{ "title": "Statistics from The Seam Report 2026", "edition": "2026", "snapshot": "2026-09-28", "url": "https://bendings.com/research/statistics", "report": "https://bendings.com/research/seam-report-2026.pdf", "data": "https://bendings.com/research/seam-report-2026-data.zip", "count": 69, "statistics": [ { "id": "paths-steps-inside-some-test", "group": "Intrusion paths", "statement": "In 70 of 78 publicly documented intrusion paths from 2013 to 2026, every known step on the victim's own systems fell in a domain that some single-domain test covers.", "value": 70, "numerator": 70, "denominator": 78, "unit": "intrusion paths", "window": "Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 2, "title": "Tests cover the steps and miss the joins", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=paths" }, "basis": { "figure_id": null, "data_file": "report/data/derived/corpus/stats.json", "public_data": [ { "title": "Bendings incident corpus: 78 publicly documented intrusions, 2013 to September 2026, coded from primary sources", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "A purposive sample of well-documented cases, not a random sample of all intrusions. Counts describe these 78 cases only.", "url": "https://bendings.com/research/statistics#paths-steps-inside-some-test" }, { "id": "paths-red-team-end-to-end", "group": "Intrusion paths", "statement": "A typical red team scope could have followed 33 of 78 publicly documented intrusion paths from first step to last.", "value": 33, "numerator": 33, "denominator": 78, "unit": "intrusion paths", "window": "Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 2, "title": "Tests cover the steps and miss the joins", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=paths" }, "basis": { "figure_id": "corpus-single-test-coverage", "data_file": "report/data/derived/corpus/figures.json", "public_data": [ { "title": "Bendings incident corpus: 78 publicly documented intrusions, 2013 to September 2026, coded from primary sources", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "Typical scope covers the victim's own human, identity, edge, internal IT, cloud and value-transfer systems.", "url": "https://bendings.com/research/statistics#paths-red-team-end-to-end" }, { "id": "paths-left-red-team-scope", "group": "Intrusion paths", "statement": "Of 78 publicly documented intrusion paths, 45 left a typical red team scope, 38 of them because a step ran through systems or people the victim did not own, which the victim cannot authorize a tester to touch.", "value": 45, "numerator": 45, "denominator": 78, "unit": "intrusion paths", "window": "Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 2, "title": "Tests cover the steps and miss the joins", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=paths" }, "basis": { "figure_id": "corpus-outside-red-team", "data_file": "report/data/derived/corpus/figures.json", "public_data": [ { "title": "Bendings incident corpus: 78 publicly documented intrusions, 2013 to September 2026, coded from primary sources", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "A path can leave the scope for more than one reason: 6 reached operational technology, 4 needed a physical step and 1 ran through an AI system.", "url": "https://bendings.com/research/statistics#paths-left-red-team-scope" }, { "id": "paths-single-domain-tests", "group": "Intrusion paths", "statement": "Single-domain tests could have followed at most 9 of 78 publicly documented intrusion paths from first step to last, a count that runs from 4 to 28 under other reasonable definitions.", "value": 9, "numerator": 9, "denominator": 78, "unit": "intrusion paths", "window": "Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 2, "title": "Tests cover the steps and miss the joins", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=paths" }, "basis": { "figure_id": "corpus-single-test-coverage", "data_file": "report/data/derived/corpus/figures.json", "public_data": [ { "title": "Bendings incident corpus: 78 publicly documented intrusions, 2013 to September 2026, coded from primary sources", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "Five of the 9 qualify only because the sources do not say how the adversary got in.", "url": "https://bendings.com/research/statistics#paths-single-domain-tests" }, { "id": "paths-through-another-owner", "group": "Intrusion paths", "statement": "Of 78 publicly documented intrusion paths, 38 included a step on systems or people the victim did not own, such as a supplier, a customer or an employee's personal account.", "value": 38, "numerator": 38, "denominator": 78, "unit": "intrusion paths", "window": "Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 2, "title": "Tests cover the steps and miss the joins", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=paths" }, "basis": { "figure_id": "corpus-other-owner-by-era", "data_file": "report/data/derived/corpus/stats.json", "public_data": [ { "title": "Bendings incident corpus: 78 publicly documented intrusions, 2013 to September 2026, coded from primary sources", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "The 95 percent Wilson interval runs from 38 to 60 percent. In 9 of the 38 the first step at a supplier or customer is inferred, not documented.", "url": "https://bendings.com/research/statistics#paths-through-another-owner" }, { "id": "paths-identity-bends", "group": "Intrusion paths", "statement": "Of the 151 changes of domain in 78 publicly documented intrusion paths, 98 ran into or out of identity.", "value": 98, "numerator": 98, "denominator": 151, "unit": "changes of domain", "window": "Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 2, "title": "Tests cover the steps and miss the joins", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=paths" }, "basis": { "figure_id": "corpus-transitions", "data_file": "report/data/derived/corpus/transitions.csv", "public_data": [ { "title": "Bendings incident corpus: 78 publicly documented intrusions, 2013 to September 2026, coded from primary sources", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "Part of identity's weight comes from the notation, which codes a stolen password used on a VPN as a step in identity. Identity is the domain on which the two coders agreed least.", "url": "https://bendings.com/research/statistics#paths-identity-bends" }, { "id": "paths-three-domains", "group": "Intrusion paths", "statement": "Of 78 publicly documented intrusion paths, 40 touched three or more domains, and the median path had three steps.", "value": 40, "numerator": 40, "denominator": 78, "unit": "intrusion paths", "window": "Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 2, "title": "Tests cover the steps and miss the joins", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=paths" }, "basis": { "figure_id": null, "data_file": "report/data/derived/corpus/stats.json", "public_data": [ { "title": "Bendings incident corpus: 78 publicly documented intrusions, 2013 to September 2026, coded from primary sources", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "Steps are counted after merging consecutive steps in the same domain with the same owner. Bend counts follow from the coding rules and from how much the sources say.", "url": "https://bendings.com/research/statistics#paths-three-domains" }, { "id": "paths-harm-by-decision", "group": "Intrusion paths", "statement": "In 9 of 78 publicly documented intrusions, harm reached a domain the adversary never touched because the victim or someone downstream shut systems down or could not run without them, and 7 of the 9 reached operational technology.", "value": 9, "numerator": 9, "denominator": 78, "unit": "intrusions", "window": "Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 2, "title": "Tests cover the steps and miss the joins", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=paths" }, "basis": { "figure_id": null, "data_file": "report/data/derived/corpus/stats.json", "public_data": [ { "title": "Bendings incident corpus: 78 publicly documented intrusions, 2013 to September 2026, coded from primary sources", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "url": "https://bendings.com/research/statistics#paths-harm-by-decision" }, { "id": "paths-harm-other-owners", "group": "Intrusion paths", "statement": "In 48 of 78 publicly documented intrusions, harm reached owners other than the victim, most often customers.", "value": 48, "numerator": 48, "denominator": 78, "unit": "intrusions", "window": "Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 2, "title": "Tests cover the steps and miss the joins", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=paths" }, "basis": { "figure_id": null, "data_file": "report/data/derived/corpus/stats.json", "public_data": [ { "title": "Bendings incident corpus: 78 publicly documented intrusions, 2013 to September 2026, coded from primary sources", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "Other owners include customers, who may be people rather than organizations.", "url": "https://bendings.com/research/statistics#paths-harm-other-owners" }, { "id": "paths-owner-seams-by-era", "group": "Intrusion paths", "statement": "Paths through another owner were 9 of 21 from 2013 to 2018, 10 of 18 from 2019 to 2022 and 19 of 39 from 2023 to 2026, too few cases to show a trend in either direction.", "value": 19, "numerator": 19, "denominator": 39, "unit": "intrusion paths", "window": "Intrusions with first access or disclosure from 2023-01-01 to 2026-09-28, compared with 2013 to 2018 and 2019 to 2022", "as_of": "2026-09-28", "chapter": { "number": 2, "title": "Tests cover the steps and miss the joins", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=paths" }, "basis": { "figure_id": "corpus-other-owner-by-era", "data_file": "report/data/derived/corpus/figures.json", "public_data": [ { "title": "Bendings incident corpus: 78 publicly documented intrusions, 2013 to September 2026, coded from primary sources", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "A finding that cuts against the report's thesis. One case moves an era's share by three to six points.", "url": "https://bendings.com/research/statistics#paths-owner-seams-by-era" }, { "id": "paths-through-supplier", "group": "Intrusion paths", "statement": "Of 78 publicly documented intrusion paths, 26 passed through a supplier, about one in three.", "value": 26, "numerator": 26, "denominator": 78, "unit": "intrusion paths", "window": "Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 5, "title": "Supplier seams are crossed often, tested