{
  "schemaVersion": 1,
  "type": "public-media-reference",
  "publisher": "Protico Community Intelligence",
  "reportTitle": "The Response Gap",
  "referenceDate": "2026-10-22",
  "researchVersion": "1.6",
  "window": {
    "from": "2024-01",
    "through": "2026-09",
    "count": 33
  },
  "partialMonth": {
    "month": "2026-10",
    "from": "2026-10-01",
    "through": "2026-10-21",
    "partial": true,
    "cvePublished": 12543,
    "kevAdded": 24,
    "cveCumulativeSince2024": 173448
  },
  "snapshots": {
    "cve": "2026-10-22T07:01:20.491Z",
    "kevLatestEntry": "2026-10-20"
  },
  "facts": [
    {
      "id": "cve-publications-october-mtd",
      "metric": "cvePublished",
      "unit": "records",
      "previous": {
        "from": "2025-10-01",
        "through": "2025-10-21",
        "value": 2719
      },
      "current": {
        "from": "2026-10-01",
        "through": "2026-10-21",
        "value": 12543
      },
      "changePercent": 361.3,
      "sourceIds": [
        "monthly-cve"
      ],
      "kind": "Protico comparison of saved source counts over matching calendar days"
    },
    {
      "id": "kev-additions-october-mtd",
      "metric": "kevAdded",
      "unit": "records",
      "previous": {
        "from": "2025-10-01",
        "through": "2025-10-21",
        "value": 24
      },
      "current": {
        "from": "2026-10-01",
        "through": "2026-10-21",
        "value": 24
      },
      "changePercent": 0,
      "sourceIds": [
        "kev"
      ],
      "kind": "Protico comparison of saved source counts over matching calendar days"
    }
  ],
  "definitions": {
    "cvePublished": "Official NVD API totalResults for UTC publication-date queries with noRejected; original API responses are retained in the research data package.",
    "kevAdded": "CISA KEV records grouped by catalog dateAdded, not attack date.",
    "changePercent": "100 × (October 1–21, 2026 / October 1–21, 2025 − 1), rounded to one decimal. Each period contains 21 days.",
    "partialMonth": "October 1–21, 2026 is displayed separately from the 33 complete months; it is excluded from moving averages and model before/after comparisons.",
    "seriesRelationship": "Different clocks and units. KEV additions divided by CVE publications do not estimate exploitation probability."
  },
  "limitations": [
    "CVE counts use official NVD API totalResults with noRejected and saved UTC publication-date queries. Retained responses contain one sample CVE and the API aggregate; upstream records remain revisable.",
    "CVE publication dates and CISA KEV catalog-addition dates measure different events. KEV additions divided by CVE publications do not estimate exploitation probability.",
    "The complete series ends September 2026. October 2026 is shown separately through October 21 UTC and compared with October 1–21, 2025. Partial months are excluded from full-month averages.",
    "Model dates provide temporal context. Attribution to AI research tools requires record-level evidence."
  ],
  "downloads": {
    "reproductionKit": "https://labs.protico.io/cybersecurity/response-gap-data.zip",
    "research": "https://labs.protico.io/cybersecurity/research.json",
    "sourceManifest": "https://labs.protico.io/cybersecurity/source-manifest.json",
    "monthlyCSV": "https://labs.protico.io/cybersecurity/monthly.csv"
  },
  "sources": [
    {
      "id": "monthly-cve",
      "publisher": "NIST National Vulnerability Database",
      "status": "active",
      "kind": "Official NVD API 2.0 aggregate snapshots with noRejected",
      "url": "https://nvd.nist.gov/developers/vulnerabilities",
      "retrievedAt": "2026-10-22",
      "capturedFrom": "2026-10-22T06:53:14.923Z",
      "capturedThrough": "2026-10-22T07:01:20.491Z",
      "queryManifest": "raw/nvd/manifest.json"
    },
    {
      "id": "kev",
      "publisher": "CISA",
      "kind": "official catalog snapshot",
      "url": "https://github.com/cisagov/kev-data/blob/fd12990e9c566a1ad3060e1a2073129778f438cc/known_exploited_vulnerabilities.csv",
      "upstreamBlobSha1": "2f6c0943b68f3edab4813ca3ed3642d1c4ac4789",
      "latestDateAdded": "2026-10-20",
      "rows": 1754,
      "upstreamCommit": "fd12990e9c566a1ad3060e1a2073129778f438cc",
      "catalogVersion": "2026.10.21",
      "dateReleased": "2026-10-21T14:04:39.8983Z",
      "retrievedAt": "2026-10-22"
    },
    {
      "id": "official-quarterly-cve",
      "publisher": "CVE Program",
      "kind": "official quarterly reference; kept separate from monthly research",
      "url": "https://github.com/CVEProject/cve-website/blob/f2b4f05012bbbe22905587c6d0c48e23767b1822/src/assets/data/metrics.json",
      "upstreamCommit": "f2b4f05012bbbe22905587c6d0c48e23767b1822",
      "upstreamBlobSha1": "48ef6548429e249e21a5947bd16ff6857bfc41d9",
      "completeThrough": "2026-Q2",
      "retrievedAt": "2026-10-22"
    },
    {
      "id": "idc-spending-2026-03",
      "publisher": "IDC",
      "title": "Global Security Spend to Exceed $300 Billion in 2026 as the Adoption of AI-Driven Security Platforms Gains Momentum",
      "url": "https://www.idc.com/resource-center/press-releases/wwsecuritysg/",
      "publishedAt": "2026-03-03",
      "retrievedAt": "2026-10-22",
      "kind": "forecast",
      "period": null,
      "scope": "Worldwide security spending; IDC Worldwide Security Spending Guide covers core and next-generation security across 28 industries, five company sizes, 38 technology markets and 48 countries.",
      "metrics": [
        {
          "year": 2026,
          "value": 308,
          "unit": "USD billion",
          "status": "forecast"
        },
        {
          "year": 2029,
          "value": 430,
          "unit": "USD billion",
          "status": "forecast"
        },
        {
          "year": 2026,
          "value": 11.8,
          "unit": "percent YoY",
          "status": "forecast"
        }
      ],
      "context": "Both numbers are the March 2026 forecast vintage, not year-end actuals or necessarily the newest paid forecast. Do not mix with Gartner series or the undated IDC event-page update.",
      "supportingUrls": []
    },
    {
      "id": "idc-2027-event-update",
      "publisher": "IDC",
      "title": "IDC IT Security Summit, 2027 Series",
      "url": "https://www.idc.com/mea/events/become-a-sponsor/it-security/",
      "publishedAt": null,
      "retrievedAt": "2026-10-22",
      "kind": "forecast-on-official-event-page",
      "period": null,
      "scope": "Page attributes figures collectively to IDC Worldwide Security Spending Guide 2026 and several other IDC forecasts and surveys.",
      "metrics": [
        {
          "year": 2027,
          "value": 361.9,
          "unit": "USD billion",
          "status": "forecast"
        },
        {
          "year": 2030,
          "value": 512.9,
          "unit": "USD billion",
          "status": "forecast"
        },
        {
          "year": 2027,
          "value": 12.4,
          "unit": "percent YoY",
          "status": "forecast"
        }
      ],
      "context": "Official and accessible on 2026-10-22, but publication date and exact guide vintage are not supplied. Treat as additional context; do not append these values to the March 2026 series as if one version.",
      "supportingUrls": []
    },
    {
      "id": "gartner-total-2026-02",
      "publisher": "Gartner",
      "title": "Forecast Analysis: Information Security, Worldwide, 2026",
      "url": "https://www.gartner.com/en/documents/7408930",
      "publishedAt": "2026-02-05",
      "retrievedAt": "2026-10-22",
      "kind": "forecast",
      "period": null,
      "scope": null,
      "metrics": [
        {
          "year": 2026,
          "value": 244,
          "unit": "USD billion",
          "status": "forecast"
        },
        {
          "year": 2026,
          "value": 11.6,
          "unit": "percent constant-currency growth",
          "status": "forecast"
        }
      ],
      "context": "A more recent Gartner update exists (2026-09-24) but its public abstract has no numeric total. Do not call this February number Gartner's latest forecast.",
      "supportingUrls": []
    },
    {
      "id": "gartner-latest-public-abstract-2026-09",
      "publisher": "Gartner",
      "title": "Forecast: Information Security, Worldwide, 2024-2030, 3Q26",
      "url": "https://www.gartner.com/en/documents/8422113",
      "publishedAt": "2026-09-24",
      "retrievedAt": "2026-10-22",
      "kind": "forecast-abstract-only",
      "period": null,
      "scope": null,
      "metrics": [],
      "context": "Latest located official Gartner forecast. Public abstract states continued growth and its drivers but does not publish annual monetary totals. Do not extract paywalled figures from unofficial blogs and present them as independently checked primary data.",
      "supportingUrls": []
    },
    {
      "id": "gartner-securing-ai-2026-08",
      "publisher": "Gartner",
      "title": "Gartner Forecasts the Market for Securing AI Will Reach $4.8 Billion in 2027",
      "url": "https://www.gartner.com/en/newsroom/press-releases/2026-08-26-gartner-forecasts-the-market-for-securing-ai-will-reach-almost-5-billion-in-2027",
