{
  "date": "2026-10-16",
  "generatedAt": "2026-10-16T09:55:01.832970+00:00",
  "methodVersion": "1.0",
  "partial": false,
  "sources": [
    {
      "name": "CISA",
      "kind": "government",
      "url": "https://www.cisa.gov/cybersecurity-advisories/all.xml",
      "ok": true,
      "fetchedAt": "2026-10-16T09:55:01.832970+00:00",
      "items": 30,
      "matched": 10,
      "excluded": {
        "no theme match": 12,
        "commercial content": 1,
        "older than 14 days": 7
      }
    },
    {
      "name": "CERT-EU",
      "kind": "government",
      "url": "https://cert.europa.eu/publications/security-advisories-rss",
      "ok": true,
      "fetchedAt": "2026-10-16T09:55:01.832970+00:00",
      "items": 10,
      "matched": 0,
      "excluded": {
        "no theme match": 3,
        "older than 14 days": 7
      }
    },
    {
      "name": "NCSC",
      "kind": "government",
      "url": "https://www.ncsc.gov.uk/api/1/services/v1/all-rss-feed.xml",
      "ok": true,
      "fetchedAt": "2026-10-16T09:55:01.832970+00:00",
      "items": 20,
      "matched": 0,
      "excluded": {
        "no theme match": 5,
        "older than 14 days": 15
      }
    },
    {
      "name": "BleepingComputer",
      "kind": "press",
      "url": "https://www.bleepingcomputer.com/feed/",
      "ok": true,
      "fetchedAt": "2026-10-16T09:55:01.832970+00:00",
      "items": 15,
      "matched": 1,
      "excluded": {
        "no theme match": 14
      }
    }
  ],
  "themes": [
    {
      "id": "ot",
      "label": "OT & connected devices",
      "share": 47.66049152412513,
      "rawShare": 47.66049152412513,
      "points": 5.061099964189324,
      "count": 6,
      "delta": null,
      "action": "Separate device zones from business workloads. Review integrator and maintenance access before enforcing changes."
    },
    {
      "id": "identity",
      "label": "Identity & service access",
      "share": 34.85670363270222,
      "rawShare": 34.85670363270222,
      "points": 3.7014570321401106,
      "count": 3,
      "delta": null,
      "action": "Map which workloads need identity services. Limit reachable protocols and separate identity administration; network rules do not replace identity controls."
    },
    {
      "id": "management",
      "label": "Management & remote access",
      "share": 9.094934615008258,
      "rawShare": 9.094934615008258,
      "points": 0.9657972837108187,
      "count": 1,
      "delta": null,
      "action": "Separate management traffic from application traffic. Restrict administrative access to named, controlled entry points."
    },
    {
      "id": "egress",
      "label": "Egress & command-and-control",
      "share": 6.004845651958144,
      "rawShare": 6.004845651958144,
      "points": 0.6376586380504319,
      "count": 1,
      "delta": null,
      "action": "Review workload egress destinations and protocols. An allowed channel can still carry malicious traffic."
    },
    {
      "id": "lateral",
      "label": "Lateral movement",
      "share": 2.383024576206256,
      "rawShare": 2.383024576206256,
      "points": 0.2530549982094662,
      "count": 1,
      "delta": null,
      "action": "Test whether a compromised workload can reach unrelated workloads. Keep required flows explicit."
    },
    {
      "id": "workloads",
      "label": "Workload & tenant isolation",
      "share": 0.0,
      "rawShare": 0.0,
      "points": 0.0,
      "count": 0,
      "delta": null,
      "action": "Validate workload and tenant boundaries at the actual enforcement point, including host and management paths."
    },
    {
      "id": "recovery",
      "label": "Ransomware & recovery boundaries",
      "share": 0.0,
      "rawShare": 0.0,
      "points": 0.0,
      "count": 0,
      "delta": null,
      "action": "Test whether production credentials and workloads can reach backup administration. Keep recovery access separate."
    },
    {
      "id": "visibility",
      "label": "Flow visibility & policy validation",
      "share": 0.0,
      "rawShare": 0.0,
      "points": 0.0,
      "count": 0,
      "delta": null,
      "action": "Use observed flows to test intended policy. Verify denied paths as well as approved dependencies."
