Confirmed incidentsweight 15%97
Breaches and attacks Vexday investigated and confirmed with the victim or a regulator.
Rises when more serious incidents are confirmed in the period: verified cases, not rumors.
BOARD INTELLIGENCE
Today's cyber risk, in a number the board understands.
A daily index of the threat landscape for Brazil, from 0 to 100. The higher it is, the more dangerous the moment. Every point traces back to the data behind it, with no black box. Updated live, from open and verified sources.
48
Elevated
out of 100 · higher means more dangerous
Calm
Moderate
Elevated
High
Critical
020406080100
Last 31 days
THE MONTH FOR THE BOARD
November 2026
Month in progress: figures run to today.
Average index for the month41.5Elevatedpeak of 47.4 on Nov 7 · low of 37.3 · 55.4 in October
For the meeting
- The threat index for Brazil averaged 41.5 (elevated); in October, it was 55.4. It peaked at 47.4 on November 7.
- 3 flaws were added to CISA's Known Exploited Vulnerabilities catalog (KEV). Among them: CVE-2024-27834 (Apple Multiple Products).
- 7 Brazilian organizations appeared on ransomware extortion sites (29 in October); the most active group was thegentlemen, with 3 victims.
- Vexday published 37 incidents this month, and Brazil's government (CTIR Gov and CISC) issued one official alert.
3New in KEV−31 vs Oct
7Ransomware victims in Brazil−22 vs Oct
37Published incidents−79 vs Oct
1Official alerts−26 vs Oct
308New critical flaws−1,303 vs Oct
Added to KEV
- CVE-2024-27834Apple Multiple Products
- CVE-2026-119977WordPress Core
- CVE-2026-19868SonicWall SonicOS SSLVPN
Most active groups against Brazil
- thegentlemen3 victims
- Aoqin1 victim
- Destello1 victim
- lockbit51 victim
- medusalocker1 victim
Published incidents
- MetaMask Staking: 0,385 ETH desviados, 17 mil validadores retiradosconfirmed
- Planilha de FOI expôs saúde de 8 mil funcionários do NHSconfirmed
- DigiCert deixou arquivo de identidades exposto por 16 mesesconfirmed
- Biblioteca de Queens parada por ransomware; dados, sem respostaconfirmed
- App escolar da Irlanda do Norte admite acesso indevidoconfirmed
Official alerts
- Boletim do CISC de VulnerabilidadesCISC · Nov 4
Sources: CISA KEV, CVE List and NVD, ransomware.live, CTIR Gov and CISC (CC BY-ND 3.0: number, title and link only) and the Vexday MORGUE (published cases only). The index reads the threat landscape, not any one company's exposure.
This product uses data from the NVD API but is not endorsed or certified by the NVD.
vexday.io · Generated on November 7, 2026
What makes up the number today
The index is the weighted average of seven signals. Below, each one in order of how much it weighs right now, with what it measures and what makes it rise.
Ransomware in Brazilweight 20%52
Brazilian organizations appearing on ransomware groups' extortion sites.
Rises when more Brazilian companies are listed by criminal groups, a direct sign of activity against the country.
Active groupsweight 10%80
Threat groups with concrete recent activity (newly claimed victims).
Rises when more criminal groups are actively operating in the period.
Active exploitationweight 20%22
Vulnerabilities attackers are already exploiting in the wild, per CISA's KEV catalog.
Rises when more flaws come under active attack than usual: attackers have new ready-made weapons.
New critical flawsweight 10%43
Newly disclosed critical-severity vulnerabilities.
Rises when more critical flaws appear than usual: more doors potentially open.
Momentumweight 10%41
The direction of the index itself: is the landscape getting worse or better than the previous week.
Above 50, risk has been rising; below, falling.
Exploitation pressureweight 15%16
The statistical probability (EPSS) that vulnerabilities will be exploited is increasing.
Rises when many flaws gain attack probability at once: the landscape becomes more flammable.
How the index is calculated
01
Each signal becomes a score from 0 to 100
We compare the last 7 days of activity with the average of the last 90. A signal at its historical normal scores 50. If it doubles, it rises to ~75. If it halves, it drops to ~25. So the number answers “is today worse than normal?”, not an absolute value without context.
02
Signals are weighted
Not everything weighs the same. Active exploitation and ransomware in Brazil weigh the most (20% each), as the most direct signs of present danger. Confirmed incidents and exploitation pressure follow (15%). Groups, critical flaws and momentum make up the rest at 10% each.
03
The result falls into a named zone
The weighted average sets the day's zone: Calm (0–20), Moderate (20–40), Elevated (40–60), High (60–80) or Critical (80–100). The board reads the zone at a glance; the number gives the precision.
04
Everything is auditable
We keep the raw numbers behind every signal, every day. You can open any point in the history and see exactly what went into it. The index is never an opinion: it's a calculation you can redo.
Where the data comes from
Only open and verifiable sources, never leaked content. CISA's KEV catalog (active exploitation), FIRST's EPSS (exploitation probability), the CVE database, ransomware groups' extortion sites and Vexday's own incident curation, where every case carries an explicit confidence label.
See the verified incidents →