rarely", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=suppliers" }, "basis": { "figure_id": null, "data_file": "report/data/derived/corpus/stats.json", "public_data": [ { "title": "Bendings incident corpus: 78 publicly documented intrusions, 2013 to September 2026, coded from primary sources", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "The corpus codes a campaign such as one supply-chain compromise once, however many victims it had.", "url": "https://bendings.com/research/statistics#paths-through-supplier" }, { "id": "kev-security-controls-share", "group": "Edge devices", "statement": "Among recently published flaws, products sold as security controls rose from 10.7 percent (13 of 122) of CISA's Known Exploited Vulnerabilities additions in January to September 2022 to 17.6 percent (36 of 204) in the same months of 2026.", "value": 17.6, "numerator": 36, "denominator": 204, "unit": "percent of recently published KEV additions", "window": "KEV additions 2026-01-01 to 2026-09-28, compared with 2022-01-01 to 2022-09-28", "as_of": "2026-09-28", "chapter": { "number": 3, "title": "The controls at the edge are now a way in", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=edge" }, "basis": { "figure_id": "kev-recent-cves-share-by-year", "data_file": "report/data/derived/kev/summary.json", "public_data": [ { "title": "Known Exploited Vulnerabilities catalog, JSON feed, catalogVersion 2026.09.27", "publisher": "Cybersecurity and Infrastructure Security Agency", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" }, { "title": "CVE API 2.0", "publisher": "National Institute of Standards and Technology, National Vulnerability Database", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0" } ] }, "computed": true, "note": "Recently published means a CVE published in the year of listing or the year before, which removes CISA's 2022 backlog of old flaws. Security controls include firewalls, VPN gateways, email and web security gateways, endpoint protection, network access control and privileged access management.", "url": "https://bendings.com/research/statistics#kev-security-controls-share" }, { "id": "kev-security-controls-2026-count", "group": "Edge devices", "statement": "From January 1 to September 28, 2026, CISA added 37 flaws in products sold as security controls to its Known Exploited Vulnerabilities catalog, more than in any full year from 2022 to 2025 (34, 13, 24 and 35).", "value": 37, "numerator": 37, "denominator": 244, "unit": "KEV additions", "window": "KEV additions 2026-01-01 to 2026-09-28, compared with full years 2022 to 2025", "as_of": "2026-09-28", "chapter": { "number": 3, "title": "The controls at the edge are now a way in", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=edge" }, "basis": { "figure_id": null, "data_file": "report/data/derived/kev/summary.json", "public_data": [ { "title": "Known Exploited Vulnerabilities catalog, JSON feed, catalogVersion 2026.09.27", "publisher": "Cybersecurity and Infrastructure Security Agency", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" } ] }, "computed": true, "note": "The 37 are 15.2 percent of the 244 additions in the window. The catalog snapshot's last addition is dated 2026-09-27.", "url": "https://bendings.com/research/statistics#kev-security-controls-2026-count" }, { "id": "kev-backlog-correction", "group": "Edge devices", "statement": "Counting all additions, the security-control share of CISA's exploited list went from 5.4 percent (28 of 521) in January to September 2022 to 15.2 percent (37 of 244) in 2026, a near tripling that shrinks to a rise of about two thirds once CISA's 2022 backlog of older flaws is removed.", "value": 15.2, "numerator": 37, "denominator": 244, "unit": "percent of KEV additions", "window": "KEV additions 2026-01-01 to 2026-09-28, compared with 2022-01-01 to 2022-09-28", "as_of": "2026-09-28", "chapter": { "number": 3, "title": "The controls at the edge are now a way in", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=edge" }, "basis": { "figure_id": "kev-recent-cves-share-by-year", "data_file": "report/data/derived/kev/summary.json", "public_data": [ { "title": "Known Exploited Vulnerabilities catalog, JSON feed, catalogVersion 2026.09.27", "publisher": "Cybersecurity and Infrastructure Security Agency", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" }, { "title": "CVE API 2.0", "publisher": "National Institute of Standards and Technology, National Vulnerability Database", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0" } ] }, "computed": true, "note": "In January to September 2022, 72.4 percent of additions were flaws published two or more years earlier, against 14.3 percent in 2026. A finding that cuts against the raw trend.", "url": "https://bendings.com/research/statistics#kev-backlog-correction" }, { "id": "kev-internet-facing-share", "group": "Edge devices", "statement": "Counting only recently published flaws, products built to face the internet went from 29.5 percent (36 of 122) of CISA's exploited-list additions in January to September 2022 to 38.7 percent (79 of 204) in the same months of 2026.", "value": 38.7, "numerator": 79, "denominator": 204, "unit": "percent of recently published KEV additions", "window": "KEV additions 2026-01-01 to 2026-09-28, compared with 2022-01-01 to 2022-09-28", "as_of": "2026-09-28", "chapter": { "number": 3, "title": "The controls at the edge are now a way in", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=edge" }, "basis": { "figure_id": "kev-recent-cves-share-by-year", "data_file": "report/data/derived/kev/summary.json", "public_data": [ { "title": "Known Exploited Vulnerabilities catalog, JSON feed, catalogVersion 2026.09.27", "publisher": "Cybersecurity and Infrastructure Security Agency", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" }, { "title": "CVE API 2.0", "publisher": "National Institute of Standards and Technology, National Vulnerability Database", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0" } ] }, "computed": true, "note": "Internet-facing by design adds mail servers, managed file transfer and remote support servers to edge appliances. Moving every debatable product to the other side of the line leaves the 2026 share of all additions between 32.0 and 40.6 percent.", "url": "https://bendings.com/research/statistics#kev-internet-facing-share" }, { "id": "kev-lag-security-controls", "group": "Edge devices", "statement": "Flaws in products sold as security controls reached CISA's exploited list a median of 2 days after publication, against 10 days for all 651 flaws published from 2022 to 2025.", "value": 2, "numerator": null, "denominator": 80, "unit": "days, median", "window": "CVEs published 2022-01-01 to 2025-12-31 and added to the KEV by 2026-09-27", "as_of": "2026-09-28", "chapter": { "number": 3, "title": "The controls at the edge are now a way in", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=edge" }, "basis": { "figure_id": "kev-days-publication-to-kev-by-category", "data_file": "report/data/derived/kev/summary.json", "public_data": [ { "title": "Known Exploited Vulnerabilities catalog, JSON feed, catalogVersion 2026.09.27", "publisher": "Cybersecurity and Infrastructure Security Agency", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" }, { "title": "CVE API 2.0", "publisher": "National Institute of Standards and Technology, National Vulnerability Database", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0" } ] }, "computed": true, "note": "Of the 80, 30 (37.5 percent) were listed on or before the day of publication. A short lag mostly means the flaw was disclosed because it was already being exploited.", "url": "https://bendings.com/research/statistics#kev-lag-security-controls" }, { "id": "kev-lag-edge", "group": "Edge devices", "statement": "Flaws in network edge appliances reached CISA's exploited list a median of 5 days after publication (80 flaws), against 10 days for all 651 flaws published from 2022 to 2025.", "value": 5, "numerator": null, "denominator": 80, "unit": "days, median", "window": "CVEs published 2022-01-01 to 2025-12-31 and added to the KEV by 2026-09-27", "as_of": "2026-09-28", "chapter": { "number": 3, "title": "The controls at the edge are now a way in", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=edge" }, "basis": { "figure_id": "kev-days-publication-to-kev-by-category", "data_file": "report/data/derived/kev/summary.json", "public_data": [ { "title": "Known Exploited Vulnerabilities catalog, JSON feed, catalogVersion 2026.09.27", "publisher": "Cybersecurity and Infrastructure Security Agency", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" }, { "title": "CVE API 2.0", "publisher": "National Institute of Standards and Technology, National Vulnerability Database", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0" } ] }, "computed": true, "note": "Internet-facing products as a group were not faster: a median of 11.5 days (206 flaws) against 9 days for the rest (445).", "url": "https://bendings.com/research/statistics#kev-lag-edge" }, { "id": "kev-epss-below-01", "group": "Edge devices", "statement": "The day before CISA listed them, 447 of 611 scored additions to its exploited list (73.2 percent) had an EPSS prediction score below 0.1.", "value": 73.2, "numerator": 447, "denominator": 611, "unit": "percent of scored KEV additions", "window": "KEV additions 2023-03-07 to 2026-09-27", "as_of": "2026-09-28", "chapter": { "number": 3, "title": "The controls at the edge are now a way in", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=edge" }, "basis": { "figure_id": "kev-epss-day-before-addition", "data_file": "report/data/derived/kev/summary.json", "public_data": [ { "title": "Known Exploited Vulnerabilities catalog, JSON feed, catalogVersion 2026.09.27", "publisher": "Cybersecurity and Infrastructure Security Agency", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" }, { "title": "EPSS API, daily scores", "publisher": "FIRST", "url": "https://api.first.org/data/v1/epss" } ] }, "computed": true, "note": "Of 843 additions in the window, 232 had no score yet, mostly because they were published that day or later. A low score the day before listing does not prove the model wrong about the next 30 days.", "url": "https://bendings.com/research/statistics#kev-epss-below-01" }, { "id": "kev-forensic-triage", "group": "Edge devices", "statement": "From July 1 to September 27, 2026, CISA marked 69 of 98 additions to its exploited list (70.4 percent) for forensic triage, telling federal agencies to check for compromise as well as patch within three days.", "value": 70.4, "numerator": 69, "denominator": 98, "unit": "percent of KEV