      "publishedAt": "2026-08-26",
      "retrievedAt": "2026-10-22",
      "kind": "forecast",
      "period": null,
      "scope": "Market for securing AI; a subset, NOT all information-security spending and NOT all AI-enabled security products.",
      "metrics": [
        {
          "year": 2026,
          "value": 2.835,
          "unit": "USD billion",
          "status": "forecast"
        },
        {
          "year": 2027,
          "value": 4.783,
          "unit": "USD billion",
          "status": "forecast"
        },
        {
          "year": 2028,
          "value": 7.7,
          "unit": "USD billion",
          "status": "approximate forecast"
        },
        {
          "year": 2027,
          "value": 68.7,
          "unit": "percent YoY",
          "status": "forecast"
        }
      ],
      "context": "Keep this subset separate from overall spending. The same release predicts access-control weaknesses and prompt injection will account for over half of successful attacks on AI agents by 2029; this is a prediction, not observed attack prevalence.",
      "supportingUrls": []
    },
    {
      "id": "ibm-codb-2026",
      "publisher": "IBM / Ponemon Institute",
      "title": "IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average",
      "url": "https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average",
      "publishedAt": "2026-07-29",
      "retrievedAt": "2026-10-22",
      "kind": "observational-study",
      "period": "2025-03 to 2026-02",
      "scope": "602 breached organizations globally. Study conducted by Ponemon Institute, sponsored and analyzed by IBM. Follow-on May 2026 survey had 456 responses and is a separate sample.",
      "metrics": [
        {
          "value": 4.99,
          "unit": "USD million per breach",
          "status": "sample mean, all studied breaches"
        },
        {
          "value": 6,
          "unit": "USD million per breach",
          "status": "sample mean, AI-enabled malicious breaches"
        },
        {
          "value": 25,
          "unit": "percent",
          "status": "approximately one in four malicious breaches were AI-enabled"
        }
      ],
      "context": "Sample averages, not global aggregate losses, a forecast for a particular firm, or proof that AI caused the cost difference. Do not say 25% of all businesses were attacked by AI.",
      "supportingUrls": []
    },
    {
      "id": "ibm-codb-2025-comparator",
      "publisher": "IBM",
      "title": "IBM Report: UK Sees Drop in Breach Costs as AI Speeds Detection",
      "url": "https://uk.newsroom.ibm.com/2025-cost-of-data-breach-UK",
      "publishedAt": "2025-07-30",
      "retrievedAt": "2026-10-22",
      "kind": "observational-study",
      "period": null,
      "scope": null,
      "metrics": [
        {
          "value": 4.44,
          "unit": "USD million per breach",
          "status": "global sample mean in 2025 edition"
        }
      ],
      "context": "Possible two-year comparison: 2025 edition 4.44 to 2026 edition 4.99. Separate annual samples; avoid a causal claim. Keep main emphasis on 2026.",
      "supportingUrls": []
    },
    {
      "id": "marks-spencer-fy2026",
      "publisher": "Marks & Spencer Group plc",
      "title": "Full Year Results for the 52 Weeks Ended 28 March 2026",
      "url": "https://corporate.marksandspencer.com/newsroom/press-releases/full-year-results-52-weeks-ended-28-march-2026",
      "publishedAt": "2026-05-20",
      "retrievedAt": "2026-10-22",
      "kind": "company-results",
      "period": "52 weeks ended 2026-03-28",
      "scope": "RNS note 3 (printed p.37) describes the total as system recovery, risk management and specialist advisory costs caused directly by the incident. Costs are adjusting items because those response and recovery activities would not have been incurred without the incident. The £131.3m figure is not lost revenue, all operating-profit decline, or a complete incident-loss total; the source separately discusses online trading disruption, stock-flow restrictions, markdown and clearance impacts. Insurance is other operating income, managed centrally and not allocated to segments (RNS p.34).",
      "metrics": [
        {
          "value": 131.3,
          "unit": "GBP million",
          "status": "incident-related costs in adjusting items"
        },
        {
          "value": 100,
          "unit": "GBP million",
          "status": "insurance proceeds separately recorded centrally in adjusted profit"
        }
      ],
      "context": "This supersedes using its earlier £300m forecast as an actual final loss. Do not call £31.3m the net total loss; insurance is recorded differently and direct recovery costs do not include every trading impact.",
      "supportingUrls": [
        "https://corporate.marksandspencer.com/sites/marksandspencer/files/2026-05/fy26-rns.pdf#page=37",
        "https://corporate.marksandspencer.com/sites/marksandspencer/files/2026-05/m-and-s-2026-full-year-results.pdf#page=21"
      ]
    },
    {
      "id": "jlr-q3-fy2026",
      "publisher": "JLR",
      "title": "JLR Q3 Performance Impacted by Previously Indicated Challenges",
      "url": "https://www.jlr.com/news/2026/02/jlr-q3-performance-impacted-previously-indicated-challenges",
      "publishedAt": "2026-02-05",
      "retrievedAt": "2026-10-22",
      "kind": "company-results",
      "period": "three months ended 2025-12-31",
      "scope": null,
      "metrics": [
        {
          "value": 64,
          "unit": "GBP million",
          "status": "cyber-incident-related exceptional costs in this quarter"
        }
      ],
      "context": "Quarter only, not total incident cost. Company revenue/profit declines also reflect tariffs, China market conditions and Jaguar model phase-out; do not attribute full changes to the attack.",
      "supportingUrls": []
    },
    {
      "id": "jlr-annual-2026",
      "publisher": "JLR",
      "title": "Annual Report 2026",
      "url": "https://www.jlr.com/annual-report-2026",
      "publishedAt": null,
      "retrievedAt": "2026-10-22",
      "kind": "company-annual-report",
      "period": "FY25/26",
      "scope": null,
      "metrics": [
        {
          "value": 5,
          "unit": "weeks",
          "status": "production paused before restarting 2025-10-08"
        }
      ],
      "context": null,
      "supportingUrls": []
    },
    {
      "id": "fbi-ic3-2025",
      "publisher": "FBI Internet Crime Complaint Center",
      "title": "2025 IC3 Annual Report",
      "url": "https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf",
      "publishedAt": "2026-04",
      "retrievedAt": "2026-10-22",
      "kind": "reported-complaints",
      "period": "calendar 2025",
      "scope": null,
      "metrics": [
        {
          "value": 20.877,
          "unit": "USD billion",
          "status": "all reported losses, individuals and organizations, not enterprise-only"
        },
        {
          "value": 3046598558,
          "unit": "USD",
          "status": "business email compromise reported losses"
        },
        {
          "value": 24768,
          "unit": "complaints",
          "status": "business email compromise complaints"
        }
      ],
      "context": "PDF p. 8 has BEC losses, p. 62 has methodology. IC3 is voluntary reporting and includes individuals. Ransomware losses omit business interruption, wages and recovery services; do not compare its ransomware total against IBM means or company costs as equivalent measures.",
      "supportingUrls": []
    },
    {
      "id": "pwc-dti-2027",
      "publisher": "PwC",
      "title": "2027 Global Digital Trust Insights: C-suite playbook and findings",
      "url": "https://www.pwc.com/us/en/services/consulting/cybersecurity-data-tech-risk/library/global-digital-trust-insights.html",
      "publishedAt": "2026-10-01",
      "retrievedAt": "2026-10-22",
      "kind": "survey",
      "period": null,
      "scope": "Business and technology leaders across 71 countries. Different percentages refer to respondent subgroups.",
      "metrics": [
        {
          "value": 84,
          "unit": "percent",
          "status": "security and finance leaders expecting budget increases"
        },
        {
          "value": 39,
          "unit": "percent",
          "status": "security, risk and operations leaders with fully formalised and integrated cyber-specific operational-continuity plans"
        },
        {
          "value": 22,
          "unit": "percent",
          "status": "respondents willing to authorise fully autonomous AI defensive actions"
        }
      ],
      "context": "Plans and survey responses are not realized 2027 spending or measured control effectiveness. The two percentages have different respondent groups.",
      "supportingUrls": []
    },
    {
      "id": "event-1-source-1",
      "title": "PHP / PHP2Shell",
      "url": "https://www.php.net/archive/2026.php",
      "publishedAt": null,
      "eventDate": "2026-10-21",
      "retrievedAt": "2026-10-22",
      "kind": "vulnerability_disclosure_and_patch",
      "context": "Source link for the incident chronology; discovery, disclosure, patch and incident dates can differ."
