How the critical infrastructure monitor works

What is collected

DFX reads only what a site's robots.txt allows under our declared user agent, DFX-Cyber-Sentinel. A path it disallows, or a site whose robots.txt cannot be read, is skipped and shown as not checked, never as operational. Most providers are read from the incident feed they publish for subscribers, no more often than every 15 minutes. That feed does not state impact, so impact prints as not stated and is never inferred from a post's title. Each provider's source is named on its page. One request per provider, with a cached-version check, an eight-second timeout, six at a time. Nothing is scanned, probed, logged into or tested. Every update to a provider post is stored with the time DFX first saw it, and a later edit does not overwrite what was stored. A post's title and current status show the latest the provider published.

Public institutions

Libraries, cities, school districts and agencies rarely publish a machine-readable status feed, so DFX reads their homepages, catalogs and official status pages with one ordinary request every ten to fifteen minutes. It records whether each page answers, whether its content collapses to a short notice, and whether official wording such as "network disruption", "out of an abundance of caution" or "restored" appears. Several services of one institution failing together raises an internal review. A site that refuses automated reads is shown as blocked, which is our limitation, not a fault at the institution. None of this is published as a claim of attack. The design comes from the Queens Public Library ransomware case of November 2026, where no public signal preceded the library's own announcement.

Vendors that serve many public institutions (library platforms, municipal website and payment providers, school systems) are followed through their public status feeds, because a shared provider's notice reaches many institutions at once.

How evidence is graded

A Confirmed

The organisation, a regulator or a court confirms a cyber incident, or compelling independent evidence establishes it.

B Strongly corroborated

Several credible independent sources support an incident without official confirmation.

C Unexplained disruption

A verifiable operational disruption whose cause is not established. Published as a disruption, never as an attack.

D Weak or ambiguous

Limited evidence or plausibly routine activity. Held for research, not published.

E Explained or disproven

Shown to have a non-cyber cause, or the original report was false. Kept, with the correction, rather than deleted.

Separate scores are kept for how sure we are that something happened, how sure we are that a cyber cause produced it, the operational severity, the systemic importance and the investigation priority. None of them is a probability of compromise.

What is published, and what is not

• Provider status posts are published automatically as what the provider said, with a classification of the wording it used.
• A provider using words like "unauthorized" or asking customers to reset credentials raises an internal review. It is never turned into a public claim of attack by software.
• Confirmed cyber incidents appear only after an analyst grades them A or B against the sources.
• Suspicions of compromise without confirmation stay in a restricted research queue unless reviewed and approved.
• A documented customer relationship is shown as a relationship, never as an impact, unless the impact itself is confirmed.
• Corrections are recorded with the original value, the new value and the reason.

What this cannot see

• Organisations without a public machine-readable status feed, including several large core banking processors and most utilities, are covered only through research.
• Intrusions that never disrupt a service leave no status post. In the historical backtest about a fifth of confirmed incidents showed nothing public before disclosure.
• The lead time measured historically is short: a median of about one day from the first live-detectable signal to acknowledgement.
• DNS, certificate and routing changes showed no early-warning value in the research sample and are not used to raise signals.
• A quiet day means no material change within monitored coverage, not that nothing happened.