{
  "notice": "Please credit \"Is software solved?\" and the sources listed in credits when you reuse these numbers. They are our own aggregates. For original records, go to each source.",
  "id": "security",
  "name": "Security",
  "question": "Are we still getting pwned?",
  "metric": "Added to CISA's exploited list, last 12 months",
  "solvedIf": "Exploited vulnerabilities trend toward zero",
  "value": "313",
  "change": "+24%",
  "trend": [
    {
      "label": "2024-01-14",
      "value": 196
    },
    {
      "label": "2024-02-13",
      "value": 203
    },
    {
      "label": "2024-03-14",
      "value": 195
    },
    {
      "label": "2024-04-13",
      "value": 184
    },
    {
      "label": "2024-05-13",
      "value": 174
    },
    {
      "label": "2024-06-12",
      "value": 176
    },
    {
      "label": "2024-07-12",
      "value": 159
    },
    {
      "label": "2024-08-11",
      "value": 162
    },
    {
      "label": "2024-09-10",
      "value": 178
    },
    {
      "label": "2024-10-10",
      "value": 174
    },
    {
      "label": "2024-11-09",
      "value": 180
    },
    {
      "label": "2024-12-09",
      "value": 177
    },
    {
      "label": "2025-01-08",
      "value": 182
    },
    {
      "label": "2025-02-07",
      "value": 189
    },
    {
      "label": "2025-03-09",
      "value": 200
    },
    {
      "label": "2025-04-08",
      "value": 222
    },
    {
      "label": "2025-05-08",
      "value": 231
    },
    {
      "label": "2025-06-07",
      "value": 242
    },
    {
      "label": "2025-07-07",
      "value": 251
    },
    {
      "label": "2025-08-06",
      "value": 253
    },
    {
      "label": "2025-09-05",
      "value": 251
    },
    {
      "label": "2025-10-05",
      "value": 241
    },
    {
      "label": "2025-11-04",
      "value": 252
    },
    {
      "label": "2025-12-04",
      "value": 240
    },
    {
      "label": "2026-01-03",
      "value": 245
    },
    {
      "label": "2026-02-02",
      "value": 248
    },
    {
      "label": "2026-03-04",
      "value": 242
    },
    {
      "label": "2026-04-03",
      "value": 244
    },
    {
      "label": "2026-05-03",
      "value": 256
    },
    {
      "label": "2026-06-02",
      "value": 254
    },
    {
      "label": "2026-07-02",
      "value": 257
    },
    {
      "label": "2026-08-01",
      "value": 265
    },
    {
      "label": "2026-08-31",
      "value": 281
    },
    {
      "label": "2026-09-30",
      "value": 308
    },
    {
      "label": "2026-10-30",
      "value": 313
    }
  ],
  "trendLabel": "Rolling 12-month total, with one point per month.",
  "chartNote": "This chart shows counts. The score below adjusts counts for git pushes, so the two can move in opposite directions.",
  "caution": [
    "The data behind this score starts in January 2024, so it misses the first 14 months after ChatGPT launched.",
    "The score divides this count by git pushes. If AI agents are inflating the number of pushes, it can improve even if software is no more reliable."
  ],
  "score": 25,
  "scoreReason": "Per git push: Down 44% since January 2024, when the data starts.",
  "fromHigh": "At its high",
  "status": "Getting worse",
  "rule": "Getting worse when more exploited vulnerabilities are listed than a year before.",
  "direction": "away",
  "checks": [
    {
      "date": "2026-11-02",
      "value": "313",
      "change": "+24%",
      "status": "Getting worse"
    },
    {
      "date": "2026-11-01",
      "value": "313",
      "change": "+24%",
      "status": "Getting worse"
    }
  ],
  "url": "/signals/security",
  "api": "/api/signals/security.json",
  "credits": [
    {
      "name": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "signal": "security",
      "license": "CC0 1.0",
      "credit": "Data from the CISA Known Exploited Vulnerabilities catalog. Use does not imply endorsement by CISA or DHS. We count entries and publish the results."
    },
    {
      "name": "Exploit-DB",
      "url": "https://www.exploit-db.com/",
      "signal": "security",
      "license": "GPL-2.0",
      "credit": "Dates from the Exploit Database by OffSec. We count entries and publish the results."
    },
    {
      "name": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "signal": "security",
      "license": "CC BY 4.0",
      "credit": "Breach data from Have I Been Pwned (haveibeenpwned.com). We count verified breaches and publish the results."
    },
    {
      "name": "OSV",
      "url": "https://osv.dev/",
      "signal": "security",
      "license": "CC BY 4.0 and Apache 2.0, by upstream database",
      "credit": "Data from OSV, including the GitHub Advisory Database, PyPI Advisory Database and OpenSSF Malicious Packages. We count entries and publish the results."
    },
    {
      "name": "pwn.watch",
      "url": "https://pwn.watch/",
      "signal": "security",
      "license": "No license published",
      "credit": "Incident data from pwn.watch by @thekitze. We count records and publish our own analysis."
    }
  ]
}