    }
  ],
  "evidence": [
    {
      "id": "30b52d2fc768757d",
      "title": "Johnson Controls EasyIO FG",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-01",
      "source": "CISA",
      "kind": "government",
      "sourceWeight": 2.5,
      "published": "2026-10-06T12:00:00+00:00",
      "firstSeen": "2026-10-16T09:55:01.832970+00:00",
      "matches": {
        "lateral": [
          "lateral movement"
        ]
      },
      "primary": "lateral",
      "cves": [
        "CVE-2026-27872",
        "CVE-2026-27873"
      ]
    },
    {
      "id": "bce52ccd711d90ff",
      "title": "Hitachi Energy Asset Suite",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-03",
      "source": "CISA",
      "kind": "government",
      "sourceWeight": 2.5,
      "published": "2026-10-06T12:00:00+00:00",
      "firstSeen": "2026-10-16T09:55:01.832970+00:00",
      "matches": {
        "ot": [
          "industrial control"
        ]
      },
      "primary": "ot",
      "cves": [
        "CVE-2026-11796",
        "CVE-2026-7395"
      ]
    },
    {
      "id": "3bf96eac7c2fcc85",
      "title": "Hitachi Energy SOI",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-04",
      "source": "CISA",
      "kind": "government",
      "sourceWeight": 2.5,
      "published": "2026-10-06T12:00:00+00:00",
      "firstSeen": "2026-10-16T09:55:01.832970+00:00",
      "matches": {
        "ot": [
          "industrial control"
        ]
      },
      "primary": "ot",
      "cves": [
        "CVE-2026-34197"
      ]
    },
    {
      "id": "4f0c5d36cee95535",
      "title": "Hitachi Energy REB500",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-05",
      "source": "CISA",
      "kind": "government",
      "sourceWeight": 2.5,
      "published": "2026-10-06T12:00:00+00:00",
      "firstSeen": "2026-10-16T09:55:01.832970+00:00",
      "matches": {
        "ot": [
          "industrial control"
        ]
      },
      "primary": "ot",
      "cves": [
        "CVE-2024-8176",
        "CVE-2025-59375"
      ]
    },
    {
      "id": "db461caabe0c965b",
      "title": "Hitachi Energy RTU500",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-06",
      "source": "CISA",
      "kind": "government",
      "sourceWeight": 2.5,
      "published": "2026-10-06T12:00:00+00:00",
      "firstSeen": "2026-10-16T09:55:01.832970+00:00",
      "matches": {
        "ot": [
          "industrial control"
        ]
      },
      "primary": "ot",
      "cves": [
        "CVE-2010-2965",
        "CVE-2014-9195",
        "CVE-2023-46143",
        "CVE-2026-8065",
        "CVE-2026-8066",
        "CVE-2026-8067"
      ]
    },
    {
      "id": "fad0f7b297536f4d",
      "title": "Grid Protection Alliance openPDC and openHistorian",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02",
      "source": "CISA",
      "kind": "government",
      "sourceWeight": 2.5,
      "published": "2026-10-08T12:00:00+00:00",
      "firstSeen": "2026-10-16T09:55:01.832970+00:00",
      "matches": {
        "identity": [
          "service account"
        ]
      },
      "primary": "identity",
      "cves": [
        "CVE-2026-100730",
        "CVE-2026-101022",
        "CVE-2026-104629",
        "CVE-2026-105278",
        "CVE-2026-105281",
        "CVE-2026-85479"
      ]
    },
    {
      "id": "0b5b8a5c7759b503",
      "title": "CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure",
      "url": "https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure",
      "source": "CISA",
      "kind": "government",
      "sourceWeight": 2.5,
      "published": "2026-10-13T12:00:00+00:00",
      "firstSeen": "2026-10-16T09:55:01.832970+00:00",
      "matches": {
        "identity": [
          "credential theft"
        ],
        "egress": [
          "exfiltration"
        ]
      },
      "primary": "identity",
      "cves": [
        "CVE-2026-104935"
      ]
    },
    {
      "id": "769eb8106e41d884",
      "title": "Guangzhou Juan IoT Technology EseeCloud",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02",
      "source": "CISA",
      "kind": "government",
      "sourceWeight": 2.5,
      "published": "2026-10-15T12:00:00+00:00",
      "firstSeen": "2026-10-16T09:55:01.832970+00:00",
      "matches": {
        "ot": [
          "iot"
        ]
      },
      "primary": "ot",
      "cves": [
        "CVE-2026-105664",
        "CVE-2026-107617",
        "CVE-2026-97858"
      ]
    },
    {
      "id": "86b82961354a0413",
      "title": "Thermo Fisher Torrent Suite Software",
      "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-01",
      "source": "CISA",
      "kind": "government",
      "sourceWeight": 2.5,
      "published": "2026-10-15T12:00:00+00:00",
      "firstSeen": "2026-10-16T09:55:01.832970+00:00",
      "matches": {
        "identity": [
          "service account"
        ]
      },
      "primary": "identity",
      "cves": [
        "CVE-2026-107777"
      ]
    },
    {
      "id": "ea0e140b6f9eb8ea",
      "title": "J4Care dcm4che",
      "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02",
      "source": "CISA",
      "kind": "government",
      "sourceWeight": 2.5,
      "published": "2026-10-15T12:00:00+00:00",
      "firstSeen": "2026-10-16T09:55:01.832970+00:00",
      "matches": {
        "ot": [
          "dicom"
        ]
      },
      "primary": "ot",
      "cves": [
        "CVE-2026-101021",
        "CVE-2026-105273",
        "CVE-2026-105279",
        "CVE-2026-105667",
        "CVE-2026-107621",
        "CVE-2026-97851"
      ]
    },
    {
      "id": "379db0c8ad00f803",
      "title": "BeyondTrust patches zero-day exploited in attacks since August",
      "url": "https://www.bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-in-attacks-since-august",
      "source": "BleepingComputer",
      "kind": "press",
      "sourceWeight": 1.0,
      "published": "2026-10-16T06:18:08+00:00",
      "firstSeen": "2026-10-16T09:55:01.832970+00:00",
      "matches": {
        "management": [
          "beyondtrust"
        ]
      },
      "primary": "management",
      "cves": []
    }
  ],
  "newItems": 11,
  "duplicatesRemoved": 0,
  "comparisonDate": null
}