Forecast Briefings
Threat briefings you can act on in five minutes.
Each Forecast Briefing tells a CISO what to decide and tells the engineer who works for them what to do next, from the same page. Every claim is labeled as confirmed, claimed, or our assessment, and every forecast says how likely the threat is and how sure we are.
Latest briefings
-
Attackers are targeting WordPress core during site updates
Attackers are going after a WordPress flaw that lets them take over a site during the few seconds a core update is unpacking, and CISA added it to its list of exploited vulnerabilities on November 3 (CVE-2026-119977). It…
What makes a briefing different
Government advisories are authoritative but rarely say how likely something is or what it means for the business. Vendor research is deep but tied to one vendor’s data. News is fast but thin. A Forecast Briefing does six things in one piece.
Labeled evidence
Every claim is marked as confirmed, claimed, or our assessment, so you always know what you are standing on.
A forecast with confidence
We say how likely a threat is to reach you, in calibrated words, and how confident we are in that call.
What would change our call
We name the signals that would raise or lower the forecast, so a briefing is worth checking back on.
Two audiences, one page
The top serves the executive and the bottom serves the operator, and neither has to read the other’s part.
Ready-to-run detection
Detection logic for Elastic Security and Google Security Operations, with a vendor-neutral Sigma version, each marked tested or untested.
Global sources, visible corrections
Non-English reporting is translated and attributed, and every change to a briefing is dated and explained at the bottom.
How to read a briefing
Three labels and one scale of likelihood words are used the same way in every briefing, so you can calibrate once and trust them everywhere.
Established
Backed by a primary source, or by two independent sources. A vendor advisory confirming a vulnerability and its fixed versions is an example.
Asserted
Stated by an actor, a vendor, or a single source and not independently verified. Ransomware leak-site postings are always claims, and we never name victims from them.
Our judgment
Our own analytic call, always with our confidence stated. Our forecast of which sectors are next is an example.
| Phrase | Probability |
|---|---|
| Almost no chance | 1 to 5% |
| Very unlikely | 5 to 20% |
| Unlikely | 20 to 45% |
| Roughly even chance | 45 to 55% |
| Likely | 55 to 80% |
| Very likely | 80 to 95% |
| Almost certain | 95 to 99% |
Confidence describes the quality of the evidence, not the likelihood of the event, so the two are always stated separately as High, Moderate, or Low. Words like may, could, and possibly never appear in our judgments.
Two views of the same storm
Briefings are built from public reporting. The Dorothy network adds what participants actually see, anonymously, and the two are never mixed in our analysis. If you run a SIEM and want earlier warning, become a Station.
Cyber Forecast is founded and operated by NuHarbor Security. Made in Vermont.
Forecast Briefings are for awareness, not a guarantee. Verify against your own environment before acting. Ransomware leak-site figures are claims published by criminal groups, not confirmed breaches.
Briefings · Live forecast · Dorothy network · Governance and privacy · Funding · Join