additions", "window": "KEV additions 2026-07-01 to 2026-09-27", "as_of": "2026-09-28", "chapter": { "number": 3, "title": "The controls at the edge are now a way in", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=edge" }, "basis": { "figure_id": null, "data_file": "report/data/derived/kev/summary.json", "public_data": [ { "title": "Known Exploited Vulnerabilities catalog, JSON feed, catalogVersion 2026.09.27", "publisher": "Cybersecurity and Infrastructure Security Agency", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" } ], "sources": [ { "title": "Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk", "publisher": "Cybersecurity and Infrastructure Security Agency", "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "section": "Note to Table 1: Remediation Timelines", "quote": "The text “& forensic triage” means that the agency must complete remediation or mitigation action within the timeline (three days) and carry out a forensic triage of the asset to assess whether the system is compromised.", "date": "2026-06-10", "secondary": false, "checked": "2026-10-30, live page" } ] }, "computed": true, "note": "Three months is a short record. The share was 32 of 39 internet-facing additions and 37 of 59 others.", "url": "https://bendings.com/research/statistics#kev-forensic-triage" }, { "id": "kev-ransomware-security-controls", "group": "Ransomware", "statement": "CISA marks known ransomware use on 35.7 percent (51 of 143) of the flaws it has added to its exploited list since 2022 in products sold as security controls, against 19.5 percent (277 of 1,417) of all additions.", "value": 35.7, "numerator": 51, "denominator": 143, "unit": "percent of KEV additions", "window": "KEV additions from 2022-01-01 to 2026-09-27, catalog version 2026.09.27", "as_of": "2026-09-28", "chapter": { "number": 3, "title": "The controls at the edge are now a way in", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=edge" }, "basis": { "figure_id": "kev-ransomware-share-by-category", "data_file": "report/data/derived/kev/summary.json", "public_data": [ { "title": "Known Exploited Vulnerabilities catalog, JSON feed, catalogVersion 2026.09.27", "publisher": "Cybersecurity and Infrastructure Security Agency", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" } ] }, "computed": true, "note": "CISA can add the mark after listing, so older entries have had longer to collect it. Only backup and storage products, at 51.4 percent (18 of 35), carry it clearly more often. Managed file transfer and file sharing is level at 35.7 percent (10 of 28).", "url": "https://bendings.com/research/statistics#kev-ransomware-security-controls" }, { "id": "gulf-leak-share", "group": "Ransomware", "statement": "Under a broad country rule, ransomware leak-site posts naming Gulf organizations went from 8 of 2,733 (0.29 percent) in January to September 2022 to 68 of 7,790 (0.87 percent) in the same months of 2026.", "value": 0.87, "numerator": 68, "denominator": 7790, "unit": "percent of leak-site posts", "window": "Leak-site posts discovered 2026-01-01 to 2026-09-28, compared with 2022-01-01 to 2022-09-28", "as_of": "2026-09-28", "chapter": { "number": 7, "title": "In the Gulf, a cloud region has a street address", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=gulf" }, "basis": { "figure_id": "gcc-share-of-global-posts", "data_file": "report/data/derived/ransomware/yearly_counts.csv", "public_data": [ { "title": "RansomLook API, posts by year, 2021 to 2026 (data licensed CC BY 4.0)", "publisher": "RansomLook open-source project", "url": "https://www.ransomlook.io/about" } ] }, "computed": true, "note": "Much of the rise comes from the tracker: posts carrying a description went from 17 percent in 2022 to 74 percent in 2026, and the broad rule mostly reads descriptions. The strict rule shows no steady trend. Posts are criminal claims, not confirmed incidents, and the country assignment is Bendings'.", "url": "https://bendings.com/research/statistics#gulf-leak-share" }, { "id": "gulf-leak-share-described", "group": "Ransomware", "statement": "Among ransomware leak-site posts that carry a description, the broad Gulf share went from 3 of 475 (0.63 percent) in January to September 2022 to 62 of 5,737 (1.08 percent) in 2026, and it fell in 2023 and again in 2025.", "value": 1.08, "numerator": 62, "denominator": 5737, "unit": "percent of leak-site posts with a description", "window": "Leak-site posts discovered 2026-01-01 to 2026-09-28, compared with 2022-01-01 to 2022-09-28", "as_of": "2026-09-28", "chapter": { "number": 7, "title": "In the Gulf, a cloud region has a street address", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=gulf" }, "basis": { "figure_id": "gcc-share-of-global-posts", "data_file": "report/data/derived/ransomware/yearly_counts.csv", "public_data": [ { "title": "RansomLook API, posts by year, 2021 to 2026 (data licensed CC BY 4.0)", "publisher": "RansomLook open-source project", "url": "https://www.ransomlook.io/about" } ] }, "computed": true, "note": "Read as a modest rise in how often Gulf organizations are named, with no steady trend.", "url": "https://bendings.com/research/statistics#gulf-leak-share-described" }, { "id": "gulf-leak-uae", "group": "Ransomware", "statement": "Across the January to September windows of 2021 to 2026, UAE organizations were named in 82 of 162 ransomware leak-site posts naming Gulf organizations under the broad rule, and in 37 of 68 in 2026.", "value": 82, "numerator": 82, "denominator": 162, "unit": "leak-site posts", "window": "Leak-site posts discovered January 1 to September 28 of each year, 2021 to 2026", "as_of": "2026-09-28", "chapter": { "number": 7, "title": "In the Gulf, a cloud region has a street address", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=gulf" }, "basis": { "figure_id": "gcc-posts-by-country", "data_file": "report/data/derived/ransomware/figures.json", "public_data": [ { "title": "RansomLook API, posts by year, 2021 to 2026 (data licensed CC BY 4.0)", "publisher": "RansomLook open-source project", "url": "https://www.ransomlook.io/about" } ] }, "computed": true, "note": "UAE firms may name Dubai or the UAE in public descriptions more often than other Gulf firms. Read the split as a lead, not a risk ranking. Posts naming two or more Gulf states are counted separately.", "url": "https://bendings.com/research/statistics#gulf-leak-uae" }, { "id": "paths-human-step", "group": "People and fraud", "statement": "A human step appears in 23 of 78 publicly documented intrusion paths and is the first step in 16.", "value": 23, "numerator": 23, "denominator": 78, "unit": "intrusion paths", "window": "Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 4, "title": "Whoever resets a password is part of identity", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=human" }, "basis": { "figure_id": null, "data_file": "report/data/derived/corpus/stats.json", "public_data": [ { "title": "Bendings incident corpus: 78 publicly documented intrusions, 2013 to September 2026, coded from primary sources", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "url": "https://bendings.com/research/statistics#paths-human-step" }, { "id": "ic3-2025-total", "group": "People and fraud", "statement": "The FBI's Internet Crime Complaint Center received 1,008,597 complaints reporting $20.877 billion in losses in 2025.", "value": 20877000000, "numerator": null, "denominator": null, "unit": "USD", "window": "Complaints filed 2025-01-01 to 2025-12-31", "as_of": "2026-04-06", "chapter": { "number": 4, "title": "Whoever resets a password is part of identity", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=human" }, "basis": { "sources": [ { "title": "Internet Crime Report 2025", "publisher": "FBI Internet Crime Complaint Center", "url": "https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf", "section": "IC3 Complaints in 2025, PDF page 6", "quote": "2025 complaint highlights: 1,008,597 complaints; $20.877 billion in losses; 26% increase in losses from 2024", "date": "2026-04-06", "secondary": false, "checked": "2026-10-30, live page" } ] }, "computed": false, "note": "Losses are what complainants reported. Many victims do not file with the FBI.", "url": "https://bendings.com/research/statistics#ic3-2025-total" }, { "id": "ic3-bec-share", "group": "People and fraud", "statement": "Business email compromise accounted for 24,768 complaints and $3.05 billion in losses reported to the FBI for 2025, 14.6 percent of all reported losses.", "value": 14.6, "numerator": 3046598558, "denominator": 20877000000, "unit": "percent of reported losses", "window": "Complaints filed 2025-01-01 to 2025-12-31", "as_of": "2026-04-06", "chapter": { "number": 4, "title": "Whoever resets a password is part of identity", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=human" }, "basis": { "figure_id": "ic3-bec-losses-2014-2025", "data_file": "report/data/derived/convergence/ic3_2025_crime_types.csv", "public_data": [ { "title": "Internet Crime Report 2025", "publisher": "FBI Internet Crime Complaint Center", "url": "https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf" } ] }, "computed": true, "note": "Bendings' calculation from the IC3 three-year loss and complaint comparison tables, PDF page 26.", "url": "https://bendings.com/research/statistics#ic3-bec-share" }, { "id": "ic3-bec-vs-ransomware", "group": "People and fraud", "statement": "Business email compromise losses reported to the FBI for 2025 were 94 times reported ransomware losses, $3,046.6 million against $32.3 million.", "value": 94, "numerator": 3046598558, "denominator": 32320105, "unit": "times", "window": "Complaints filed 2025-01-01 to 2025-12-31", "as_of": "2026-04-06", "chapter": { "number": 4, "title": "Whoever resets a password is part of identity", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=human" }, "basis": { "figure_id": "ic3-2025-people-fraud-vs-ransomware", "data_file": "report/data/derived/convergence/ic3_2025_crime_types.csv", "public_data": [ { "title": "Internet Crime Report 2025", "publisher": "FBI Internet Crime Complaint Center", "url": "https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf" } ] }, "computed": true, "note": "IC3 ransomware losses leave out downtime, recovery and lost business, and many ransomware victims never file with IC3, so the ratio shows where reported losses concentrate, not what ransomware costs.", "url": "https://bendings.com/research/statistics#ic3-bec-vs-ransomware" }, { "id": "ic3-deception-share", "group": "People and fraud", "statement": "Six crime types in which a person is deceived reported $15.0 billion to the FBI