# Why I built the AI Data Pressure Index

> Canonical: https://roblinton.com/writing/why-i-built-the-ai-data-pressure-index/
> Author: Rob Linton · Published 2026-08-17

**TL;DR:** I built a daily gauge of the pressure AI puts on enterprise data. It first read down when I judged the pressure was rising, so I re-examined the inputs and corrected it in the open. The number matters less than the fact that you can watch it, check it, and catch it being wrong.

---
I have spent thirty years on [one question](/writing/thirty-years-one-problem/): who is allowed to read this? A few weeks ago I turned it into a number, and the most useful thing it did was disagree with me. This is the story of that, and why I think one daily figure is worth keeping.

## What is the AI Data Pressure Index?

It is a single daily figure for how hard AI is pushing on enterprise data, measured against how fast the controls around that data improve. [The index](/data/) rolls twelve public series into six categories: how capable frontier AI is getting, how widely it is deployed, the economics pushing it into data work, the attack surface, the harm actually occurring, and the governance response, which is the one category that pushes the number down.

Rob Linton (yes, me, written in the third person so search engines file it under the right name) built and runs it; it is a personal editorial project, updated every morning, not a product of any employer.

Each category is built from sources you can open yourself:

- **Capability** leans on [Epoch AI](https://epoch.ai/data), which tracks how fast frontier models are clearing hard benchmarks.
- **Deployment** watches the growth in context windows and model releases, the plumbing that lets AI reach more data at once.
- **Economics** follows two forces at once: the collapsing price of a unit of inference, and the money flowing into AI software, because cheap and well funded is what pushes AI into work it was never trusted with before.
- **Attack surface** counts newly exploited vulnerabilities and the volume of research into attacking AI agents.
- **Realised harm** tracks breached-account counts and ransomware activity, the damage that has already happened rather than the kind that might.
- **Governance**, the counterweight, counts formal AI-governance publications from bodies such as the US Federal Register.

None of it is proprietary, and all of it updates on its own clock, which is the whole idea.

I will not re-explain the maths, because the [full method](/data/methodology/) is already published in detail. This is about why the number is worth having, and what building it taught me.

## Why does one number matter?

Because the gap it tracks is invisible until it is a breach. AI capability compounds and gets cheaper every month; the controls around data are slow, manual, and mostly unchanged. So the distance between what an AI can reach and what governance actually permits widens by default, quietly, whether or not anyone is watching it.

The individual signals already exist, just scattered. Breach counts, model releases, token prices, vulnerability feeds: each tells part of the story, none tells the whole condition, and a security leader who wants the trend has to assemble it in their head every week. The model for fixing that is old and boring. A central bank does not publish thirty separate charts of financial stress; it standardises them against a baseline and prints one index that everyone can quote and argue with. Australia's cyber agency made the underlying point in its May guidance, which states that ["Data readiness is a core prerequisite for AI adoption"](https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/opportunities-for-ai-in-cyber-defence). A breach is just the moment the gap becomes visible, and by then the pressure had been building for months. A daily figure makes it visible before the incident, not after.

## What did it get wrong at first?

It read down when I was fairly sure the real pressure was rising. My read: when a measure argues with something you are confident about, the measure is a hypothesis to test, not a verdict to accept. So I went back to the inputs, and found three things wrong with my own design.

The first was a category error. I had been counting a surge in AI-security research as governance catching up, filing it on the side that lowers the number. That is backwards. A spike in papers on how to attack AI agents does not mean the defence has arrived; it means the threat is being mapped out in the open, and the attack surface is widening. I moved it to the side where a rising threat belongs.

The second was a lazy metric wearing a serious face. My governance signal had been a keyword count, and a keyword count is noise: a full-text match on "artificial intelligence" pulls in every immigration notice and grant announcement that mentions it in passing. So I replaced it with a [curated register](/data/governance/) of official AI-governance publications, each a real document you can open and read. It is slower to build and much harder to fake, which is exactly why it is better.

The third was a scaling mistake, and it was the one distorting the headline. I had standardised the composite against its own 2024 normal, and that pinned it near the top of its scale, reading an alarmist four standard deviations above baseline. At four standard deviations a gauge has nowhere left to go. It is stuck on "Severe" and it stops telling you anything from one day to the next. I re-standardised it against the full range the index has actually covered since 2024, and it settled a little above its baseline, in the band I call "Building". Not because the pressure fell, but because the ruler was wrong.

The point is not that the new number is right. It is that I could see it was wrong and fix it in the open.

## What should a rising number make you do?

Treat it as a prompt to check one unglamorous thing: what your AI can actually reach. A climbing index is not a reason to panic, and it is certainly not a reason to buy anything. It is a reason to go and answer the same question I have been asking for thirty years. Which systems can your AI tools read from right now? Not what they are supposed to read, what they can reach (the answer is almost always more than anyone intended). Treat every agent as a user, give it the least privilege it needs and an audit trail, and ask any AI vendor exactly where your data goes and under whose jurisdiction. The pressure the index measures only becomes a loss at one specific place: where an ungoverned system meets data it was never cleared to touch.

## What does it not claim?

It is an argument, not a prediction. It measures the pressure on enterprise data right now. It never forecasts a specific breach, never measures an attacker's intent, and never scores a named vendor or product, mine included. It is published under my own name, not any employer's. If that sounds like a lot of hedging, good. A number about risk that refuses to admit its limits is the kind of number I would not trust either.

It also has limits I can name today, which is the honest way to hold them. The governance register is built mostly from United States federal publications, so it currently under-weights strong action in Europe, the United Kingdom and here in Australia, and widening it is on the list. The category weights are my editorial judgement, frozen between monthly reviews, not a law of nature. The harm data lags, because breaches surface late, so that category is always describing a few weeks ago rather than this morning. None of these sink the argument, but I would rather set them down in daylight than have you find them and assume I was hiding something.

## Why publish it at all?

Because a number I could quietly adjust in private would prove nothing. The discipline only counts if it is in the open: the figure is append-only, the method is published, and the morning it read wrong is still on the record next to the correction. There is a public-good reason too. The gap it tracks deserves a shared reference. This is not a product, and it is not for sale.

## Why can you check it?

Every input is a public, free source, and the method is published so anyone can rebuild the figure. Epoch AI for capability, the public vulnerability feeds for the attack surface, the US Federal Register for the governance register, and so on, all listed. You can take the same data and disagree with my weights, which are editorial, frozen between monthly reviews, and shown. If you think governance deserves more weight, or that realised harm is undercounted, re-weight it and see what you get; I would rather you argued with the number than took it on faith. The moat, if there is one, is the daily operation and the growing archive. A pressure index you cannot audit is just an opinion with a decimal point.

Net: a slow, invisible gap becomes something you can watch, argue with, and check, every morning. You can read today's figure, and exactly how it is built, on [the data page](/data/).