    },
    {
      "id": "event-1-source-2",
      "title": "PHP / PHP2Shell",
      "url": "https://calif.io/php2shell/",
      "publishedAt": null,
      "eventDate": "2026-10-21",
      "retrievedAt": "2026-10-22",
      "kind": "vulnerability_disclosure_and_patch",
      "context": "Source link for the incident chronology; discovery, disclosure, patch and incident dates can differ."
    },
    {
      "id": "event-1-source-3",
      "title": "PHP / PHP2Shell",
      "url": "https://cert.europa.eu/publications/security-advisories/2026-018/",
      "publishedAt": null,
      "eventDate": "2026-10-21",
      "retrievedAt": "2026-10-22",
      "kind": "vulnerability_disclosure_and_patch",
      "context": "Source link for the incident chronology; discovery, disclosure, patch and incident dates can differ."
    },
    {
      "id": "event-1-source-4",
      "title": "PHP / PHP2Shell",
      "url": "https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/",
      "publishedAt": null,
      "eventDate": "2026-10-21",
      "retrievedAt": "2026-10-22",
      "kind": "vulnerability_disclosure_and_patch",
      "context": "Source link for the incident chronology; discovery, disclosure, patch and incident dates can differ."
    },
    {
      "id": "event-1-source-5",
      "title": "PHP / PHP2Shell",
      "url": "https://www.wiz.io/blog/php2shell-php-rce",
      "publishedAt": null,
      "eventDate": "2026-10-21",
      "retrievedAt": "2026-10-22",
      "kind": "vulnerability_disclosure_and_patch",
      "context": "Source link for the incident chronology; discovery, disclosure, patch and incident dates can differ."
    },
    {
      "id": "event-2-source-1",
      "title": "eMudhra intermediate certificates",
      "url": "https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/",
      "publishedAt": null,
      "eventDate": "2026-10-20",
      "retrievedAt": "2026-10-22",
      "kind": "certificate_trust_incident",
      "context": "Source link for the incident chronology; discovery, disclosure, patch and incident dates can differ."
    },
    {
      "id": "event-2-source-2",
      "title": "eMudhra intermediate certificates",
      "url": "https://blog.cloudflare.com/emudhra-certificate-compromise/",
      "publishedAt": null,
      "eventDate": "2026-10-20",
      "retrievedAt": "2026-10-22",
      "kind": "certificate_trust_incident",
      "context": "Source link for the incident chronology; discovery, disclosure, patch and incident dates can differ."
    },
    {
      "id": "event-3-source-1",
      "title": "Node.js October security release",
      "url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
      "publishedAt": null,
      "eventDate": "2026-10-21",
      "retrievedAt": "2026-10-22",
      "kind": "vulnerability_disclosure_and_patch",
      "context": "Source link for the incident chronology; discovery, disclosure, patch and incident dates can differ."
    },
    {
      "id": "event-4-source-1",
      "title": "Zeabur October incident",
      "url": "https://zeabur.com/blogs/october-2026-security-incident",
      "publishedAt": null,
      "eventDate": "2026-10-14",
      "retrievedAt": "2026-10-22",
      "kind": "confirmed_intrusion_and_data_access",
      "context": "Source link for the incident chronology; discovery, disclosure, patch and incident dates can differ."
    },
    {
      "id": "event-4-source-2",
      "title": "Zeabur October incident",
      "url": "https://zeabur.com/blogs/august-2026-security-incident",
      "publishedAt": null,
      "eventDate": "2026-10-14",
      "retrievedAt": "2026-10-22",
      "kind": "confirmed_intrusion_and_data_access",
      "context": "Source link for the incident chronology; discovery, disclosure, patch and incident dates can differ."
    },
    {
      "id": "event-4-source-3",
      "title": "Zeabur October incident",
      "url": "https://status.zeabur.com/",
      "publishedAt": null,
      "eventDate": "2026-10-14",
      "retrievedAt": "2026-10-22",
      "kind": "confirmed_intrusion_and_data_access",
      "context": "Source link for the incident chronology; discovery, disclosure, patch and incident dates can differ."
    },
    {
      "id": "event-5-source-1",
      "title": "91APP Commerce Cloud",
      "url": "https://91app.com/blog/91app-202610-security/",
      "publishedAt": null,
      "eventDate": "2026-10-16",
      "retrievedAt": "2026-10-22",
      "kind": "confirmed_data_access_disclosure",
      "context": "Source link for the incident chronology; discovery, disclosure, patch and incident dates can differ."
    },
    {
      "id": "event-6-source-1",
      "title": "Railway environment variables",
      "url": "https://blog.railway.com/p/security-disclosure-wednesday-october-21st",
      "publishedAt": null,
      "eventDate": "2026-10-21",
      "retrievedAt": "2026-10-22",
      "kind": "suspected_unauthorized_access_under_investigation",
      "context": "Source link for the incident chronology; discovery, disclosure, patch and incident dates can differ."
    },
    {
      "id": "event-7-source-1",
      "title": "Japan prime minister PHP warning",
      "url": "https://x.com/takaichi_sanae/status/2112890642590564386",
      "publishedAt": null,
      "eventDate": "2026-10-21",
      "retrievedAt": "2026-10-22",
      "kind": "public_policy_response_not_separate_incident",
      "context": "Source link for the incident chronology; discovery, disclosure, patch and incident dates can differ."
    },
    {
      "id": "nist-ir-2025",
      "publisher": "NIST",
      "title": "NIST SP 800-61 Rev. 3 — Incident Response Recommendations",
      "url": "https://csrc.nist.gov/pubs/sp/800/61/r3/final",
      "publishedAt": "2025-04-03",
      "retrievedAt": "2026-10-22",
      "kind": "guidance",
      "summary": "Plan incident coordination, initial notification and regular status updates; include incident disclosure in supplier agreements; communicate recovery progress.",
      "context": "Voluntary risk-management guidance outside organizations where other instruments require it; not a universal statutory deadline."
    },
    {
      "id": "nist-csf-2024",
      "publisher": "NIST",
      "title": "NIST Cybersecurity Framework 2.0",
      "url": "https://doi.org/10.6028/NIST.CSWP.29",
      "publishedAt": "2024-02-26",
      "retrievedAt": "2026-10-22",
      "kind": "guidance",
      "summary": "Review policies as threats and technology change; define supply-chain requirements, least-privilege access and role-appropriate staff training.",
      "context": "Framework outcomes, not a mandated contract template."