for 2025, 72 percent of all reported losses.", "value": 72, "numerator": 15008136845, "denominator": 20877000000, "unit": "percent of reported losses", "window": "Complaints filed 2025-01-01 to 2025-12-31", "as_of": "2026-04-06", "chapter": { "number": 4, "title": "Whoever resets a password is part of identity", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=human" }, "basis": { "figure_id": "ic3-2025-people-fraud-vs-ransomware", "data_file": "report/data/derived/convergence/ic3_2025_crime_types.csv", "public_data": [ { "title": "Internet Crime Report 2025", "publisher": "FBI Internet Crime Complaint Center", "url": "https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf" } ] }, "computed": true, "note": "The six are investment fraud, business email compromise, tech and customer support fraud, government impersonation, employment fraud and SIM swap. Most of these frauds cross one seam, from a deceived person to a payment.", "url": "https://bendings.com/research/statistics#ic3-deception-share" }, { "id": "ic3-sim-swap-decline", "group": "People and fraud", "statement": "SIM swap losses reported to the FBI fell 76 percent, from $72.7 million on 2,026 complaints in 2022 to $17.4 million on 971 complaints in 2025.", "value": 76, "numerator": 17366758, "denominator": 72652571, "unit": "percent decline", "window": "Complaints filed in 2025, compared with 2022", "as_of": "2026-04-06", "chapter": { "number": 4, "title": "Whoever resets a password is part of identity", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=human" }, "basis": { "figure_id": "ic3-sim-swap-2022-2025", "data_file": "report/data/derived/convergence/ic3_sim_swap.csv", "public_data": [ { "title": "Internet Crime Report 2025", "publisher": "FBI Internet Crime Complaint Center", "url": "https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf" }, { "title": "Internet Crime Report 2023", "publisher": "FBI Internet Crime Complaint Center", "url": "https://www.ic3.gov/AnnualReport/Reports/2023_IC3Report.pdf" } ] }, "computed": true, "note": "Losses from accounts taken over after a SIM swap may be filed under other crime types, and the fall may reflect reporting as well as fewer attacks. A finding that cuts against the report's thesis.", "url": "https://bendings.com/research/statistics#ic3-sim-swap-decline" }, { "id": "uae-fiu-fraud-losses", "group": "Gulf", "statement": "The UAE Financial Intelligence Unit estimated fraud losses of AED 1.24 billion for 2021 to 2023, from the fund recall data of 41 financial institutions.", "value": 1244117187, "numerator": null, "denominator": null, "unit": "AED", "window": "2021-01-01 to 2023-12-31", "as_of": "2024-11-29", "chapter": { "number": 4, "title": "Whoever resets a password is part of identity", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=human" }, "basis": { "sources": [ { "title": "Organized Financial Fraud (strategic analysis)", "publisher": "UAE Financial Intelligence Unit", "url": "https://uaefiu.gov.ae/media/1pmnbrjz/fraud-report-24-nov-final-sanitised-version-final.pdf", "section": "Key findings", "quote": [ "AED 1,244,117,187 Estimated financial loss", "Repatriation amounts from (41) FIs" ], "date": "2024-11-29", "secondary": false, "checked": "2026-10-30, live page" } ] }, "computed": false, "note": "An estimate built from repatriation and fund recall data, not a count of incidents.", "url": "https://bendings.com/research/statistics#uae-fiu-fraud-losses" }, { "id": "sec-third-party", "group": "SEC filings", "statement": "In 36 of 135 cybersecurity incidents US public companies disclosed on Form 8-K from December 18, 2023 to September 28, 2026, the company said the incident occurred at, or came through, a third party.", "value": 36, "numerator": 36, "denominator": 135, "unit": "incidents", "window": "Form 8-K and 8-K/A filings 2023-12-18 to 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 5, "title": "Supplier seams are crossed often, tested rarely", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=suppliers" }, "basis": { "figure_id": "sec8k-third-party-share", "data_file": "report/data/derived/sec8k/stats.json", "public_data": [ { "title": "EDGAR full-text search and filing archives, Form 8-K and 8-K/A cybersecurity incident disclosures", "publisher": "US Securities and Exchange Commission", "url": "https://efts.sec.gov/LATEST/search-index" } ] }, "computed": true, "note": "These are filers, not supplier events: seven filings concern one software supplier's 2024 incident. In 99 of the 135, the first filing states no third-party path.", "url": "https://bendings.com/research/statistics#sec-third-party" }, { "id": "sec-supplier-events", "group": "SEC filings", "statement": "Counting each supplier's breach once, at most 28 of 127 cybersecurity incidents disclosed on Form 8-K, 22 percent, came through a supplier.", "value": 28, "numerator": 28, "denominator": 127, "unit": "incidents", "window": "Form 8-K and 8-K/A filings 2023-12-18 to 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 5, "title": "Supplier seams are crossed often, tested rarely", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=suppliers" }, "basis": { "figure_id": null, "data_file": "report/data/derived/sec8k/stats.json", "public_data": [ { "title": "EDGAR full-text search and filing archives, Form 8-K and 8-K/A cybersecurity incident disclosures", "publisher": "US Securities and Exchange Commission", "url": "https://efts.sec.gov/LATEST/search-index" } ] }, "computed": true, "note": "Twenty-one of the 28 do not name the supplier and may overlap, so 28 is a ceiling.", "url": "https://bendings.com/research/statistics#sec-supplier-events" }, { "id": "sec-item-105", "group": "SEC filings", "statement": "After the SEC staff statement of May 21, 2024, 33 of 112 new cybersecurity incidents (29.5 percent) were first disclosed under Item 1.05 of Form 8-K, against 17 of 23 (73.9 percent) before it.", "value": 33, "numerator": 33, "denominator": 112, "unit": "incidents", "window": "Incidents first disclosed 2024-05-21 to 2026-09-28, compared with 2023-12-18 to 2024-05-20", "as_of": "2026-09-28", "chapter": { "number": 5, "title": "Supplier seams are crossed often, tested rarely", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=suppliers" }, "basis": { "figure_id": "sec8k-quarterly-by-item", "data_file": "report/data/derived/sec8k/stats.json", "public_data": [ { "title": "EDGAR full-text search and filing archives, Form 8-K and 8-K/A cybersecurity incident disclosures", "publisher": "US Securities and Exchange Commission", "url": "https://efts.sec.gov/LATEST/search-index" } ] }, "computed": true, "note": "Quote it as 33 of 112 or 29.5 percent. The exact share is 29.46 percent, so rounding 29.5 again to 30 overstates it. The staff statement said incidents not yet judged material could be disclosed under Item 8.01.", "url": "https://bendings.com/research/statistics#sec-item-105" }, { "id": "sec-named-attacker", "group": "SEC filings", "statement": "In only 5 of 135 cybersecurity incidents US public companies disclosed on Form 8-K did the first filing name the attacker or call it state-sponsored.", "value": 5, "numerator": 5, "denominator": 135, "unit": "incidents", "window": "Form 8-K and 8-K/A filings 2023-12-18 to 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 7, "title": "In the Gulf, a cloud region has a street address", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=gulf" }, "basis": { "figure_id": null, "data_file": "report/data/derived/sec8k/stats.json", "public_data": [ { "title": "EDGAR full-text search and filing archives, Form 8-K and 8-K/A cybersecurity incident disclosures", "publisher": "US Securities and Exchange Commission", "url": "https://efts.sec.gov/LATEST/search-index" } ] }, "computed": true, "note": "SEC rules let companies withhold technical detail.", "url": "https://bendings.com/research/statistics#sec-named-attacker" }, { "id": "fbi-atm-jackpotting", "group": "Physical and OT", "statement": "The FBI knew of 1,900 ATM jackpotting incidents reported since 2020, more than 700 of them in 2025, with more than $20 million lost that year.", "value": 1900, "numerator": null, "denominator": null, "unit": "incidents", "window": "Incidents reported to the FBI from 2020 to 2026-02-19", "as_of": "2026-02-19", "chapter": { "number": 6, "title": "Few tests cross the door, camera or valve", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=physical" }, "basis": { "sources": [ { "title": "Increase in Malware Enabled ATM Jackpotting Incidents Across United States (FLASH-20260219)", "publisher": "Federal Bureau of Investigation", "url": "https://www.ic3.gov/CSA/2026/260219.pdf", "section": "Summary", "quote": "Out of 1,900 ATM jackpotting incidents reported since 2020, over 700 of them with more than $20 million in losses occurred in 2025 alone.", "date": "2026-02-19", "secondary": false, "checked": "2026-10-30, live page" } ] }, "computed": false, "note": "The count covers only what was reported to the FBI. Jackpotting attacks the machine and does not open a way into the bank's network.", "url": "https://bendings.com/research/statistics#fbi-atm-jackpotting" }, { "id": "kev-physical-security-devices", "group": "Physical and OT", "statement": "Of the 1,728 entries in CISA's Known Exploited Vulnerabilities catalog, 22 (1.3 percent) are in cameras, video recorders or access-control systems, and 17 of the 22 were added from January 2024 onward.", "value": 22, "numerator": 22, "denominator": 1728, "unit": "KEV entries", "window": "Whole catalog, 2021-11-03 to 2026-09-27, version 2026.09.27", "as_of": "2026-09-28", "chapter": { "number": 6, "title": "Few tests cross the door, camera or valve", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=physical" }, "basis": { "figure_id": "kev-physical-security-devices-by-year", "data_file": "report/data/derived/convergence/kev_physical_security_devices.csv", "public_data": [ { "title": "Known Exploited Vulnerabilities catalog, JSON feed, catalogVersion 2026.09.27", "publisher": "Cybersecurity and Infrastructure Security Agency", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" } ] }, "computed": true, "note": "Found by keyword screen and hand review, so the method may undercount. Building management and industrial controllers are excluded.", "url": "https://bendings.com/research/statistics#kev-physical-security-devices" }, { "id": "paths-physical-step", "group": "Physical and OT", "statement": "Only 4 of 78 publicly documented intrusion paths include a physical step, which may say more about what victims disclose than about attacks.", "value": 4, "numerator": 4, "denominator": 78, "unit": "intrusion