log. Recounted from /testing-rules/data.json for the same 41 regimes, so report/data/derived/regimes/matrix.csv gives the PDF’s number. The PDF gives 12.
    Computed from

    report/data/derived/regimes/matrix.csv, in the data download. Figure regimes-seam-matrix is in report/data/derived/regimes/figures.json.

Reporting deadlines.

8 statistics, from chapter 10.

  1. 1 hours #clocks-gulf-one-hour

    The central banks of Bahrain, Qatar and Kuwait expect a first report of a serious cyber incident within one hour.

    Numerator and denominator
    None. A single figure.
    As of
    Window
    Rules in force on 2026-09-28
    Note
    The shortest fixed first notice among the 10 financial regulators compared. The clocks start at different moments: occurrence or detection in Bahrain, identification in Qatar, discovery in Kuwait. Bahrain’s first report is a phone call. Kuwait’s one hour applies to high-severity incidents.
    Primary sources

    CBB Rulebook Volume 1 (Conventional Banks), Module OM, Central Bank of Bahrain, April 2022. OM-5.5.57.

    conventional bank licensees must contact the CBB, immediately (within one hour)

    Checked October 30, 2026, live page.

    Technology Risks (QCB cyber security circular for banks), Qatar Central Bank, January 2018. 8.2.10.

    All critical incidents must be reported to QCB and the relevant governmental authorities within 1 hour of identification.

    Checked October 30, 2026, live page.

    Cyber and Operational Resilience Framework for All Local Banks and Financial Institutions, v1.0, Central Bank of Kuwait, December 3, 2025. 8.2.2.1(b).

    b) High severity incidents shall be reported within (1) hour of discovery.

    Checked October 30, 2026, live page.

  2. 36 hours #clocks-us-36-hours

    US federal bank regulators require notice no later than 36 hours after a bank determines that a notification incident has occurred.

    Numerator and denominator
    None. A single figure.
    As of
    Window
    Rules in force on 2026-09-28
    Note
    The US clock waits for a determination the bank makes and records, so its hour 0 can fall later than a Gulf clock’s.
    Primary sources

    12 CFR part 225 subpart N, computer-security incident notification, Federal Reserve Board, via eCFR, May 1, 2022. 12 CFR 225.302.

    The Board must receive this notification from the banking organization as soon as possible and no later than 36 hours after the banking organization determines that a notification incident has occurred.

    Checked October 30, 2026, saved copy of September 28, 2026; live page refused the request.

    12 CFR part 53, computer-security incident notification, Office of the Comptroller of the Currency, via eCFR, May 1, 2022. 12 CFR 53.3.

    The OCC must receive this notification from the banking organization as soon as possible and no later than 36 hours after the banking organization determines that a notification incident has occurred.

    Checked October 30, 2026, saved copy of September 28, 2026; live page refused the request.

    12 CFR part 304 subpart C, computer-security incident notification, Federal Deposit Insurance Corporation, via eCFR, May 1, 2022. 12 CFR 304.23.

    The FDIC must receive this notification from the banking organization as soon as possible and no later than 36 hours after the banking organization determines that a notification incident has occurred.

    Checked October 30, 2026, saved copy of September 28, 2026; live page refused the request.

  3. 4 hours #clocks-uae-4-hours

    Since September 14, 2026, a bank licensed in the UAE must notify the central bank within 4 hours of an operational risk event that significantly affects its critical operations, and send a summary within 24 hours.

    Numerator and denominator
    None. A single figure.
    As of
    Window
    Rule in force from 2026-09-14
    Note
    The text does not say what event starts the four-hour clock.
    Primary source

    Circular No. 1/2026, Operational Risk Management Regulation, Central Bank of the UAE, February 3, 2026. Articles 15.2.1 and 15.2.2.

    15.2.1. Within 4 hours: notify the Central Bank of the events, including what Critical Operations are affected;

    15.2.2. Within 24 hours: provide the Central Bank with a summary report of the nature of the event

    Checked October 30, 2026, live page.

  4. 6 hours #clocks-oman-6-hours

    Oman’s central bank expects licensed institutions to report a cyber security incident immediately and not later than 6 hours after it has occurred and been identified.

    Numerator and denominator
    None. A single figure.
    As of
    Window
    Rules in force on 2026-09-28
    Note
    Oman also sets 12, 24 and 48-hour reports by severity, counted from occurrence.
    Primary source

    Cyber Security and Resilience Framework (CS&RF), Central Bank of Oman, September 2023. Section 3.3.14, item 4.

    immediately, not later than 6 hours on a 24/7 basis, when a cyber security incident has occurred and identified

    Checked September 28, 2026, OCR of the saved scan; the PDF is image-only, so the live copy cannot be text-matched.

  5. 72 hours #clocks-nydfs-72-hours

    New York’s financial regulator requires notice no later than 72 hours after a covered entity determines that a cybersecurity incident has occurred at the entity, its affiliates or a third-party service provider.