    },
    {
      "id": "cisa-secure-design-2023",
      "publisher": "CISA",
      "title": "U.S. and International Partners Publish Secure-by-Design and -Default Principles and Approaches",
      "url": "https://content.govdelivery.com/accounts/USDHSCISA/bulletins/354a744",
      "publishedAt": "2023-04-13",
      "retrievedAt": "2026-10-22",
      "kind": "guidance",
      "summary": "Manufacturers should own product security outcomes and be transparent and accountable. Clear user instructions do not transfer a supplier's security responsibilities to customers.",
      "context": "The announcement and initial principles were verified; later versions may add detail."
    },
    {
      "id": "nist-genai-2024",
      "publisher": "NIST",
      "title": "NIST AI 600-1 — Generative Artificial Intelligence Profile",
      "url": "https://doi.org/10.6028/NIST.AI.600-1",
      "publishedAt": "2024-07",
      "retrievedAt": "2026-10-22",
      "kind": "guidance",
      "summary": "Review third-party AI contracts, incident ownership, data use, response times and support; prepare and rehearse third-party AI incident response.",
      "context": "Voluntary recommended actions for generative AI risk management."
    },
    {
      "id": "taiwan-pdpa-operative",
      "publisher": "全國法規資料庫",
      "title": "台灣個人資料保護法：第 3、8、12 條及生效狀態",
      "url": "https://law.moj.gov.tw/LawClass/LawOldVer.aspx?pcode=I0050021",
      "publishedAt": "2023-05-31",
      "retrievedAt": "2026-10-22",
      "kind": "guidance",
      "summary": "Article 3 protects specified data-subject rights from advance waiver or contractual restriction; Article 8 addresses notice of data practices and rights; the operative Article 12 addresses notifying affected individuals in its specified circumstances.",
      "context": "Taiwan-specific. As reviewed on 2026-10-22, the main page marks the 2025-11-11 amendments to Article 12 and other provisions as not yet effective, with an undetermined commencement date. The public copy offers general operational recommendations and does not present the amended reporting regime as current law or apply Taiwan law worldwide."
    },
    {
      "id": "ncsc-exercises",
      "publisher": "UK National Cyber Security Centre",
      "title": "Effective steps to cyber exercise creation",
      "url": "https://www.ncsc.gov.uk/guidance/effective-steps-to-cyber-exercise-creation",
      "publishedAt": null,
      "retrievedAt": "2026-10-22",
      "kind": "guidance",
      "summary": "Use realistic incident exercises, relevant participants, metrics and post-exercise lessons to improve response processes.",
      "context": "The source page was reviewed on 2026-10-22; its publication date was not available in the extracted page."
    }
  ],
  "guidance": {
    "zh-Hant": {
      "eyebrow": "服務政策與用戶溝通",
      "title": "資安預算要跟上，對用戶的承諾也要跟上。",
      "intro": "資安事件也牽動企業與用戶之間的責任和信任。Protico 關注服務條款、隱私說明與內部流程如何回應這些變化，並依 NIST、CISA 等機構的公開指引，整理通知、權責與支援管道的五個面向。",
      "cards": [
        {
          "id": "notice",
          "title": "重新與客戶、用戶確認事件應對策略。",
          "body": "與客戶和用戶重新確認事件發生時的標準應對流程：什麼情況啟動、誰負責處理、透過哪個管道聯絡，以及何時提供後續消息。服務中斷時，也要能找到聯絡窗口，掌握影響範圍與處理進度。",
          "sourceIds": [
            "nist-ir-2025"
          ]
        },
        {
          "id": "responsibility",
          "title": "把彼此要做的事寫清楚。",
          "body": "公司負責哪些安全更新、帳號保護與資料維護？用戶何時需要更新裝置、重設憑證或確認異常登入？用簡單例子說明，讓條款能真的拿來用。",
          "sourceIds": [
            "cisa-secure-design-2023"
          ]
        },
        {
          "id": "ai",
          "title": "持續掌握第三方工具的資安規範與標準。",
          "body": "持續檢視第三方服務與 AI 工具的資安要求、資料用途、存取權限，以及事件通知與支援安排。供應商調整功能、條款或安全措施時，同步確認對現有使用方式的影響，更新內部規則與應對流程。",
          "sourceIds": [
            "nist-genai-2024",
            "nist-csf-2024"
          ]
        },
        {
          "id": "support",
          "title": "讓受影響的人知道怎麼求助。",
          "body": "把帳號復原、資料查詢、更正或刪除的申請方式，以及申訴管道放在容易找到的地方。更新條款時，也要保留用戶依法享有的權益。",
          "sourceIds": [
            "taiwan-pdpa-operative"
          ]
        },
        {
          "id": "practice",
          "title": "和同事一起走一遍流程。",
          "body": "用真實工作情境練習：收到可疑訊息、帳號被接管，或供應商發出警報時，誰先接手？客服、產品、法務和資安一起演練，再把卡住的地方改掉。",
          "sourceIds": [
            "ncsc-exercises"
          ]
        }
      ],
      "closing": "Protico Community Intelligence 將分散在社群裡的訊號整理成企業可追蹤的資訊，協助負責團隊查證與回應，讓對外承諾接上日常作業。",
      "sourceLabel": "服務政策與溝通指引來源"
    },
    "en": {
      "eyebrow": "SERVICE POLICY & USER COMMUNICATION",
      "title": "Update your security budget—and your promises to users.",
      "intro": "Security incidents affect the responsibilities and trust between businesses and their users. Protico examines how terms, privacy notices and internal processes address these changes. The five areas below draw on published guidance from NIST, CISA and other institutions.",
      "cards": [
        {
          "id": "notice",
          "title": "Reconfirm the incident response plan with customers and users.",
          "body": "Review the standard response process with customers and users: what triggers it, who takes responsibility, how to get in touch and when updates will follow. Keep a contact route available during outages so people can follow the impact and response progress.",
          "sourceIds": [
            "nist-ir-2025"
          ]
        },
        {
          "id": "responsibility",
          "title": "Make everyone's responsibilities clear.",
          "body": "Explain the company's security updates, account protections and data safeguards. Show users when to update devices, reset credentials or check suspicious logins, using examples they can follow.",
          "sourceIds": [
            "cisa-secure-design-2023"
          ]
        },
        {
          "id": "ai",
          "title": "Keep up with third-party security requirements and standards.",
          "body": "Regularly review the security requirements, data use, access permissions, incident notifications and support arrangements of third-party services and AI tools. When suppliers change features, terms or safeguards, assess the effect on current use and update internal rules and response procedures.",
          "sourceIds": [
            "nist-genai-2024",
            "nist-csf-2024"
          ]
        },
        {
          "id": "support",
          "title": "Make help easy to find.",
          "body": "Provide clear routes for account recovery, data access, correction or deletion requests, and complaints. Preserve users' legal rights when revising terms.",
          "sourceIds": [
            "taiwan-pdpa-operative"
          ]
        },
        {
          "id": "practice",
          "title": "Walk through the process together.",
          "body": "Rehearse suspicious messages, compromised accounts and supplier alerts. Bring support, product, legal and security teams together, agree who takes over and fix the points where the process stalls.",
          "sourceIds": [
            "ncsc-exercises"
          ]
        }
      ],
      "closing": "Protico Community Intelligence organizes signals from community discussions into information businesses can follow, helping the responsible teams verify and respond while keeping service commitments connected to daily operations.",
      "sourceLabel": "Sources on service policy and communication"
    },
    "ja": {
      "eyebrow": "サービス方針と利用者への説明",
      "title": "セキュリティ予算とともに、利用者への約束も見直す。",
      "intro": "セキュリティ事件は、企業と利用者の責任や信頼にも関わります。Protico は、利用規約、プライバシーの説明、社内手順がこうした変化にどう対応するかに注目しています。NIST、CISA などの公開指針から、通知、役割分担、支援窓口に関する五つの観点を整理しました。",
      "cards": [
        {
          "id": "notice",
          "title": "顧客・利用者と、インシデント対応方針を改めて確認する。",
          "body": "顧客や利用者と、問題が起きたときの標準的な対応手順を再確認します。対応を始める条件、担当者、連絡方法、続報の時期を共有し、サービス停止中も窓口を確認できるようにして、影響範囲と対応状況を伝えます。",