paths", "window": "Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 6, "title": "Few tests cross the door, camera or valve", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=physical" }, "basis": { "figure_id": null, "data_file": "report/data/derived/corpus/stats.json", "public_data": [ { "title": "Bendings incident corpus: 78 publicly documented intrusions, 2013 to September 2026, coded from primary sources", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "url": "https://bendings.com/research/statistics#paths-physical-step" }, { "id": "paths-ot-by-decision", "group": "Physical and OT", "statement": "In 7 of 78 publicly documented intrusions, harm reached operational technology only because the victim or someone downstream shut it down or could not run it, against 6 in which the adversary acted in it.", "value": 7, "numerator": 7, "denominator": 78, "unit": "intrusions", "window": "Intrusions with first access or disclosure from 2013-01-01 to 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 6, "title": "Few tests cross the door, camera or valve", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=physical" }, "basis": { "figure_id": null, "data_file": "report/data/derived/corpus/stats.json", "public_data": [ { "title": "Bendings incident corpus: 78 publicly documented intrusions, 2013 to September 2026, coded from primary sources", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "The two groups cannot overlap: harm by decision is counted only in domains the adversary never acted in. Seven against six in a chosen sample is too few to rank one above the other.", "url": "https://bendings.com/research/statistics#paths-ot-by-decision" }, { "id": "gulf-corpus-sources", "group": "Gulf", "statement": "Of the 15 Gulf intrusions in the incident corpus, 4 rest on press reports alone and 6 do not disclose the first step.", "value": 4, "numerator": 4, "denominator": 15, "unit": "intrusion paths", "window": "Gulf intrusions with first access or disclosure from 2013-01-01 to 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 7, "title": "In the Gulf, a cloud region has a street address", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=gulf" }, "basis": { "figure_id": null, "data_file": "report/data/derived/corpus/stats.json", "public_data": [ { "title": "Bendings incident corpus: 78 publicly documented intrusions, 2013 to September 2026, coded from primary sources", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "Gulf authorities publish few incident narratives, and no Gulf company in the corpus published an account of how the attackers got in. The Gulf and US cases rest on different kinds of source and compare only loosely.", "url": "https://bendings.com/research/statistics#gulf-corpus-sources" }, { "id": "dfsa-third-party-risk", "group": "Gulf", "statement": "The Dubai Financial Services Authority's Cyber Thematic Review 2024 found the firms it supervises below 70 percent in complying with third-party risk management practices.", "value": 70, "numerator": null, "denominator": null, "unit": "percent, upper bound", "window": "Questionnaire responses for the 2024 review", "as_of": "2024", "chapter": { "number": 7, "title": "In the Gulf, a cloud region has a street address", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=gulf" }, "basis": { "sources": [ { "title": "Cyber Thematic Review 2024", "publisher": "Dubai Financial Services Authority", "url": "https://www.dfsa.ae/download_file/3762/0", "section": "Executive summary", "quote": "On average, 80-90% of Firms implemented the governance practices mandated by the Rules, except compliance with third-party risk management practices which remains below 70%, consistent with 2022.", "date": "2024", "secondary": false, "checked": "2026-10-30, saved copy of 2026-09-28; live page refused the request" } ] }, "computed": false, "note": "Built on a questionnaire to the firms the DFSA supervises. The review gives no exact figure below 70 percent.", "url": "https://bendings.com/research/statistics#dfsa-third-party-risk" }, { "id": "ic3-bec-ai-share", "group": "AI", "statement": "Only $30.3 million of the business email compromise losses reported to the FBI for 2025, about 1 percent, came from complaints with AI-related information.", "value": 1, "numerator": 30256592, "denominator": 3046598558, "unit": "percent of reported BEC losses", "window": "Complaints filed 2025-01-01 to 2025-12-31", "as_of": "2026-04-06", "chapter": { "number": 4, "title": "Whoever resets a password is part of identity", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=human" }, "basis": { "figure_id": "ic3-2025-bec-ai-share", "data_file": "report/data/derived/convergence/figures.json", "public_data": [ { "title": "Internet Crime Report 2025", "publisher": "FBI Internet Crime Complaint Center", "url": "https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf" } ], "sources": [ { "title": "Internet Crime Report 2025", "publisher": "FBI Internet Crime Complaint Center", "url": "https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf", "section": "AI References by Complaint Loss, PDF page 42", "quote": "BEC $30,256,592", "date": "2026-04-06", "secondary": false, "checked": "2026-10-30, live page" } ] }, "computed": true, "note": "A floor: the tag records only what victims knew and reported.", "url": "https://bendings.com/research/statistics#ic3-bec-ai-share" }, { "id": "ic3-ai-related", "group": "AI", "statement": "The FBI's Internet Crime Complaint Center received 22,364 complaints with AI-related information in 2025, reporting $893 million in losses.", "value": 22364, "numerator": null, "denominator": null, "unit": "complaints", "window": "Complaints filed 2025-01-01 to 2025-12-31", "as_of": "2026-04-06", "chapter": { "number": 4, "title": "Whoever resets a password is part of identity", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=human" }, "basis": { "sources": [ { "title": "Internet Crime Report 2025", "publisher": "FBI Internet Crime Complaint Center", "url": "https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf", "section": "How AI Could Be Used in Frauds/Scams, PDF page 39", "quote": "22,364 Complaints $893,346,472 Losses", "date": "2026-04-06", "secondary": false, "checked": "2026-10-30, live page" } ] }, "computed": false, "note": "Mostly investment fraud. The tag depends on what victims knew, so it is a lower bound.", "url": "https://bendings.com/research/statistics#ic3-ai-related" }, { "id": "aisi-out-of-scope", "group": "AI", "statement": "The UK AI Security Institute found that in 10 of 122 runs of one cyber evaluation, AI agents took 19 actions beyond the scope of the test against real people and organizations.", "value": 10, "numerator": 10, "denominator": 122, "unit": "evaluation runs", "window": "Evaluation runs reviewed after the incident of July 2026", "as_of": "2026-08-04", "chapter": { "number": 8, "title": "AI agents under test reached real organizations", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=ai" }, "basis": { "sources": [ { "title": "Incident Report: unsanctioned agent behaviour during cyber testing", "publisher": "UK AI Security Institute", "url": "https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing", "section": "What we found", "quote": "However, in 10 of the 122 runs, we identified 19 cases where an agent had taken distinct actions beyond the scope of the testing parameters.", "date": "2026-08-04", "secondary": false, "checked": "2026-10-30, live page" } ] }, "computed": false, "note": "A capability evaluation with safeguards deliberately reduced, not a commercial penetration test. The worst case was an attempt to get malicious code into a public open-source project, caught by the project's maintainer.", "url": "https://bendings.com/research/statistics#aisi-out-of-scope" }, { "id": "nvd-prompt-injection", "group": "AI", "statement": "CVE records in the National Vulnerability Database that name prompt injection rose from 2 in 2023 to 83 in the first nine months of 2026.", "value": 83, "numerator": 83, "denominator": 71430, "unit": "CVE records", "window": "CVEs published 2026-01-01 to 2026-09-28, compared with 2023", "as_of": "2026-09-28", "chapter": { "number": 8, "title": "AI agents under test reached real organizations", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=ai" }, "basis": { "figure_id": "ai-nvd-prompt-injection-cves-by-year", "data_file": "report/data/derived/ai/seam_nvd_prompt_injection_by_year.csv", "public_data": [ { "title": "CVE API 2.0", "publisher": "National Institute of Standards and Technology, National Vulnerability Database", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0" } ] }, "computed": true, "note": "Keyword counts are a floor: many prompt injection flaws are described in other words. The denominator is all non-rejected CVEs published in the window. An exact-phrase NVD API search gives 78 for 2026; the published 83 uses a regular expression over the NVD JSON feeds.", "url": "https://bendings.com/research/statistics#nvd-prompt-injection" }, { "id": "darpa-aixcc", "group": "AI", "statement": "In the final of DARPA's AI Cyber Challenge in August 2025, competing AI systems found 54 of the 63 synthetic vulnerabilities planted across 54 million lines of code, and 18 real ones.", "value": 54, "numerator": 54, "denominator": 63, "unit": "synthetic vulnerabilities found", "window": "Final Competition, August 2025", "as_of": "2025-08-08", "chapter": { "number": 8, "title": "AI agents under test reached real organizations", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=ai" }, "basis": { "sources": [ { "title": "AI Cyber Challenge marks pivotal inflection point for cyber defense", "publisher": "DARPA", "url": "https://www.darpa.mil/news/2025/aixcc-results", "section": "Deep Dive: Final Competition Findings, Highlights; Editor's note", "quote": [ "In total, competitors’ systems discovered 54 unique synthetic vulnerabilities in the Final Competition’s 63 challenges. Of those, they patched 43. In the Final Competition, teams also discovered 18 real, non-synthetic vulnerabilities", "teams’ systems attempted to identify and generate patches for synthetic vulnerabilities across 54 million lines of code.", "Upon further review, the competition administrator determined the Final Competition included 63 synthetic vulnerabilities. The number of vulnerabilities competitors’ systems discovered (54) remained unchanged, which means competitors discovered 86% of the synthetic vulnerabilities and patched 68%." ], "date": "2025-08-08", "secondary": false, "checked": "2026-10-30, live page" } ] }, "computed": false, "note": "DARPA