Cyber incident maps & source-linked research
Understand where cases were reported without turning a disclosure map into a live-attack claim.
Product guide · Updated 25 October 2026A country is context, not an attack origin
The cyber map uses victim countries of operation coded by the VERIS Community Database. It does not locate an attacker, a compromised server or an exact event coordinate. A case can involve several countries and count once in each country while counting once in the global total. Unlocated cases remain available in a separate feed.
Keep dates honest
The default week uses cases with a known incident day. A month-only or year-only report cannot establish that an incident happened in a particular week. Wider archive views can include those less precise records, and their source date precision remains visible in the evidence. Imported coverage and the latest available incident date are shown explicitly.
Know which kind of signal you are reading
The incident feed includes community-coded confirmed cases, suspected cases and near misses, with their source status attached. Reporting metadata and CISA exploited-vulnerability references are separate global feeds. A vulnerability’s inclusion in an advisory does not establish an incident in any country and never adds a location to the map.
Account for the dataset’s limits
The current imported incident layer contains 8,262 security cases across 137 victim countries, with incident dates through June 10, 2026. Disclosure practices and community collection create uneven coverage. More reports do not necessarily mean more risk. VCDB data is used under CC BY-SA 4.0, with attribution and normalization notices retained.