          "sourceIds": [
            "nist-ir-2025"
          ]
        },
        {
          "id": "responsibility",
          "title": "それぞれがすることを、具体的に伝える。",
          "body": "会社が担う更新、アカウント保護、データ管理を説明します。利用者が端末の更新、認証情報の再設定、不審なログインの確認を行う場面も、身近な例で示します。",
          "sourceIds": [
            "cisa-secure-design-2023"
          ]
        },
        {
          "id": "ai",
          "title": "外部ツールのセキュリティ要件と基準を継続的に把握する。",
          "body": "外部サービスや AI ツールのセキュリティ要件、データの利用目的、アクセス権限、インシデント通知、支援体制を定期的に確認します。提供元が機能、規約、安全対策を変更した際は、現在の利用方法への影響を確認し、社内ルールと対応手順を見直します。",
          "sourceIds": [
            "nist-genai-2024",
            "nist-csf-2024"
          ]
        },
        {
          "id": "support",
          "title": "困った人が、すぐに相談先を見つけられるように。",
          "body": "アカウント復旧、データの開示・訂正・削除の申請方法や苦情窓口を、見つけやすい場所にまとめます。規約を変える際も、利用者の法的な権利を守ります。",
          "sourceIds": [
            "taiwan-pdpa-operative"
          ]
        },
        {
          "id": "practice",
          "title": "同僚と一緒に、対応を一度やってみる。",
          "body": "不審なメッセージ、アカウント乗っ取り、取引先からの警告を想定します。サポート、製品、法務、セキュリティの担当者で対応を試し、誰が引き継ぐかを確認して、滞る部分を直します。",
          "sourceIds": [
            "ncsc-exercises"
          ]
        }
      ],
      "closing": "Protico Community Intelligence は、コミュニティに分散する兆候を企業が追える情報に整理し、担当者による確認と対応を支えます。利用者への約束を日々の業務につなげるためです。",
      "sourceLabel": "サービス方針と説明に関する参考資料"
    },
    "ko": {
      "eyebrow": "서비스 정책과 이용자 소통",
      "title": "보안 예산과 함께, 사용자와의 약속도 점검해야 합니다.",
      "intro": "보안 사고는 기업과 이용자 사이의 책임과 신뢰에도 영향을 줍니다. Protico는 이용약관, 개인정보 안내와 내부 절차가 이런 변화에 어떻게 대응하는지 살펴봅니다. NIST, CISA 등 기관의 공개 지침을 바탕으로 통지, 역할과 지원 창구에 관한 다섯 가지 항목을 정리했습니다.",
      "cards": [
        {
          "id": "notice",
          "title": "고객·이용자와 사고 대응 방침을 다시 확인하세요.",
          "body": "고객 및 이용자와 사고 발생 시의 표준 대응 절차를 다시 확인하세요. 대응을 시작하는 조건, 담당자, 연락 방법과 후속 안내 시점을 함께 정하고, 서비스 중단 중에도 연락 창구를 통해 영향 범위와 처리 상황을 확인할 수 있도록 하세요.",
          "sourceIds": [
            "nist-ir-2025"
          ]
        },
        {
          "id": "responsibility",
          "title": "각자 해야 할 일을 구체적으로 설명하세요.",
          "body": "회사가 맡는 보안 업데이트, 계정 보호와 데이터 관리를 설명하세요. 사용자가 기기를 업데이트하거나 인증 정보를 재설정하고 의심스러운 로그인을 확인할 때도 쉬운 예시를 제공하세요.",
          "sourceIds": [
            "cisa-secure-design-2023"
          ]
        },
        {
          "id": "ai",
          "title": "외부 도구의 보안 요구사항과 기준을 지속적으로 파악하세요.",
          "body": "외부 서비스와 AI 도구의 보안 요구사항, 데이터 이용 목적, 접근 권한, 사고 통지와 지원 체계를 정기적으로 검토하세요. 공급업체가 기능, 약관이나 보호 조치를 바꾸면 현재 이용 방식에 미치는 영향을 확인하고 내부 규칙과 대응 절차를 갱신하세요.",
          "sourceIds": [
            "nist-genai-2024",
            "nist-csf-2024"
          ]
        },
        {
          "id": "support",
          "title": "도움이 필요한 사람이 쉽게 찾아올 수 있게 하세요.",
          "body": "계정 복구와 데이터 열람·정정·삭제 신청 방법, 이의 제기 창구를 찾기 쉬운 곳에 안내하세요. 약관을 바꿀 때도 사용자가 법적으로 보장받는 권리를 지켜야 합니다.",
          "sourceIds": [
            "taiwan-pdpa-operative"
          ]
        },
        {
          "id": "practice",
          "title": "동료들과 대응 절차를 직접 따라가 보세요.",
          "body": "의심스러운 메시지, 계정 탈취, 공급업체 경고를 가정해 보세요. 고객 지원, 제품, 법무, 보안 담당자가 함께 연습하고, 누가 이어받을지 정한 뒤 막히는 부분을 고치세요.",
          "sourceIds": [
            "ncsc-exercises"
          ]
        }
      ],
      "closing": "Protico Community Intelligence는 커뮤니티에 흩어진 신호를 기업이 추적할 수 있는 정보로 정리합니다. 담당자의 확인과 대응을 도와 이용자와의 약속이 일상 업무로 이어지게 합니다.",
      "sourceLabel": "서비스 정책과 소통 관련 출처"
    }
  },
  "rights": {
    "id": "protico-original-content-attribution-permission",
    "name": "Protico original-content reuse permission",
    "attributionName": "Protico Community Intelligence",
    "url": "https://labs.protico.io/cybersecurity/media-kit/license.txt",
    "permitted": [
      "copy",
      "publish",
      "quote",
      "translate",
      "adapt",
      "commercial and non-commercial use"
    ],
    "conditions": [
      "Credit Protico Community Intelligence.",
      "Link the relevant original language page and retain the reference date and source labels.",
      "Identify translations, excerpts and material changes; do not imply endorsement."
    ],
    "excluded": [
      "third-party reports and datasets",
      "social-post screenshots and other third-party images",
      "logos and trademarks",
      "upstream raw dataset archives"
    ],
    "includedChartData": "Selected numerical facts are provided to understand the original chart; source provenance and applicable upstream terms remain unchanged."
  },
  "locales": {
    "en": {
      "eyebrow": "FOR MEDIA, CREATORS & RESEARCHERS",
      "title": "Bring this research into your story.",
      "intro": "You can quote, translate and adapt Protico’s original text, analysis and charts, including in commercial publications. Credit “Protico Community Intelligence”, link to the original and keep the reference date. Please label translations or other changes. No separate request is needed for uses within this scope.",
      "scope": "This permission covers Protico’s original work only. Third-party reports, datasets, social-post screenshots and logos remain subject to their own permissions or other lawful uses. The kit links to those sources; it does not grant their rights.",
      "download": "Download the media & Agent kit",
      "brief": "Download the Markdown brief",
      "machine": "Download structured JSON",
      "chart": "Download the editable SVG chart",
      "copy": "Copy attribution",
      "copyBrief": "Copy the reference brief",
      "terms": "Read the reuse terms",
      "inside": "What’s in the kit",
      "contents": "Reference briefs in four languages, a source index, metric definitions, editable charts and a file manifest. Ready for reporting, presentations or further reading with research tools.",
      "citationLabel": "Attribution you can use",
      "credit": "Research and analysis: Protico Community Intelligence",
      "dateLabel": "Reference date",
      "changeNote": "Label any translation, excerpt or adaptation.",
      "copied": "Copied. You can paste it into your article or presentation.",
      "copyFailed": "Automatic copying is unavailable. Select and copy the text below.",
      "loading": "Loading the reference materials.",
      "error": "The kit could not be loaded. Please refresh and try again.",
      "snapshot": "Research snapshot",
      "range": "Complete months",
      "sourceLabel": "Main sources",
      "method": "How the numbers were prepared",
      "key": "Numbers to cite",
      "limits": "Context to keep with the numbers",
      "outlook": "What we are watching next",
      "advice": "Protico’s view",
      "license": "Reuse permission",
      "references": "Sources and further reading",
      "metricCVE": "CVEs published",
      "metricKEV": "KEV entries added",
      "axis": "Records per month",
      "chartTitle": "Public vulnerabilities and known exploitation: two different clocks",
      "chartNote": "CVE uses publication month; KEV uses catalog addition month. Each series shows its own publication or catalog-update cadence.",
      "summary": "This report brings together public vulnerability data, recent incidents and business costs to examine response time and how service promises, incident communication and user protections can keep pace.",
      "partial": "Partial month",
      "observations": [
        "The monthly year-over-year comparison uses October 1–21 in both 2025 and 2026, with 21 days on each side. The chart retains 33 complete months and shows October 2026 progress through the 21st separately.",
        "AI model dates provide context. Assessing AI’s role in the increase requires record-level information about research tools, discoverers and other factors.",
        "Global spending forecasts, study averages and company accounts retain their own currencies, periods and measurement scopes."