first said 70 synthetic vulnerabilities were planted and corrected the figure to 63. The systems patched 43 of the 54.", "url": "https://bendings.com/research/statistics#darpa-aixcc" }, { "id": "uk-services-php", "group": "AI", "statement": "The day after the UK NCSC's alert of October 21, 2026 on PHP flaws, a UK minister told the House of Lords that 32 government services were unavailable and four partly unavailable, largely from precautionary measures.", "value": 32, "numerator": null, "denominator": null, "unit": "government services", "window": "Cross-government reporting on 2026-10-22", "as_of": "2026-10-22", "chapter": { "number": 8, "title": "AI agents under test reached real organizations", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=ai" }, "basis": { "sources": [ { "title": "Cyber Security: PHP Vulnerability, House of Lords, volume 860", "publisher": "UK Parliament, Hansard", "url": "https://hansard.parliament.uk/Lords/2026-10-22/debates/14CB4C6D-4E16-4377-8FCF-C2CF77BB5CC0/details", "section": "Minister's answer, contribution 14", "quote": "Currently, the information I have is that 32 government services are unavailable and four are partially unavailable. That is the latest cross-government reporting. That has resulted largely from precautionary measures", "date": "2026-10-22", "secondary": false, "checked": "2026-10-30, saved copy of 2026-10-22; live page refused the request" } ] }, "computed": false, "note": "Dated after the report's data snapshot. The minister reported no confirmed compromise of central government systems.", "url": "https://bendings.com/research/statistics#uk-services-php" }, { "id": "regimes-ai-testing", "group": "AI", "statement": "Of 50 testing regimes in the United States, the six Gulf states and nine benchmark schemes, none of the 47 coded regimes with public text sets rules for AI-driven testing, although 30 of the 47 mention automated scanning, continuous testing or the security of AI systems.", "value": 0, "numerator": 0, "denominator": 47, "unit": "testing regimes", "window": "Regulator texts as of 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 9, "title": "Testing rules stop at the seams attackers cross", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=regimes" }, "basis": { "figure_id": "regimes-seam-matrix", "data_file": "report/data/derived/regimes/matrix.csv", "public_data": [ { "title": "Testing regime matrix: 50 regimes coded on 17 dimensions, each cell citing the regulator text", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "The other 3 of the 50 could not be coded on this point because their text is not public. No regime sets scope limits, human approval points or logging for an AI that runs the test.", "url": "https://bendings.com/research/statistics#regimes-ai-testing" }, { "id": "regimes-physical", "group": "Testing rules", "statement": "Of 41 US and Gulf testing regimes, only 1 requires a physical intrusion test, Saudi Arabia's controls for operational technology, and only at the two highest facility levels.", "value": 1, "numerator": 1, "denominator": 41, "unit": "testing regimes", "window": "US and Gulf testing regimes as of 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 9, "title": "Testing rules stop at the seams attackers cross", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=regimes" }, "basis": { "figure_id": "regimes-seam-stance-us-gcc", "data_file": "report/data/derived/regimes/matrix.csv", "public_data": [ { "title": "Testing regime matrix: 50 regimes coded on 17 dimensions, each cell citing the regulator text", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ], "sources": [ { "title": "Operational Technology Cybersecurity Controls (OTCC-1:2022)", "publisher": "National Cybersecurity Authority, Saudi Arabia", "url": "https://nca.gov.sa/otcc_en.pdf", "section": "Subcontrol 2-13-1-9", "quote": "Physical security capabilities and readiness must be periodically tested by performing simulation exercises (such as social engineering).", "date": "2022", "secondary": false, "checked": "2026-10-30, live page" } ] }, "computed": true, "note": "Eight more regimes require physical controls to be tested without anyone trying the door. Two of the 41 have no public text.", "url": "https://bendings.com/research/statistics#regimes-physical" }, { "id": "regimes-people", "group": "Testing rules", "statement": "Of 41 US and Gulf testing regimes, 5 require a test of people such as social engineering, and 12 more permit one.", "value": 5, "numerator": 5, "denominator": 41, "unit": "testing regimes", "window": "US and Gulf testing regimes as of 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 9, "title": "Testing rules stop at the seams attackers cross", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=regimes" }, "basis": { "figure_id": "regimes-seam-stance-us-gcc", "data_file": "report/data/derived/regimes/matrix.csv", "public_data": [ { "title": "Testing regime matrix: 50 regimes coded on 17 dimensions, each cell citing the regulator text", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "Permission is often only as awareness training. New York requires social engineering training and no social engineering test. Counted on the September coding as corrected on October 30, 2026; see the /testing-rules change log. Recounted from /testing-rules/data.json for the same 41 regimes, so report/data/derived/regimes/matrix.csv gives the PDF’s number. The PDF gives 13 that permit one.", "url": "https://bendings.com/research/statistics#regimes-people" }, { "id": "regimes-supplier", "group": "Testing rules", "statement": "Of 41 US and Gulf testing regimes, 9 put systems a supplier runs inside the test, 7 of 12 in the United States and 2 of 29 in the Gulf, where 11 rely on supplier assurance alone.", "value": 9, "numerator": 9, "denominator": 41, "unit": "testing regimes", "window": "US and Gulf testing regimes as of 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 9, "title": "Testing rules stop at the seams attackers cross", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=regimes" }, "basis": { "figure_id": "regimes-seam-stance-us-gcc", "data_file": "report/data/derived/regimes/matrix.csv", "public_data": [ { "title": "Testing regime matrix: 50 regimes coded on 17 dimensions, each cell citing the regulator text", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "Supplier assurance means contract rights, supplier reports or audits, with supplier systems outside the firm's own test. The EU's DORA is the only text found that lets a pooled test cross a supplier seam no single customer could authorize. Counted on the September coding as corrected on October 30, 2026; see the /testing-rules change log. Recounted from /testing-rules/data.json for the same 41 regimes, so report/data/derived/regimes/matrix.csv gives the PDF’s number. The PDF gives 10 in the Gulf.", "url": "https://bendings.com/research/statistics#regimes-supplier" }, { "id": "regimes-no-seam", "group": "Testing rules", "statement": "Of the 39 US and Gulf testing regimes with public text, 23 require none of the human, physical, supplier, OT or cloud seams.", "value": 23, "numerator": 23, "denominator": 39, "unit": "testing regimes", "window": "US and Gulf testing regimes as of 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 9, "title": "Testing rules stop at the seams attackers cross", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=regimes" }, "basis": { "figure_id": "regimes-seam-matrix", "data_file": "report/data/derived/regimes/matrix.csv", "public_data": [ { "title": "Testing regime matrix: 50 regimes coded on 17 dimensions, each cell citing the regulator text", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "Counts measure texts, not strictness: a federal regulation and an accreditation standard each count once.", "url": "https://bendings.com/research/statistics#regimes-no-seam" }, { "id": "regimes-ot", "group": "Testing rules", "statement": "Of 41 US and Gulf testing regimes, 31 do not address operational technology.", "value": 31, "numerator": 31, "denominator": 41, "unit": "testing regimes", "window": "US and Gulf testing regimes as of 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 9, "title": "Testing rules stop at the seams attackers cross", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=regimes" }, "basis": { "figure_id": "regimes-seam-stance-us-gcc", "data_file": "report/data/derived/regimes/matrix.csv", "public_data": [ { "title": "Testing regime matrix: 50 regimes coded on 17 dimensions, each cell citing the regulator text", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "Kuwait's central bank framework requires annual penetration tests of IoT and OT and names CCTV and building management systems.", "url": "https://bendings.com/research/statistics#regimes-ot" }, { "id": "regimes-threat-led", "group": "Testing rules", "statement": "None of seven US financial testing regimes requires threat-led red teaming, while Saudi Arabia's central bank sets a cycle of at least once every three years and Kuwait's at least once a year.", "value": 0, "numerator": 0, "denominator": 7, "unit": "US financial testing regimes", "window": "US and Gulf testing regimes as of 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 9, "title": "Testing rules stop at the seams attackers cross", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=regimes" }, "basis": { "figure_id": "regimes-threat-led-red-team", "data_file": "report/data/derived/regimes/matrix.csv", "public_data": [ { "title": "Testing regime matrix: 50 regimes coded on 17 dimensions, each cell citing the regulator text", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ], "sources": [ { "title": "Financial Entities Ethical Red-Teaming, Version 1.0", "publisher": "Saudi Central Bank (SAMA)", "url": "https://rulebook.sama.gov.sa/sites/default/files/ar_net_file_store/SAMA_AR_2898_VER1.pdf", "section": "Section 1.6, Periodicity of the Red Teaming tests", "quote": "Each Member Organization within the Financial Sector of Saudi Arabia and are regulated by SAMA should be tested, as a minimum once every three (3) years, in line with this framework.", "date": "2019-05", "secondary": false, "checked": "2026-10-30, live page" }, { "title": "Cyber and Operational Resilience Framework for All Local Banks and Financial Institutions, v1.0", "publisher": "Central Bank of Kuwait", "url": "https://www.cbk.gov.kw/en/images/corf-170113_v10_tcm10-170113.pdf", "section": "5.13.2.7", "quote": "Red teaming exercises shall be conducted at least once a year or as required based on changes to the threat landscape, critical systems, or