    Numerator and denominator
    None. A single figure.
    As of
    Window
    Rules in force on 2026-09-28
    Note
    Because the rule reaches affiliates, a Gulf affiliate’s notice to its own central bank can prompt a New York decision. Paying a ransom adds a 24-hour notice.
    Primary source

    23 NYCRR Part 500 Cybersecurity Regulation, New York State Department of Financial Services, November 1, 2023. 23 NYCRR 500.17(a)(1).

    as promptly as possible but in no event later than 72 hours after determining that a cybersecurity incident has occurred at the covered entity, its affiliates, or a third-party service provider.

    Checked October 30, 2026, saved copy of September 28, 2026; live page refused the request.

  6. 9 of 96 notification duties #clocks-start-not-stated

    Of 96 incident notification duties in US, Gulf, EU and UK texts that could bind a banking group, 9 do not say what event starts the clock.

    Numerator
    9
    Denominator
    96
    As of
    Window
    Regulator texts as of 2026-09-28
    Note
    All nine are in Gulf texts. Awareness or belief starts 34 duties, detection, identification or discovery 18, a determination or classification 12 and occurrence 10. Not legal advice.
    Computed from

    report/data/derived/clocks/summary.json, in the data download. Figure clocks-trigger-families is in report/data/derived/clocks/figures.json.

  7. 40 hours after detection #clocks-scenario-first-deadlines

    In a hypothetical ransomware incident at a group with banks in the United States, Saudi Arabia, the UAE and Bahrain, the first deadline falls in Bahrain at hour 1 and the first US deadline at hour 40.

    Numerator and denominator
    None. A single figure.
    As of
    Window
    Hypothetical scenario on rules in force on 2026-09-28
    Note
    A scenario Bendings built, with every assumption in scenario.csv. The US determination is assumed at hour 4. Of the 26 in-force clocks that apply without conditions, 22 start within the first 30 hours, at 13 authorities in four countries.
    Computed from

    report/data/derived/clocks/scenario.csv, in the data download. Figure clocks-scenario-timeline is in report/data/derived/clocks/figures.json.

  8. 72 hours #clocks-data-protection-72

    Saudi Arabia, Bahrain, Oman, the ADGM and the Qatar Financial Centre all set 72 hours for personal data breach notice, the same as the GDPR, while the UAE federal law has no period in force.

    Numerator and denominator
    None. A single figure.
    As of
    Window
    Data protection texts as of 2026-09-28
    Note
    Qatar’s onshore 72 hours comes from official guidance, not the statute. The UAE federal law leaves the period to executive regulations that could not be found on official portals.
    Computed from

    report/data/derived/clocks/clocks.csv, in the data download. Figure clocks-data-breach-authority is in report/data/derived/clocks/figures.json.

Posture.

7 statistics, from chapter 11.

  1. 147 of 159 institutions #posture-dmarc

    Of 159 US and Gulf regulators and banks measured on September 28, 2026, 147 (92 percent) told mail receivers to quarantine or reject mail that fails DMARC, including all 12 US authorities.

    Numerator
    147
    Denominator
    159
    As of
    Window
    Measured once, 2026-09-28 17:02 to 17:14 UTC
    Note
    A finding that cuts against the report’s thesis: the email seam is mostly closed at the exact domain. DMARC does nothing about lookalike domains, subsidiaries or suppliers that send for the institution. Results are reported in aggregate only.
    Computed from

    report/data/derived/posture/aggregates.json, in the data download. Figure posture-dmarc-policy is in report/data/derived/posture/figures.json.

  2. 67 of 79 banks #posture-spf-strict

    Of 79 Gulf banks, 67 end their SPF record with the strict -all instruction, against 27 of 50 large US banks.

    Numerator
    67
    Denominator
    79
    As of
    Window
    Measured once, 2026-09-28 17:02 to 17:14 UTC
    Note
    The US list holds only the 50 largest bank holding companies and the Gulf list every locally incorporated bank, so the two are not like for like. Three Gulf bank records need more than the 10 DNS lookups RFC 7208 allows.
    Computed from

    report/data/derived/posture/aggregates.json, in the data download. Figure posture-gcc-banks-matrix is in report/data/derived/posture/figures.json.

  3. 7 of 159 institutions #posture-security-txt

    Only 7 of 159 US and Gulf regulators and banks measured served a security.txt file telling an outsider where to report a flaw, and 3 of those files were valid under RFC 9116.

    Numerator
    7
    Denominator
    159
    As of
    Window
    Measured once, 2026-09-28 17:02 to 17:14 UTC
    Note
    Only the standard location on the main web host was tested. Absence means not at the standard place, not unreachable. All 11 US authority .gov domains list a security contact in CISA’s registry data.
    Computed from

    report/data/derived/posture/aggregates.json, in the data download. Figure posture-security-txt is in report/data/derived/posture/figures.json.