      ],
      "forecast": "IDC’s March 2026 forecast puts worldwide security spending at USD 308 billion in 2026 and USD 430 billion in 2029. Both use the same March 2026 forecast edition.",
      "cost": "M&S reported GBP 131.3 million in incident-related costs for its year ended March 2026, with insurance separately recorded. These costs cover systems response, recovery and external specialist support; the accounts discuss trading impacts separately.",
      "language": "en",
      "path": "en",
      "reportTitle": "AI-era cybersecurity. Vulnerability disclosures surge. How much time do businesses have to respond?",
      "canonical": "https://labs.protico.io/cybersecurity/en/",
      "briefURL": "https://labs.protico.io/cybersecurity/media-kit/brief-en.md",
      "chartURL": "https://labs.protico.io/cybersecurity/media-kit/chart-en.svg",
      "citation": "Research and analysis: Protico Community Intelligence — AI-era cybersecurity. Vulnerability disclosures surge. How much time do businesses have to respond? · Reference date: 2026-10-22 · https://labs.protico.io/cybersecurity/en/",
      "caseContext": {
        "title": "From Taiwan to the world: shared risks across business services.",
        "intro": "91APP reported an attack on its commerce database. Zeabur described an incident across deployment regions, while Railway disclosed possible access to environment variables. Together, the cases connect familiar business services in Taiwan with the cloud infrastructure and credentials that support them.",
        "items": [
          {
            "name": "91APP",
            "date": "OCT 16 · 2026",
            "summary": "91APP reported automated attacks on its Commerce Cloud database and access to some information.",
            "response": "The company began an external investigation and emailed affected customers with assistance.",
            "url": "https://91app.com/blog/91app-202610-security/"
          },
          {
            "name": "Zeabur",
            "date": "OCT 14–15 · 2026",
            "summary": "Zeabur confirmed access to environment variables and account data, identifying incomplete internal credential rotation.",
            "response": "The incident spanned deployment regions and included credentials and API keys for upstream services.",
            "url": "https://zeabur.com/blogs/october-2026-security-incident"
          },
          {
            "name": "Railway",
            "date": "OCT 21 · 2026",
            "summary": "Railway said an unauthorized party may have obtained some decrypted environment variables.",
            "response": "It advised precautionary rotation of environment variables, API keys and private registry credentials, plus checks for unusual activity.",
            "url": "https://blog.railway.com/p/security-disclosure-wednesday-october-21st"
          }
        ],
        "japan": "On the evening of October 21, Japan’s Prime Minister Sanae Takaichi posted on X asking people to check whether they used PHP and prepare to update it. A software update normally handled by engineering teams had drawn a personal reminder from the prime minister.",
        "japanURL": "https://x.com/takaichi_sanae/status/2112890642590564386"
      }
    },
    "zh-Hant": {
      "eyebrow": "給媒體、創作者與研究者",
      "title": "把這份資料帶進你的報導。",
      "intro": "歡迎引用、翻譯或改編 Protico 原創的文字、分析與圖表，包含商業媒體使用。標明「Protico Community Intelligence」、附上原文連結與資料日期；有修改或翻譯，也請一起註明。符合這些條件，就不需要另外申請。",
      "scope": "授權只涵蓋 Protico 原創內容。第三方報告、資料集、社群貼文截圖與標誌，仍依各自的授權或其他合法使用依據處理；這份資料包提供來源連結，不代替原作者授權。",
      "download": "下載媒體與 Agent 資料包",
      "brief": "下載參考摘要 Markdown",
      "machine": "下載結構化資料 JSON",
      "chart": "下載可編輯圖表 SVG",
      "copy": "複製引用文字",
      "copyBrief": "複製參考摘要",
      "terms": "閱讀授權範圍",
      "inside": "包內有什麼",
      "contents": "四語參考摘要、來源索引、數字定義、可編輯圖表與檔案清單。適合放進報導、簡報或交給研究工具繼續閱讀。",
      "citationLabel": "可以直接使用的引用方式",
      "credit": "資料整理與分析：Protico Community Intelligence",
      "dateLabel": "資料截至",
      "changeNote": "如有翻譯、節錄或修改，請加註。",
      "copied": "已複製，可以貼到你的文章或簡報。",
      "copyFailed": "無法自動複製，請選取下方文字複製。",
      "loading": "正在整理引用資料。",
      "error": "資料包暫時無法載入，請重新整理後再試。",
      "snapshot": "資料快照",
      "range": "完整月份",
      "sourceLabel": "主要來源",
      "method": "數字怎麼來的",
      "key": "可引用的數字",
      "limits": "閱讀時要留意",
      "outlook": "我們對接下來幾年的觀察",
      "advice": "Protico 的建議",
      "license": "內容重用說明",
      "references": "來源與延伸資料",
      "metricCVE": "CVE 公開數",
      "metricKEV": "KEV 新增數",
      "axis": "每月筆數",
      "chartTitle": "公開漏洞與已知利用：兩種不同的時間",
      "chartNote": "CVE 依公開月份；KEV 依加入目錄月份。兩項統計各自呈現公開與目錄更新的節奏。",
      "summary": "這份專題把公開漏洞資料、近期事件與企業成本放在一起，討論企業可用的反應時間，以及服務承諾、通報和使用者保護如何跟上。",
      "partial": "當月進度",
      "observations": [
        "單月同期比較採 2025 與 2026 年的 10 月 1–21 日，兩邊各 21 天。圖表保留 33 個完整月份，另列 2026 年 10 月截至 21 日的進度。",
        "AI 模型日期提供背景。評估 AI 對漏洞數的影響，還需要逐筆研究工具、發現者與其他因素的資料。",
        "全球支出預測、研究樣本平均與單一企業財報，各自保留原本的幣別、期間與統計範圍。"
      ],
      "forecast": "IDC 於 2026 年 3 月發布的預測為：2026 年全球資安支出 3,080 億美元，2029 年 4,300 億美元。兩者採用同一份 2026 年 3 月的預測版本。",
      "cost": "M&S 截至 2026 年 3 月的年度財報列出 1.313 億英鎊事件相關成本，保險理賠另列；這筆費用涵蓋系統回應、復原與外部專業支援，營運影響另見財報說明。",
      "language": "zh-Hant",
