US Critical Infrastructure Cyber Intelligence

Where the findings are

Shaded by the number of public findings in each state. A filled marker means the finding documents a site in that state; a ring means it is placed by headquarters only, which says nothing about the area around it. Select a state to filter the page.

Confirmed cyber incidents

Incidents confirmed by the organisation, a regulator or compelling corroborated evidence, reviewed by an analyst. Live provider posts never enter this list on their own.

No confirmed cyber incidents with activity in the last 24 hours within monitored coverage.

Emerging operational signals

What providers published on their own status pages in this window, with the kind of wording they used. A disruption, a restriction or even security language is a provider statement, not a DFX finding that an attack occurred.

No provider status incidents with impact in the last 24 hours.

50 provider status incidents are open right now across monitored providers.

Unexplained disruptions

Verifiable operational disruptions with no established cause. Listed factually, without any claim of compromise.

None published in this window.

National timeline

Research findings and significant provider posts in date order. Event, first public observation and acknowledgement dates are kept separate on each record's page.

No dated developments in this window.

Critical infrastructure sectors

Dependencies and downstream exposure

Documented relationships between providers and the organisations that rely on them, from vendor case studies, customer releases, regulator orders and breach notices. A relationship is not an impact: each dependent says whether impact is confirmed.