Scenario

CHECKED 2026-11-06 00:00Z

Major cyber event on US infrastructure

Signs of a large cyber attack on the US power, water, communications or other systems people depend on.

All scenarios ▶

The count

NORMAL

1 of 6 signs lit.

Not enough signs lit to change the status.

1 of 6 signs lit, from 1 module. 4 not evaluated.

ELEVATED at: 3 of 6 signs lit
MAYDAY at: 5 of 6 signs lit
Not evaluated: 4
Modules lit: World Pulse
Weighted: 1.0 of 6.0
Likelihood ratio: 1.0
Checked: 2026-11-06 00:00Z

Counts are for reading. The status line uses each sign's likelihood ratio: how much more often it lit before a real event than on a normal day. Every weight is 1.0 until the backtest learns them, so today the two agree. A scenario counts only with lit signs from two or more modules.

Signs

6 SIGNS

Lit means the sign's metric crossed its bar. Not lit means it did not. Not evaluated means we had no data to judge, which is not the same as not lit.

NOT LIT CISA gives federal agencies an emergency order about a threat
New CISA emergency directive · Homeland Baseline · weight 1.0
None in the last week.
Confidence MODERATE: One source graded B2 or better.
RECEIPT ▶
WHY IT IS A SIGN, AND HOW IT CAN BE GAMED
An emergency directive is CISA's strongest order. It comes when a threat is active against federal networks.
HOW IT CAN BE GAMED Directives follow federal policy timing as well as threats.
WHAT WE DO Only a new emergency directive counts, by its number.
Cost to game it: high.
NOT EVALUATED Far more actively exploited flaws than normal added to CISA's list
KEV adds over baseline · Homeland Baseline · weight 1.0
Still learning what normal looks like.
Confidence LOW: No data to judge.
RECEIPT ▶
WHY IT IS A SIGN, AND HOW IT CAN BE GAMED
A jump in known exploited flaws means attackers are busy against systems in use.
HOW IT CAN BE GAMED CISA adds old flaws in batches when it clears a backlog.
WHAT WE DO Additions count against their own baseline, and a batch of old entries shows in the receipt.
Cost to game it: high.
NOT EVALUATED Far more US ransomware victims posted than normal
ransomware.live US victims over baseline · Homeland Baseline · weight 1.0
Still learning what normal looks like.
Confidence LOW: No data to judge.
RECEIPT ▶
WHY IT IS A SIGN, AND HOW IT CAN BE GAMED
A wave of victims in one country can mean a campaign aimed at it.
HOW IT CAN BE GAMED Groups post old victims in batches, or false claims to look busy.
WHAT WE DO Counts only, never names or links, read against the country's own baseline.
Cost to game it: low.
NOT EVALUATED Cloudflare reports an outage or an attack spike in a US region
Cloudflare Radar outage or attack anomaly for a US region · World Pulse · scored by an editor · weight 1.0
Needs an editor. No mark yet.
Confidence LOW: No data to judge.
RECEIPT ▶
WHY IT IS A SIGN, AND HOW IT CAN BE GAMED
Cloudflare carries a large share of internet traffic. An outage or attack spike it flags is real.
HOW IT CAN BE GAMED A large outage with a mundane cause, such as a bad update or a cut cable, looks like an attack.
WHAT WE DO An editor marks it from Cloudflare's own outage or attack note until the Radar keys exist.
Cost to game it: high.
LIT A large internet outage in a US state
IODA internet outage in a US state · World Pulse · weight 1.0
Seen 3 times in the last 24 hours.
Confidence MODERATE: One source graded B2 or better.
RECEIPT ▶
WHY IT IS A SIGN, AND HOW IT CAN BE GAMED
Attacks on networks and on power show up as outages across a state.
HOW IT CAN BE GAMED Power cuts, storms and cable cuts take networks down too.
WHAT WE DO Only IODA's critical alerts for a US state count.
Cost to game it: high.
NOT EVALUATED Food places near Fort Meade are at MAYDAY
Fort Meade ring MAYDAY · Mayday Index · weight 1.0
Not enough data in the last hour.
Confidence LOW: No data to judge.
RECEIPT ▶
WHY IT IS A SIGN, AND HOW IT CAN BE GAMED
Fort Meade is home to the NSA and Cyber Command. Late nights there come with cyber operations.
HOW IT CAN BE GAMED The theory is public and the base rate of spikes with nothing going on was never published. One actor can flood crowd reports.
WHAT WE DO Low weight and never alone. We publish the base rate ourselves. Turnstile, one report per address per venue per day, the median and a three-venue minimum.
Cost to game it: low.

What we cannot see

COLLECTION GAPS

Incidents not yet disclosed.
Classified attribution.
Private network telemetry.
Cloudflare Radar data until an editor marks it.
Far more actively exploited flaws than normal added to CISA's list: still learning what normal looks like.
Far more US ransomware victims posted than normal: still learning what normal looks like.
Cloudflare reports an outage or an attack spike in a US region: needs an editor. No mark yet.
Food places near Fort Meade are at MAYDAY: not enough data in the last hour.

Key assumptions

Outages and advisories in the same window share a cause.
A rise in ransomware posts reflects new attacks, not a leak site catching up on old ones.

Other explanations

WHAT WOULD CONFIRM EACH

A large outage with no attacker: a bad software update, a cable cut or a cloud failure.
Would confirm it: The provider's incident report naming a configuration or hardware cause.
A ransomware group posting old victims in a batch.
Would confirm it: Victim posts dated weeks earlier, or the group's known habit of posting in batches.
A severe flaw under mass scanning, with no coordinated attack.
Would confirm it: CISA guidance that names attempts to exploit it but no harm to infrastructure.

Sources

ADMIRALTY GRADES

CISA advisories: A2 (completely reliable, probably true)
CISA known exploited vulnerabilities: A2 (completely reliable, probably true)
ransomware.live: C3 (fairly reliable, possibly true)
Mayday Desk editor: B2 (usually reliable, probably true)
IODA internet outage: B2 (usually reliable, probably true)
Mayday Index: D4 (not usually reliable, doubtful)