regulatory requirements.", "date": "2025-12-03", "secondary": false, "checked": "2026-10-30, live page" } ] }, "computed": true, "note": "US bank supervisors may expect red teaming at large banks in ways that are not public; none could be confirmed. A third-party copy of the Saudi framework limits the three-year cycle to systemically important banks; the central bank's own rulebook copy applies it to every member organization.", "url": "https://bendings.com/research/statistics#regimes-threat-led" }, { "id": "regimes-cross-border", "group": "Testing rules", "statement": "Of 41 US and Gulf testing regimes, 16 say something about other jurisdictions, and none provides for a joint, pooled or mutually recognized test.", "value": 16, "numerator": 16, "denominator": 41, "unit": "testing regimes", "window": "US and Gulf testing regimes as of 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 9, "title": "Testing rules stop at the seams attackers cross", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=regimes" }, "basis": { "figure_id": "regimes-seam-matrix", "data_file": "report/data/derived/regimes/matrix.csv", "public_data": [ { "title": "Testing regime matrix: 50 regimes coded on 17 dimensions, each cell citing the regulator text", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "They extend rules to foreign branches, affiliates, functions or systems abroad, let foreign bank branches rely on head office functions, or limit where testers and others with access to the systems may sit. Counted on the September coding as corrected on October 30, 2026; see the /testing-rules change log. Recounted from /testing-rules/data.json for the same 41 regimes, so report/data/derived/regimes/matrix.csv gives the PDF’s number. The PDF gives 12.", "url": "https://bendings.com/research/statistics#regimes-cross-border" }, { "id": "clocks-gulf-one-hour", "group": "Reporting deadlines", "statement": "The central banks of Bahrain, Qatar and Kuwait expect a first report of a serious cyber incident within one hour.", "value": 1, "numerator": null, "denominator": null, "unit": "hours", "window": "Rules in force on 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 10, "title": "Gulf deadlines fall due hours before US ones", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=clocks" }, "basis": { "sources": [ { "title": "CBB Rulebook Volume 1 (Conventional Banks), Module OM", "publisher": "Central Bank of Bahrain", "url": "https://cbben.thomsonreuters.com/rulebook/om-5557", "section": "OM-5.5.57", "quote": "conventional bank licensees must contact the CBB, immediately (within one hour)", "date": "2022-04", "secondary": false, "checked": "2026-10-30, live page" }, { "title": "Technology Risks (QCB cyber security circular for banks)", "publisher": "Qatar Central Bank", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risks%20Regulation%20Banks.pdf", "section": "8.2.10", "quote": "All critical incidents must be reported to QCB and the relevant governmental authorities within 1 hour of identification.", "date": "2018-01", "secondary": false, "checked": "2026-10-30, live page" }, { "title": "Cyber and Operational Resilience Framework for All Local Banks and Financial Institutions, v1.0", "publisher": "Central Bank of Kuwait", "url": "https://www.cbk.gov.kw/en/images/corf-170113_v10_tcm10-170113.pdf", "section": "8.2.2.1(b)", "quote": "b) High severity incidents shall be reported within (1) hour of discovery.", "date": "2025-12-03", "secondary": false, "checked": "2026-10-30, live page" } ] }, "computed": false, "note": "The shortest fixed first notice among the 10 financial regulators compared. The clocks start at different moments: occurrence or detection in Bahrain, identification in Qatar, discovery in Kuwait. Bahrain's first report is a phone call. Kuwait's one hour applies to high-severity incidents.", "url": "https://bendings.com/research/statistics#clocks-gulf-one-hour" }, { "id": "clocks-us-36-hours", "group": "Reporting deadlines", "statement": "US federal bank regulators require notice no later than 36 hours after a bank determines that a notification incident has occurred.", "value": 36, "numerator": null, "denominator": null, "unit": "hours", "window": "Rules in force on 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 10, "title": "Gulf deadlines fall due hours before US ones", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=clocks" }, "basis": { "sources": [ { "title": "12 CFR part 225 subpart N, computer-security incident notification", "publisher": "Federal Reserve Board, via eCFR", "url": "https://www.ecfr.gov/current/title-12/chapter-II/subchapter-A/part-225/subpart-N", "section": "12 CFR 225.302", "quote": "The Board must receive this notification from the banking organization as soon as possible and no later than 36 hours after the banking organization determines that a notification incident has occurred.", "date": "2022-05-01", "secondary": false, "checked": "2026-10-30, saved copy of 2026-09-28; live page refused the request" }, { "title": "12 CFR part 53, computer-security incident notification", "publisher": "Office of the Comptroller of the Currency, via eCFR", "url": "https://www.ecfr.gov/current/title-12/chapter-I/part-53", "section": "12 CFR 53.3", "quote": "The OCC must receive this notification from the banking organization as soon as possible and no later than 36 hours after the banking organization determines that a notification incident has occurred.", "date": "2022-05-01", "secondary": false, "checked": "2026-10-30, saved copy of 2026-09-28; live page refused the request" }, { "title": "12 CFR part 304 subpart C, computer-security incident notification", "publisher": "Federal Deposit Insurance Corporation, via eCFR", "url": "https://www.ecfr.gov/current/title-12/chapter-III/subchapter-B/part-304/subpart-C", "section": "12 CFR 304.23", "quote": "The FDIC must receive this notification from the banking organization as soon as possible and no later than 36 hours after the banking organization determines that a notification incident has occurred.", "date": "2022-05-01", "secondary": false, "checked": "2026-10-30, saved copy of 2026-09-28; live page refused the request" } ] }, "computed": false, "note": "The US clock waits for a determination the bank makes and records, so its hour 0 can fall later than a Gulf clock's.", "url": "https://bendings.com/research/statistics#clocks-us-36-hours" }, { "id": "clocks-uae-4-hours", "group": "Reporting deadlines", "statement": "Since September 14, 2026, a bank licensed in the UAE must notify the central bank within 4 hours of an operational risk event that significantly affects its critical operations, and send a summary within 24 hours.", "value": 4, "numerator": null, "denominator": null, "unit": "hours", "window": "Rule in force from 2026-09-14", "as_of": "2026-09-14", "chapter": { "number": 10, "title": "Gulf deadlines fall due hours before US ones", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=clocks" }, "basis": { "sources": [ { "title": "Circular No. 1/2026, Operational Risk Management Regulation", "publisher": "Central Bank of the UAE", "url": "https://rulebook.centralbank.ae/sites/default/files/en_net_file_store/CBUAE_EN_7267_VER1.pdf", "section": "Articles 15.2.1 and 15.2.2", "quote": [ "15.2.1. Within 4 hours: notify the Central Bank of the events, including what Critical Operations are affected;", "15.2.2. Within 24 hours: provide the Central Bank with a summary report of the nature of the event" ], "date": "2026-02-03", "secondary": false, "checked": "2026-10-30, live page" } ] }, "computed": false, "note": "The text does not say what event starts the four-hour clock.", "url": "https://bendings.com/research/statistics#clocks-uae-4-hours" }, { "id": "clocks-oman-6-hours", "group": "Reporting deadlines", "statement": "Oman's central bank expects licensed institutions to report a cyber security incident immediately and not later than 6 hours after it has occurred and been identified.", "value": 6, "numerator": null, "denominator": null, "unit": "hours", "window": "Rules in force on 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 10, "title": "Gulf deadlines fall due hours before US ones", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=clocks" }, "basis": { "sources": [ { "title": "Cyber Security and Resilience Framework (CS&RF)", "publisher": "Central Bank of Oman", "url": "https://cbo.gov.om/sites/assets/FintechCompulsoryDocs/Cyber%20Security%20&%20Resilience%20Framework%20(CS&RF).pdf", "section": "Section 3.3.14, item 4", "quote": "immediately, not later than 6 hours on a 24/7 basis, when a cyber security incident has occurred and identified", "date": "2023-09", "secondary": false, "checked": "2026-09-28, OCR of the saved scan; the PDF is image-only, so the live copy cannot be text-matched" } ] }, "computed": false, "note": "Oman also sets 12, 24 and 48-hour reports by severity, counted from occurrence.", "url": "https://bendings.com/research/statistics#clocks-oman-6-hours" }, { "id": "clocks-nydfs-72-hours", "group": "Reporting deadlines", "statement": "New York's financial regulator requires notice no later than 72 hours after a covered entity determines that a cybersecurity incident has occurred at the entity, its affiliates or a third-party service provider.", "value": 72, "numerator": null, "denominator": null, "unit": "hours", "window": "Rules in force on 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 10, "title": "Gulf deadlines fall due hours before US ones", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=clocks" }, "basis": { "sources": [ { "title": "23 NYCRR Part 500 Cybersecurity Regulation", "publisher": "New York State Department of Financial Services", "url": "https://www.dfs.ny.gov/system/files/documents/2026/07/NYCRR-part-500-Cybersecurity-Regulation.pdf", "section": "23 NYCRR 500.17(a)(1)", "quote": "as promptly as possible but in no event later than 72 hours after determining that a cybersecurity incident has occurred at the covered entity, its affiliates, or a third-party service provider.", "date": "2023-11-01", "secondary": false, "checked": "2026-10-30, saved copy of 2026-09-28; live page refused the request" } ] }, "computed": false, "note": "Because the rule reaches affiliates, a Gulf affiliate's notice to its own central bank can prompt a New York decision. Paying a ransom adds a 24-hour notice.", "url": "https://bendings.com/research/statistics#clocks-nydfs-72-hours" }, { "id": "clocks-start-not-stated", "group": "Reporting deadlines", "statement": "Of 96 incident notification duties in US, Gulf, EU and UK texts that could bind a banking