BOARD INTELLIGENCE

Today's cyber risk, in a number the board understands.

A daily index of the threat landscape for Brazil, from 0 to 100. The higher it is, the more dangerous the moment. Every point traces back to the data behind it, with no black box. Updated live, from open and verified sources.

48
Elevated
out of 100 · higher means more dangerous
Calm
Moderate
Elevated
High
Critical
020406080100
Last 31 days
THE MONTH FOR THE BOARD

January 2026

Average index for the monthThe index has no computed days for this month.
For the meeting
  • 17 flaws were added to CISA's Known Exploited Vulnerabilities catalog (KEV), 2 of them tied to ransomware. Among them: CVE-2026-23760 (SmarterTools SmarterMail).
  • 20 Brazilian organizations appeared on ransomware extortion sites (20 in December); the most active group was lockbit5, with 9 victims.
  • Vexday published no incidents this month, and Brazil's government (CTIR Gov and CISC) issued one official alert.
17New in KEV−3 vs Dec · 2 with ransomware
20Ransomware victims in Brazilsame as Dec
0Published incidentssame as Dec
1Official alerts+1 vs Dec
428New critical flaws+3 vs Dec

Added to KEV

Most active groups against Brazil

Published incidents

Nothing this month.

Official alerts

Sources: CISA KEV, CVE List and NVD, ransomware.live, CTIR Gov and CISC (CC BY-ND 3.0: number, title and link only) and the Vexday MORGUE (published cases only). The index reads the threat landscape, not any one company's exposure.

This product uses data from the NVD API but is not endorsed or certified by the NVD.

vexday.io · Generated on November 7, 2026

See the full month in Replay →

The same report, with your stack

With a free account, the monthly report also covers what you track: the technologies and CVEs added to KEV, the CISA deadlines, the alerts delivered and the groups you follow.

Create free accountServing several companies? See Vexday for MSSPs →

What makes up the number today

The index is the weighted average of seven signals. Below, each one in order of how much it weighs right now, with what it measures and what makes it rise.

Confirmed incidentsweight 15%97

Breaches and attacks Vexday investigated and confirmed with the victim or a regulator.

Rises when more serious incidents are confirmed in the period: verified cases, not rumors.

Ransomware in Brazilweight 20%52

Brazilian organizations appearing on ransomware groups' extortion sites.

Rises when more Brazilian companies are listed by criminal groups, a direct sign of activity against the country.

Active groupsweight 10%80

Threat groups with concrete recent activity (newly claimed victims).

Rises when more criminal groups are actively operating in the period.

New critical flawsweight 10%44

Newly disclosed critical-severity vulnerabilities.

Rises when more critical flaws appear than usual: more doors potentially open.

Active exploitationweight 20%22

Vulnerabilities attackers are already exploiting in the wild, per CISA's KEV catalog.

Rises when more flaws come under active attack than usual: attackers have new ready-made weapons.

Momentumweight 10%41

The direction of the index itself: is the landscape getting worse or better than the previous week.

Above 50, risk has been rising; below, falling.

Exploitation pressureweight 15%16

The statistical probability (EPSS) that vulnerabilities will be exploited is increasing.

Rises when many flaws gain attack probability at once: the landscape becomes more flammable.

How the index is calculated

01

Each signal becomes a score from 0 to 100

We compare the last 7 days of activity with the average of the last 90. A signal at its historical normal scores 50. If it doubles, it rises to ~75. If it halves, it drops to ~25. So the number answers “is today worse than normal?”, not an absolute value without context.

02

Signals are weighted

Not everything weighs the same. Active exploitation and ransomware in Brazil weigh the most (20% each), as the most direct signs of present danger. Confirmed incidents and exploitation pressure follow (15%). Groups, critical flaws and momentum make up the rest at 10% each.

03

The result falls into a named zone

The weighted average sets the day's zone: Calm (0–20), Moderate (20–40), Elevated (40–60), High (60–80) or Critical (80–100). The board reads the zone at a glance; the number gives the precision.

04

Everything is auditable

We keep the raw numbers behind every signal, every day. You can open any point in the history and see exactly what went into it. The index is never an opinion: it's a calculation you can redo.

Where the data comes from

Only open and verifiable sources, never leaked content. CISA's KEV catalog (active exploitation), FIRST's EPSS (exploitation probability), the CVE database, ransomware groups' extortion sites and Vexday's own incident curation, where every case carries an explicit confidence label.

See the verified incidents →