      "path": "zh-hant",
      "reportTitle": "AI 時代，資安漏洞公告激增。企業還剩多少反應時間？",
      "canonical": "https://labs.protico.io/cybersecurity/zh-hant/",
      "briefURL": "https://labs.protico.io/cybersecurity/media-kit/brief-zh-hant.md",
      "chartURL": "https://labs.protico.io/cybersecurity/media-kit/chart-zh-hant.svg",
      "citation": "資料整理與分析：Protico Community Intelligence — AI 時代，資安漏洞公告激增。企業還剩多少反應時間？ · 資料截至: 2026-10-22 · https://labs.protico.io/cybersecurity/zh-hant/",
      "caseContext": {
        "title": "從台灣到全球，企業服務鏈上的共同風險。",
        "intro": "91APP 的公告呈現電商資料庫受到的影響；Zeabur 的調查涉及多個區域的部署環境，Railway 則揭露環境變數可能遭到存取。從台灣企業熟悉的商務服務延伸到雲端基礎設施，這些案例反映企業資料、帳戶憑證與上游服務之間的連動。",
        "items": [
          {
            "name": "91APP",
            "date": "10.16 · 2026",
            "summary": "91APP 表示 Commerce Cloud 資料庫受到自動化攻擊，部分資訊遭擷取。",
            "response": "公司啟動第三方調查，並透過 Email 通知受影響客戶與提供處理協助。",
            "url": "https://91app.com/blog/91app-202610-security/"
          },
          {
            "name": "Zeabur",
            "date": "10.14–15 · 2026",
            "summary": "Zeabur 確認環境變數與帳戶資料遭讀取；調查指出內部憑證輪換不完整。",
            "response": "事件涉及多個區域的雲端環境，也包含可存取上游服務的憑證與 API 金鑰。",
            "url": "https://zeabur.com/blogs/october-2026-security-incident"
          },
          {
            "name": "Railway",
            "date": "10.21 · 2026",
            "summary": "Railway 調查指出，未授權第三方可能取得部分環境變數的解密內容。",
            "response": "官方建議使用者預防性輪換環境變數、API 金鑰與私有映像倉庫憑證，並檢查異常活動。",
            "url": "https://blog.railway.com/p/security-disclosure-wednesday-october-21st"
          }
        ],
        "japan": "10 月 21 日晚間，日本首相高市早苗在 X 發文，請大家檢查是否使用 PHP，並準備更新。平常由工程團隊處理的軟體修補，這一次由首相親自提醒。",
        "japanURL": "https://x.com/takaichi_sanae/status/2112890642590564386"
      }
    },
    "ja": {
      "eyebrow": "メディア・クリエイター・研究者の方へ",
      "title": "この資料を、次の報道や発表に。",
      "intro": "Protico が制作した文章、分析、図表は、商用メディアを含め、引用・翻訳・編集してご利用いただけます。「Protico Community Intelligence」と原文のリンク、資料の日付を記載し、翻訳や変更がある場合はその旨を添えてください。この範囲であれば個別の申請は不要です。",
      "scope": "この許諾は Protico の独自制作部分のみが対象です。第三者の報告書、データセット、投稿のスクリーンショット、ロゴは、それぞれの許諾や適法な利用の条件に従います。資料パックでは出典へのリンクを示しており、第三者の権利を許諾するものではありません。",
      "download": "メディア・Agent 資料パックをダウンロード",
      "brief": "参考資料を Markdown でダウンロード",
      "machine": "構造化 JSON をダウンロード",
      "chart": "編集可能な SVG 図表をダウンロード",
      "copy": "出典表記をコピー",
      "copyBrief": "参考資料をコピー",
      "terms": "利用条件を読む",
      "inside": "パックの内容",
      "contents": "4 言語の参考資料、出典一覧、指標の定義、編集可能な図表、ファイル一覧を収録しています。報道、発表、調査ツールでの確認にご利用ください。",
      "citationLabel": "そのまま使える出典表記",
      "credit": "資料整理・分析：Protico Community Intelligence",
      "dateLabel": "資料確認日",
      "changeNote": "翻訳、抜粋、変更がある場合は明記してください。",
      "copied": "コピーしました。記事や発表資料に貼り付けられます。",
      "copyFailed": "自動コピーができません。下の文章を選択してコピーしてください。",
      "loading": "参考資料を読み込んでいます。",
      "error": "資料を読み込めませんでした。ページを更新してください。",
      "snapshot": "調査スナップショット",
      "range": "完全な月次データ",
      "sourceLabel": "主な出典",
      "method": "数値の整理方法",
      "key": "引用できる数値",
      "limits": "数値と一緒に伝えたいこと",
      "outlook": "これから注目すること",
      "advice": "Protico の見解",
      "license": "コンテンツの利用許諾",
      "references": "出典と関連資料",
      "metricCVE": "公開された CVE",
      "metricKEV": "追加された KEV",
      "axis": "月ごとの件数",
      "chartTitle": "脆弱性の公開と既知の悪用：異なる二つの時間軸",
      "chartNote": "CVE は公開月、KEV は登録月で集計。それぞれ公開と目録更新のペースを示します。",
      "summary": "公開脆弱性データ、最近の事例、企業の費用を整理し、対応時間と、サービス上の約束・連絡体制・利用者保護の見直しを考える特集です。",
      "partial": "月途中の集計",
      "observations": [
        "前年同月比較は 2025 年と 2026 年の 10 月 1〜21 日を対象にし、両年とも 21 日間にそろえています。図は完了した 33 か月と、2026 年 10 月 21 日までの途中集計を分けて示します。",
        "AI モデルの日付は背景情報です。増加への AI の寄与を調べるには、各脆弱性の調査ツール、発見者、その他の要因の情報が必要です。",
        "世界の支出予測、調査平均、企業の決算は、それぞれの通貨、期間、集計範囲を保って示しています。"
      ],
      "forecast": "IDC の 2026 年 3 月の予測では、世界のセキュリティ支出は 2026 年に 3,080 億米ドル、2029 年に 4,300 億米ドルです。どちらも 2026 年 3 月版の予測です。",
      "cost": "M&S は 2026 年 3 月期に 1 億 3,130 万ポンドの事件関連費用を計上し、保険金は別に記載しました。費用の範囲はシステム対応、復旧、外部専門家の支援で、営業への影響は決算で別途説明されています。",
      "language": "ja",
      "path": "ja",
      "reportTitle": "AI 時代のサイバーセキュリティ。脆弱性の公開件数が急増。企業に残された対応時間は？",
      "canonical": "https://labs.protico.io/cybersecurity/ja/",
      "briefURL": "https://labs.protico.io/cybersecurity/media-kit/brief-ja.md",
      "chartURL": "https://labs.protico.io/cybersecurity/media-kit/chart-ja.svg",
      "citation": "資料整理・分析：Protico Community Intelligence — AI 時代のサイバーセキュリティ。脆弱性の公開件数が急増。企業に残された対応時間は？ · 資料確認日: 2026-10-22 · https://labs.protico.io/cybersecurity/ja/",
      "caseContext": {
        "title": "台湾から世界へ。企業のサービスをつなぐ共通のリスク。",
        "intro": "91APP は商取引データベースへの攻撃を報告しました。Zeabur の調査は複数地域の運用環境に及び、Railway は環境変数へのアクセスの可能性を公表しています。台湾の企業に身近なサービスからクラウド基盤まで、企業データ、認証情報、関連サービスのつながりが見える事例です。",
        "items": [
          {
            "name": "91APP",
            "date": "2026年10月16日",
            "summary": "91APP は Commerce Cloud データベースへの自動攻撃と、一部情報の取得を公表しました。",
            "response": "外部調査を開始し、影響を受けた顧客にメールで通知して対応を案内しています。",
            "url": "https://91app.com/blog/91app-202610-security/"
          },
          {
            "name": "Zeabur",
            "date": "2026年10月14〜15日",
            "summary": "Zeabur は環境変数とアカウント情報へのアクセスを確認。内部認証情報の更新不足が判明しました。",
