How the index is built

This is the whole method. Nothing here is secret: every input is a public source, every step is described below, and the underlying series are downloadable, so anyone with the same data can reproduce the number. The value of the index is the daily operation and the growing archive, not opacity.

1. The sources

Around a dozen public series roll up into six categories. Five push the number up as AI pressure on data rises; the sixth, governance, pushes it down as the response strengthens. Each series, its source, and its current value is on the metrics page; the governance sources are listed in full in theregistry.

2. The pipeline, one series at a time

1. Fetch and validate. Each series is pulled from its source on a daily schedule. Before a value is accepted it passes a staleness check (is it genuinely new), a schema check, and a plausibility (jump) filter. A value that fails is excluded and the series is marked "carried forward" for the day rather than published with a bad number.
2. Transform to a stationary form. A trending level is never standardised directly. Each series is expressed as a rate, a share, a growth figure, or a level that is already stationary, so a long-running trend is not mistaken for a permanent shift.
3. Standardise against a fixed 2024 baseline. Each transformed value is turned into a z-score against that series' own 2024 mean and standard deviation: z = (value minus the 2024 mean) divided by the 2024 standard deviation. The baseline is the calendar year 2024, the last full year before agentic deployment accelerated. It is fixed, not a trailing window, because a trailing window would mean-revert sustained pressure back to zero. Each daily z is bounded at plus or minus four as a backstop.
4. Orient. Each series is signed so that a higher value means more of the thing it measures. A few are inverted where a falling number means rising pressure (the cost of processing data with AI, for instance).

3. From series to one number

5. Aggregate by category. The standardised, oriented series in each category are averaged into a category score.
6. Combine the categories. The category scores are combined using the published weights below. The governance category enters with a negative sign, so a stronger governance response genuinely lowers the index. That is the only sign convention; there is no other inversion anywhere.
7. Re-standardise into sigma units. A weighted average of z-scores has a spread well below one, so the raw composite is not yet in honest sigma units. The published index re-standardises the composite against the index's own range since 2024. A reading of plus one sigma therefore means the composite is one standard deviation above the middle of the range it has occupied since the start of 2024, which keeps the gauge interpretable and moving rather than pinned at an extreme.
8. Smooth and band. The published headline is a seven-day smoothed line. The band (Below baseline, Building, Elevated, Severe) is read off the smoothed value with hysteresis, and describes the composite level only. It does not, by itself, assert anything about any single organisation.

4. The weights

Weights are editorial, frozen between monthly reviews, and published. Because the data is downloadable, you can re-weight it yourself.

5. New series, and history before launch

A new series appears first as a candidate, shown but carrying zero weight, and only earns weight once it has enough history to be statistically meaningful. History to the left of the launch date is reconstructed from current-method inputs and is flagged as such; the live archive builds forward from launch and is never restated. Corrections are made as dated revision notes, never silent edits, and constants (weights, baselines, keyword and basket definitions) change only at month boundaries, versioned and published.

6. What it claims, and what it does not

It is an argument, not a prediction. It quantifies a condition, the pressure on enterprise data right now, and never forecasts a specific breach or incident, never measures any attacker's intent, and never scores a named vendor or product. A high reading is a statement about the environment, not about any one company's security.

7. Reproducibility

Every input is a public, free source, and the method is exactly what is written here. The per-series history and the index history will be published as downloadable files, so the number can be recomputed independently. It is a personal editorial product by Rob Linton; see about. Nothing here is investment, security, or legal advice.

Back to the index.