  4. None of 61 Gulf banks #posture-security-txt-banks

    None of the 61 Gulf bank websites that could be read served a security.txt file, against 5 of 50 large US banks, 2 of them valid.

    Numerator
    0
    Denominator
    61
    As of
    Window
    Measured once, 2026-09-28 17:02 to 17:14 UTC
    Note
    Bot protection, TLS errors or timeouts stopped a clean read at 18 of the 79 Gulf banks. Banks may run a disclosure page or bug bounty elsewhere.
    Computed from

    report/data/derived/posture/aggregates.json, in the data download. Figure posture-security-txt is in report/data/derived/posture/figures.json.

  5. 22 of 129 banks #posture-bot-block

    Bot protection blocked a plain request for the security.txt file at 22 of 129 banks, 7 of 50 in the United States and 15 of 79 in the Gulf.

    Numerator
    22
    Denominator
    129
    As of
    Window
    Measured once, 2026-09-28 17:02 to 17:14 UTC
    Note
    Requests named their sender and came from one network location in the United States, so part of the gap between regions may reflect where the requests came from.
    Computed from

    report/data/derived/posture/aggregates.json, in the data download. Figure posture-security-txt is in report/data/derived/posture/figures.json.

  6. 17 of 79 Gulf banks #posture-dnssec

    DNSSEC validated for 9 of 12 US authorities but for 11 of 50 large US banks and 17 of 79 Gulf banks, 9 of them among the 14 in Saudi Arabia.

    Numerator
    17
    Denominator
    79
    As of
    Window
    Measured once, 2026-09-28 17:02 to 17:14 UTC
    Note
    Validated means a DS record at the parent zone and an authenticated answer from two public validating resolvers.
    Computed from

    report/data/derived/posture/aggregates.json, in the data download. Figure posture-dnssec is in report/data/derived/posture/figures.json.

  7. 5 of 159 institutions #posture-mta-sts

    Only 5 of 159 US and Gulf regulators and banks measured published an MTA-STS policy in enforce mode, all of them in Oman.

    Numerator
    5
    Denominator
    159
    As of
    Window
    Measured once, 2026-09-28 17:02 to 17:14 UTC
    Computed from

    report/data/derived/posture/aggregates.json, in the data download. Figure posture-mta-sts is in report/data/derived/posture/figures.json.

How to cite.

Quote the statement with its denominator and window, and link to the statistic itself. Each link ends in the statistic’s id, the same id as in the downloads.

A statistic
Bendings (2026). The Seam Report 2026, chapter 2, statistic paths-steps-inside-some-test. Data snapshot September 28, 2026. https://bendings.com/research/statistics#paths-steps-inside-some-test
A quoted figure
Of the 69, 13 are quoted from another body: they show a primary source and no “Computed from” line. Cite that body’s document, given with each one with its section and its exact words. This page only restates them.
The report
Bendings (2026). The Seam Report 2026: Where intrusions bend between the systems you test. October edition. Data snapshot September 28, 2026. https://bendings.com/researchBibTeXRIS
Downloads
The CSV has one row per statistic. The JSON adds each source’s section, quote and check date.Statistics (CSV)Statistics (JSON)Report (PDF)Data and code

How this list was made.

Headline figures from the report, checked again against their data and sources on October 30, 2026.

What is here
The list holds 69 figures: 56 computed by Bendings from public data and 13 quoted from a primary source.
How they were checked
Each computed figure was recomputed from the file named under “Computed from” and matched to the number printed in the report, except where “Where this page differs from the PDF” says otherwise. The three testing-rule figures listed there are recounted from /testing-rules/data.json for the same 41 US and Gulf regimes. Each quote was matched word for word against its source: the live page where it answered, otherwise the copy saved for the report. Each quoted source says which.
Left out
Figures about a single named organization, figures sourced only to a security vendor or an AI developer, figures with no stated method, and a rolling ranking that has moved since the snapshot.
Where this page differs from the PDF
The PDF uses all 50 regimes as the denominator for the AI-driven testing figure. Of the 50, 3 have no public text on this point, so this page uses the 47 that do. The PDF rounds the SEC Item 1.05 share to a whole percent. This page gives 33 of 112, 29.5 percent. Three testing-rule figures use the October 30 corrections to the September coding: cross-border 16 of 41 (PDF 12), 12 permit a test of people (PDF 13), 11 Gulf regimes with supplier assurance only (PDF 10).
Dates
The report’s data snapshot is September 28, 2026. Where a quoted figure is dated later, its own as-of date governs.
Built with
report/scripts/statistics/build_stats.py writes report/data/derived/statistics/statistics.json from the report’s derived data. This page reads that file.

Discuss a seam-led test.

Write from your organization’s email address. Tell us what is in scope, your deadline and who can authorize testing. Leave sensitive details out of the first message.

Email engage@bendings.com What happens next