Weekly Threat Trends

Current week 7386 events observed this week

Previous week 8491 baseline comparison

Week over week -13.0% change in activity

Suspicious in period 78534 public-safe high-signal events

Weekly Activity

78534 total observed events in this period. Bars use a compressed visual scale when one week contains a major spike; numeric counts remain exact.

Total Suspicious

2026-05-25

0 0 suspicious

2026-06-01

0 0 suspicious

2026-06-08

0 0 suspicious

2026-06-15

0 0 suspicious

2026-06-22

0 0 suspicious

2026-06-29

0 0 suspicious

2026-07-06

0 0 suspicious

2026-07-13

0 0 suspicious

2026-07-20

20463 20463 suspicious

2026-07-27

42194 42194 suspicious

2026-08-03

8491 8491 suspicious

2026-08-10

7386 7386 suspicious

Visual scale compressed because the largest week is 42194 events. This prevents lower-volume weeks from disappearing while preserving exact labels.

Signal Mix

Threat Categories

Protocol Honeypot 53452 Interactive network services such as SSH, mail, SCADA, databases, cloud metadata, and DevOps lures.

Secret Harvest 24494 Attempts to retrieve credentials, environment files, tokens, or sensitive configuration.

Ics Probe 453 Industrial-control probing such as Modbus or SCADA-oriented interaction.

Ai Agent 85 AI-agent, MCP, tool-use, or prompt-oriented interaction.

Exploit Attempt 45 Sanitized public-safe attack category.

Prompt Attack 4 Sanitized public-safe attack category.

Spear Phishing 1 Sanitized public-safe attack category.

Protocol Exposure

Honeypot Breakdown

Protocol activity is split by the sensor surface that observed it.

SSH shell honeypot5347268.1% of selected-period sensor activity / max risk 93

Cloud metadata honeypot1105414.1% of selected-period sensor activity / max risk 92

MS SQL honeypot53776.8% of selected-period sensor activity / max risk 96

Redis/data-store honeypot27103.5% of selected-period sensor activity / max risk 96

MySQL honeypot26953.4% of selected-period sensor activity / max risk 96

PostgreSQL honeypot23503.0% of selected-period sensor activity / max risk 96

SCADA/Modbus honeypot4530.6% of selected-period sensor activity / max risk 95

DevOps lure1690.2% of selected-period sensor activity / max risk 95

SMTP mail honeypot1460.2% of selected-period sensor activity / max risk 91

AI agent/MCP honeypot920.1% of selected-period sensor activity / max risk 94

Other protocol honeypots160.0% of selected-period sensor activity / max risk 96

Current Pulse

Selected Period Detail

78442Scanner events 4Prompt attacks 24508Canary events 92AI-agent clients 96Maximum public risk score