            "response": "事件は複数地域の運用環境に及び、関連サービスの認証情報や API キーにも関係しています。",
            "url": "https://zeabur.com/blogs/october-2026-security-incident"
          },
          {
            "name": "Railway",
            "date": "2026年10月21日",
            "summary": "Railway の調査では、第三者が一部環境変数の復号内容を取得した可能性が示されています。",
            "response": "環境変数、API キー、非公開レジストリの認証情報の予防的な更新と、異常な利用の確認を推奨しています。",
            "url": "https://blog.railway.com/p/security-disclosure-wednesday-october-21st"
          }
        ],
        "japan": "10月21日夜、高市早苗首相は X で、PHP を使っているか確認し、更新に備えるよう呼びかけました。普段はエンジニアが担うソフトウェアの更新について、首相自ら注意を促した形です。",
        "japanURL": "https://x.com/takaichi_sanae/status/2112890642590564386"
      }
    },
    "ko": {
      "eyebrow": "미디어·크리에이터·연구자를 위한 자료",
      "title": "이 자료를 다음 기사에 활용해 보세요.",
      "intro": "Protico가 직접 작성한 글, 분석과 도표는 상업 매체를 포함해 인용·번역·편집해 사용할 수 있습니다. “Protico Community Intelligence”를 표시하고 원문 링크와 자료 날짜를 함께 적어 주세요. 번역하거나 수정한 부분도 밝혀 주세요. 이 범위의 사용에는 별도 신청이 필요 없습니다.",
      "scope": "이 허가는 Protico의 자체 제작물에만 적용됩니다. 타사의 보고서, 데이터셋, 게시물 스크린샷과 로고는 각각의 허가 또는 적법한 이용 조건을 따릅니다. 자료 모음은 해당 출처의 링크를 제공하며, 타사의 권리까지 허가하지는 않습니다.",
      "download": "미디어·Agent 자료 모음 다운로드",
      "brief": "Markdown 참고 자료 다운로드",
      "machine": "구조화된 JSON 다운로드",
      "chart": "편집 가능한 SVG 도표 다운로드",
      "copy": "출처 표기 복사",
      "copyBrief": "참고 자료 복사",
      "terms": "이용 조건 읽기",
      "inside": "자료 모음에 담긴 내용",
      "contents": "4개 언어 참고 자료, 출처 목록, 지표 정의, 편집 가능한 도표와 파일 목록을 제공합니다. 기사, 발표 자료나 연구 도구에서 활용할 수 있습니다.",
      "citationLabel": "바로 쓸 수 있는 출처 표기",
      "credit": "자료 정리 및 분석: Protico Community Intelligence",
      "dateLabel": "자료 기준일",
      "changeNote": "번역·발췌·수정한 경우 함께 표시해 주세요.",
      "copied": "복사했습니다. 기사나 발표 자료에 붙여 넣을 수 있습니다.",
      "copyFailed": "자동 복사가 되지 않습니다. 아래 내용을 선택해 복사해 주세요.",
      "loading": "참고 자료를 불러오는 중입니다.",
      "error": "자료를 불러오지 못했습니다. 새로고침해 주세요.",
      "snapshot": "연구 스냅샷",
      "range": "완전한 월별 자료",
      "sourceLabel": "주요 출처",
      "method": "수치를 정리한 방법",
      "key": "인용할 수 있는 수치",
      "limits": "수치와 함께 살펴볼 내용",
      "outlook": "앞으로 주목할 변화",
      "advice": "Protico의 관점",
      "license": "콘텐츠 이용 허가",
      "references": "출처와 추가 자료",
      "metricCVE": "공개된 CVE",
      "metricKEV": "추가된 KEV",
      "axis": "월별 건수",
      "chartTitle": "취약점 공개와 알려진 악용: 서로 다른 두 시간축",
      "chartNote": "CVE는 공개 월, KEV는 목록 추가 월 기준입니다. 각각 공개와 목록 갱신의 흐름을 보여 줍니다.",
      "summary": "공개 취약점 자료, 최근 사고와 기업 비용을 함께 살펴보고, 기업의 대응 시간과 서비스 약속·사고 안내·이용자 보호를 어떻게 개선할지 다룬 자료입니다.",
      "partial": "월 중간 집계",
      "observations": [
        "전년 동월 비교는 2025년과 2026년의 10월 1~21일을 대상으로 하며 양쪽 모두 21일입니다. 그래프는 완료된 33개월과 2026년 10월 21일까지의 중간 집계를 따로 표시합니다.",
        "AI 모델 날짜는 배경 정보입니다. 증가에 대한 AI의 영향을 평가하려면 각 취약점의 연구 도구, 발견자와 다른 요인에 관한 자료가 필요합니다.",
        "세계 지출 전망, 조사 평균과 기업 결산은 각각의 통화·기간·집계 범위를 유지해 제시합니다."
      ],
      "forecast": "IDC의 2026년 3월 전망은 세계 보안 지출을 2026년 3,080억 달러, 2029년 4,300억 달러로 예상했습니다. 두 수치 모두 2026년 3월 전망을 기준으로 합니다.",
      "cost": "M&S는 2026년 3월 종료 회계연도에 사고 관련 비용 1억 3,130만 파운드를 기록했으며 보험금은 별도로 처리했습니다. 이 비용은 시스템 대응·복구와 외부 전문 지원을 포함하며, 영업 영향은 결산에서 별도로 설명합니다.",
      "language": "ko",
      "path": "ko",
      "reportTitle": "AI 시대의 사이버 보안. 취약점 공개 건수가 급증한다. 기업에 남은 대응 시간은?",
      "canonical": "https://labs.protico.io/cybersecurity/ko/",
      "briefURL": "https://labs.protico.io/cybersecurity/media-kit/brief-ko.md",
      "chartURL": "https://labs.protico.io/cybersecurity/media-kit/chart-ko.svg",
      "citation": "자료 정리 및 분석: Protico Community Intelligence — AI 시대의 사이버 보안. 취약점 공개 건수가 급증한다. 기업에 남은 대응 시간은? · 자료 기준일: 2026-10-22 · https://labs.protico.io/cybersecurity/ko/",
      "caseContext": {
        "title": "대만에서 세계로, 기업 서비스 전반에 걸친 공통 위험.",
        "intro": "91APP는 커머스 데이터베이스에 대한 공격을 보고했습니다. Zeabur의 조사는 여러 지역의 배포 환경을 다뤘고, Railway는 환경 변수 접근 가능성을 공개했습니다. 대만 기업에 익숙한 서비스에서 클라우드 인프라로 이어지는 사례들은 기업 데이터, 인증 정보, 연계 서비스의 관계를 보여 줍니다.",
        "items": [
          {
            "name": "91APP",
            "date": "2026년 10월 16일",
            "summary": "91APP는 Commerce Cloud 데이터베이스에 대한 자동화 공격과 일부 정보의 무단 수집을 발표했습니다.",
            "response": "외부 조사를 시작하고, 영향을 받은 고객에게 이메일로 통지하며 대응을 안내했습니다.",
            "url": "https://91app.com/blog/91app-202610-security/"
          },
          {
            "name": "Zeabur",
            "date": "2026년 10월 14~15일",
            "summary": "Zeabur는 환경 변수와 계정 데이터 접근을 확인했습니다. 내부 인증 정보 교체가 불완전했던 점도 드러났습니다.",
            "response": "사건은 여러 지역의 배포 환경에 걸쳤으며, 상위 서비스에 접근할 수 있는 인증 정보와 API 키도 포함됐습니다.",
            "url": "https://zeabur.com/blogs/october-2026-security-incident"
          },
          {
            "name": "Railway",
            "date": "2026년 10월 21일",
            "summary": "Railway 조사에 따르면 외부인이 일부 환경 변수의 복호화된 내용에 접근했을 가능성이 있습니다.",
            "response": "환경 변수, API 키와 비공개 레지스트리 인증 정보를 예방적으로 교체하고, 비정상 활동을 확인하도록 권고했습니다.",
            "url": "https://blog.railway.com/p/security-disclosure-wednesday-october-21st"
          }
        ],
        "japan": "10월 21일 밤, 다카이치 사나에 일본 총리는 X에 PHP 사용 여부를 확인하고 업데이트를 준비해 달라는 글을 올렸습니다. 평소 엔지니어가 맡는 소프트웨어 업데이트를 총리가 직접 당부한 것입니다.",
        "japanURL": "https://x.com/takaichi_sanae/status/2112890642590564386"
      }
    }
  }
}