group, 9 do not say what event starts the clock.", "value": 9, "numerator": 9, "denominator": 96, "unit": "notification duties", "window": "Regulator texts as of 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 10, "title": "Gulf deadlines fall due hours before US ones", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=clocks" }, "basis": { "figure_id": "clocks-trigger-families", "data_file": "report/data/derived/clocks/summary.json", "public_data": [ { "title": "96 incident notification duties coded from regulator texts, with scenario file", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "All nine are in Gulf texts. Awareness or belief starts 34 duties, detection, identification or discovery 18, a determination or classification 12 and occurrence 10. Not legal advice.", "url": "https://bendings.com/research/statistics#clocks-start-not-stated" }, { "id": "clocks-scenario-first-deadlines", "group": "Reporting deadlines", "statement": "In a hypothetical ransomware incident at a group with banks in the United States, Saudi Arabia, the UAE and Bahrain, the first deadline falls in Bahrain at hour 1 and the first US deadline at hour 40.", "value": 40, "numerator": null, "denominator": null, "unit": "hours after detection", "window": "Hypothetical scenario on rules in force on 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 10, "title": "Gulf deadlines fall due hours before US ones", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=clocks" }, "basis": { "figure_id": "clocks-scenario-timeline", "data_file": "report/data/derived/clocks/scenario.csv", "public_data": [ { "title": "96 incident notification duties coded from regulator texts, with scenario file", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "A scenario Bendings built, with every assumption in scenario.csv. The US determination is assumed at hour 4. Of the 26 in-force clocks that apply without conditions, 22 start within the first 30 hours, at 13 authorities in four countries.", "url": "https://bendings.com/research/statistics#clocks-scenario-first-deadlines" }, { "id": "clocks-data-protection-72", "group": "Reporting deadlines", "statement": "Saudi Arabia, Bahrain, Oman, the ADGM and the Qatar Financial Centre all set 72 hours for personal data breach notice, the same as the GDPR, while the UAE federal law has no period in force.", "value": 72, "numerator": null, "denominator": null, "unit": "hours", "window": "Data protection texts as of 2026-09-28", "as_of": "2026-09-28", "chapter": { "number": 10, "title": "Gulf deadlines fall due hours before US ones", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=clocks" }, "basis": { "figure_id": "clocks-data-breach-authority", "data_file": "report/data/derived/clocks/clocks.csv", "public_data": [ { "title": "96 incident notification duties coded from regulator texts, with scenario file", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "Qatar's onshore 72 hours comes from official guidance, not the statute. The UAE federal law leaves the period to executive regulations that could not be found on official portals.", "url": "https://bendings.com/research/statistics#clocks-data-protection-72" }, { "id": "posture-dmarc", "group": "Posture", "statement": "Of 159 US and Gulf regulators and banks measured on September 28, 2026, 147 (92 percent) told mail receivers to quarantine or reject mail that fails DMARC, including all 12 US authorities.", "value": 147, "numerator": 147, "denominator": 159, "unit": "institutions", "window": "Measured once, 2026-09-28 17:02 to 17:14 UTC", "as_of": "2026-09-28", "chapter": { "number": 11, "title": "Banks guard mail but rarely say where to report", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=posture" }, "basis": { "figure_id": "posture-dmarc-policy", "data_file": "report/data/derived/posture/aggregates.json", "public_data": [ { "title": "Passive measurement of public DNS records and HTTPS responses at 159 US and Gulf institutions, 2026-09-28 17:02 to 17:14 UTC", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "A finding that cuts against the report's thesis: the email seam is mostly closed at the exact domain. DMARC does nothing about lookalike domains, subsidiaries or suppliers that send for the institution. Results are reported in aggregate only.", "url": "https://bendings.com/research/statistics#posture-dmarc" }, { "id": "posture-spf-strict", "group": "Posture", "statement": "Of 79 Gulf banks, 67 end their SPF record with the strict -all instruction, against 27 of 50 large US banks.", "value": 67, "numerator": 67, "denominator": 79, "unit": "banks", "window": "Measured once, 2026-09-28 17:02 to 17:14 UTC", "as_of": "2026-09-28", "chapter": { "number": 11, "title": "Banks guard mail but rarely say where to report", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=posture" }, "basis": { "figure_id": "posture-gcc-banks-matrix", "data_file": "report/data/derived/posture/aggregates.json", "public_data": [ { "title": "Passive measurement of public DNS records and HTTPS responses at 159 US and Gulf institutions, 2026-09-28 17:02 to 17:14 UTC", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "The US list holds only the 50 largest bank holding companies and the Gulf list every locally incorporated bank, so the two are not like for like. Three Gulf bank records need more than the 10 DNS lookups RFC 7208 allows.", "url": "https://bendings.com/research/statistics#posture-spf-strict" }, { "id": "posture-security-txt", "group": "Posture", "statement": "Only 7 of 159 US and Gulf regulators and banks measured served a security.txt file telling an outsider where to report a flaw, and 3 of those files were valid under RFC 9116.", "value": 7, "numerator": 7, "denominator": 159, "unit": "institutions", "window": "Measured once, 2026-09-28 17:02 to 17:14 UTC", "as_of": "2026-09-28", "chapter": { "number": 11, "title": "Banks guard mail but rarely say where to report", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=posture" }, "basis": { "figure_id": "posture-security-txt", "data_file": "report/data/derived/posture/aggregates.json", "public_data": [ { "title": "Passive measurement of public DNS records and HTTPS responses at 159 US and Gulf institutions, 2026-09-28 17:02 to 17:14 UTC", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "Only the standard location on the main web host was tested. Absence means not at the standard place, not unreachable. All 11 US authority .gov domains list a security contact in CISA's registry data.", "url": "https://bendings.com/research/statistics#posture-security-txt" }, { "id": "posture-security-txt-banks", "group": "Posture", "statement": "None of the 61 Gulf bank websites that could be read served a security.txt file, against 5 of 50 large US banks, 2 of them valid.", "value": 0, "numerator": 0, "denominator": 61, "unit": "Gulf banks", "window": "Measured once, 2026-09-28 17:02 to 17:14 UTC", "as_of": "2026-09-28", "chapter": { "number": 11, "title": "Banks guard mail but rarely say where to report", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=posture" }, "basis": { "figure_id": "posture-security-txt", "data_file": "report/data/derived/posture/aggregates.json", "public_data": [ { "title": "Passive measurement of public DNS records and HTTPS responses at 159 US and Gulf institutions, 2026-09-28 17:02 to 17:14 UTC", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "Bot protection, TLS errors or timeouts stopped a clean read at 18 of the 79 Gulf banks. Banks may run a disclosure page or bug bounty elsewhere.", "url": "https://bendings.com/research/statistics#posture-security-txt-banks" }, { "id": "posture-bot-block", "group": "Posture", "statement": "Bot protection blocked a plain request for the security.txt file at 22 of 129 banks, 7 of 50 in the United States and 15 of 79 in the Gulf.", "value": 22, "numerator": 22, "denominator": 129, "unit": "banks", "window": "Measured once, 2026-09-28 17:02 to 17:14 UTC", "as_of": "2026-09-28", "chapter": { "number": 11, "title": "Banks guard mail but rarely say where to report", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=posture" }, "basis": { "figure_id": "posture-security-txt", "data_file": "report/data/derived/posture/aggregates.json", "public_data": [ { "title": "Passive measurement of public DNS records and HTTPS responses at 159 US and Gulf institutions, 2026-09-28 17:02 to 17:14 UTC", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "Requests named their sender and came from one network location in the United States, so part of the gap between regions may reflect where the requests came from.", "url": "https://bendings.com/research/statistics#posture-bot-block" }, { "id": "posture-dnssec", "group": "Posture", "statement": "DNSSEC validated for 9 of 12 US authorities but for 11 of 50 large US banks and 17 of 79 Gulf banks, 9 of them among the 14 in Saudi Arabia.", "value": 17, "numerator": 17, "denominator": 79, "unit": "Gulf banks", "window": "Measured once, 2026-09-28 17:02 to 17:14 UTC", "as_of": "2026-09-28", "chapter": { "number": 11, "title": "Banks guard mail but rarely say where to report", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=posture" }, "basis": { "figure_id": "posture-dnssec", "data_file": "report/data/derived/posture/aggregates.json", "public_data": [ { "title": "Passive measurement of public DNS records and HTTPS responses at 159 US and Gulf institutions, 2026-09-28 17:02 to 17:14 UTC", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "note": "Validated means a DS record at the parent zone and an authenticated answer from two public validating resolvers.", "url": "https://bendings.com/research/statistics#posture-dnssec" }, { "id": "posture-mta-sts", "group": "Posture", "statement": "Only 5 of 159 US and Gulf regulators and banks measured published an MTA-STS policy in enforce mode, all of them in Oman.", "value": 5, "numerator": 5, "denominator": 159, "unit": "institutions", "window": "Measured once, 2026-09-28 17:02 to 17:14 UTC", "as_of": "2026-09-28", "chapter": { "number": 11, "title": "Banks guard mail but rarely say where to report", "url": "https://bendings.com/research/seam-report-2026.pdf#nameddest=posture" }, "basis": { "figure_id": "posture-mta-sts", "data_file": "report/data/derived/posture/aggregates.json", "public_data": [ { "title": "Passive measurement of public DNS records and HTTPS responses at 159 US and Gulf institutions, 2026-09-28 17:02 to 17:14 UTC", "publisher": "Bendings", "url": "https://bendings.com/research/seam-report-2026-data.zip" } ] }, "computed": true, "url": "https://bendings.com/research/statistics#posture-mta-sts" } ] }