Threat Rating — Methodology
Cyber Digest public site · how the per-story threat rating and the homepage threat index are computed.
Current (window ending 2026-08-29): Guarded · 48/100
121 stories in this window. Momentum: ▼ 4.2% (fall) vs the prior 14 days.
What this measures (and what it does not)
The threat rating reflects the severity and urgency of publicly reported security incidents in the Cyber Digest corpus. It is a measure of reported threat activity, derived from the same story database that powers the Story DB and monthly editions. It is not a prediction of future attacks, and it is only as current as the last published digest — a quiet score may mean incidents went undetected or unreported, not that none occurred.
It is an ordinal heuristic using banded words, not a probability and not a measurement of real-world danger. The scale is deliberately coarse, in line with how national threat levels (e.g. Australia’s terrorism threat levels, the UK’s MI5 levels) are presented — banded likelihood words rather than precise numbers.
Two layers
Layer 1 — per-story rating. Every story gets three independent labels, mirroring how CVSS separates intrinsic severity from exploitation status, and how ICD 203 separates likelihood from confidence:
| Label | Values | What drives it |
|---|---|---|
| Severity | Guarded · Elevated · Severe · Critical | CVSS band if cited, kill-chain phase reached, impact class (operational disruption, data exposure volume, OT/physical impact), sector criticality |
| Urgency (exploitation) | Not yet observed · Possible · Probable · Observed | Observed exploitation (e.g. CISA KEV mentions, "exploited in the wild") overrides static severity, per CISA KEV doctrine |
| Confidence | Verified · Reported · Unverified | Source reliability tier (1 = official/first-party → Verified; 2 = established journalism → Reported; 3+ or single-source → Unverified) |
Confidence is the gate: an Unverified story can never be rated Critical severity or Observed urgency — analysts never round up on an unattributed single-source claim.
Layer 2 — the homepage threat index
A 14-day rolling window. Each story’s weight = severity_weight × urgency_weight × confidence_weight × (1 + 0.12 × ANZ relevance) × recency decay, summed per day and averaged across the days covered. The result maps onto a coarse band:
| Band | Meter /100 | Meaning |
|---|---|---|
| Low | 0–39 | Little severe, actively-exploited reporting |
| Guarded | 40–54 | Elevated routine reporting, nothing exceptional |
| Elevated | 55–69 | Notable severe / active-incident reporting |
| Severe | 70–84 | Widespread critical or observed-exploitation activity |
| Critical | 85–100 | Sustained critical-incident reporting |
Momentum compares the current window against the prior 14 days (each window decayed relative to its own end, so it is a real trend, not a recency artefact).
How the labels are assigned (auditable rubric)
The rules live in threat_rating.py (Cyber Digest project). Signals are matched against headline + summary text; the highest-matching severity band wins, then confidence caps it. Examples: a KEV-listed bug “exploited in the wild” → Critical / Observed; a new zero-day with no exploitation reported → Severe–Elevated / Not yet observed; an unconfirmed single-source claim stays Elevated / Unverified.
Severity currently starts at Guarded for any reported story (everything in a cybersecurity digest is at least noteworthy). High-severity key signals include: CVSS ≥ 7, “exploited in the wild”, “millions of records”, ransomware, supply-chain compromise, nation-state/APT attribution, and OT/ICS physical impact.
Basis in assessment practice
- Threat / vulnerability / risk definitions and the capability × intent × targeting rating scales — NIST SP 800-30 Rev 1; opportunity per ITU-T X.1205
- Intrusion event framing with confidence per event — Diamond Model (Caltagirone et al., 2013)
- Severity vs exploitation separation — CVSS v4 (FIRST.org); observed-exploitation override — CISA KEV
- Band-based risk language and the warnings against false precision — OWASP Risk Rating Methodology
- Ability to estimate / confidence discipline and banded estimative language — ODNI ICD 203 Analytic Standards
- National threat-level presentation style — Australia’s threat advisory system; ASD/ACSC Cyber Threat Report
- Kill-chain phase as severity — Lockheed Martin, Cyber Kill Chain; TTP vocabulary — MITRE ATT&CK
Revision discipline
This index is recomputed from the database on every site build. As the corpus grows the calibrations (band thresholds, decay half-life, weights) may be re-tuned — when that happens the values on this page and the homepage will change together, and the change is disclosed here. If a rating looks wrong, the relevant story card links to its source for verification.