Weekly Threat Trends

Current week 7506 events observed this week

Previous week 8491 baseline comparison

Week over week -11.6% change in activity

Suspicious in period 78654 public-safe high-signal events

Weekly Activity

78654 total observed events in this period. Bars use a compressed visual scale when one week contains a major spike; numeric counts remain exact.

Total Suspicious

2026-05-25

0 0 suspicious

2026-06-01

0 0 suspicious

2026-06-08

0 0 suspicious

2026-06-15

0 0 suspicious

2026-06-22

0 0 suspicious

2026-06-29

0 0 suspicious

2026-07-06

0 0 suspicious

2026-07-13

0 0 suspicious

2026-07-20

20463 20463 suspicious

2026-07-27

42194 42194 suspicious

2026-08-03

8491 8491 suspicious

2026-08-10

7506 7506 suspicious

Visual scale compressed because the largest week is 42194 events. This prevents lower-volume weeks from disappearing while preserving exact labels.

Signal Mix

Threat Categories

Protocol Honeypot 53452 Interactive network services such as SSH, mail, SCADA, databases, cloud metadata, and DevOps lures.

Secret Harvest 24613 Attempts to retrieve credentials, environment files, tokens, or sensitive configuration.

Ics Probe 454 Industrial-control probing such as Modbus or SCADA-oriented interaction.

Ai Agent 85 AI-agent, MCP, tool-use, or prompt-oriented interaction.

Exploit Attempt 45 Sanitized public-safe attack category.

Prompt Attack 4 Sanitized public-safe attack category.

Spear Phishing 1 Sanitized public-safe attack category.

Protocol Exposure

Honeypot Breakdown

Protocol activity is split by the sensor surface that observed it.

SSH shell honeypot5347268.0% of selected-period sensor activity / max risk 93

Cloud metadata honeypot1107114.1% of selected-period sensor activity / max risk 92

MS SQL honeypot53786.8% of selected-period sensor activity / max risk 96

Redis/data-store honeypot28053.6% of selected-period sensor activity / max risk 96

MySQL honeypot26953.4% of selected-period sensor activity / max risk 96

PostgreSQL honeypot23513.0% of selected-period sensor activity / max risk 96

SCADA/Modbus honeypot4540.6% of selected-period sensor activity / max risk 95

DevOps lure1730.2% of selected-period sensor activity / max risk 95

SMTP mail honeypot1470.2% of selected-period sensor activity / max risk 91

AI agent/MCP honeypot920.1% of selected-period sensor activity / max risk 94

Other protocol honeypots160.0% of selected-period sensor activity / max risk 96

Current Pulse

Selected Period Detail

78562Scanner events 4Prompt attacks 24627Canary events 92AI-agent clients 96Maximum public risk score