Early warning, measured.
Every month we count how often an incident record went live on ThreatCluster at least 48 hours before the first security trade-press article on it, and by how many days. Measured from our own ingest timestamps, with the rules below — not estimated, not curated.
Month by month
| Month | Records examined | Reached trade press | We were 48h+ earlier | Median lead |
|---|---|---|---|---|
| Nov 2026· still settling | 387 | 73 | 0 | — |
| Oct 2026 | 1,869 | 434 | 38(9% of covered) | 4.6 days |
| Sep 2026 | 1,543 | 408 | 30(7% of covered) | 3.7 days |
| Aug 2026 | 940 | 308 | 22(7% of covered) | 3.6 days |
| Jul 2026 | 1,197 | 355 | 15(4% of covered) | 3.4 days |
| Jun 2026 | 1,444 | 317 | 14(4% of covered) | 4.4 days |
| May 2026 | 1,418 | 302 | 10(3% of covered) | 3.7 days |
"Still settling": the current month's trade coverage is still arriving, so its numbers only move up. A month is final a few weeks after it ends.
How it's measured
The method is deliberately strict, so every counted win is one we would defend:
- Our own clocks only. A record exists from the moment our pipeline created it; an article counts from the moment we ingested it — never from a publisher's claimed publication date.
- Trade press means 18 outlets a security team already reads (BleepingComputer, The Hacker News, The Register, Dark Reading, SecurityWeek, The Record and the rest of that tier), matched by article domain.
- A win needs all of: the record live at least 48 hours before the first trade article joined it; at least three distinct non-trade sources visible before that article; and no mainstream or wire coverage (Reuters, AP, BBC, FT…) before the trade press — if the FT ran it first, the claim is not ours to make.
- Leads over 10 days are discarded, not celebrated: in validation those were long-running thematic clusters drifting onto a related story, not genuine early warning.
- Only records with a threat score of 50 or higher are examined.
The same method, run across the corpus, produces the lead-time figure on the homepage. Named examples with timestamps are on the press page.
Use it live
The incidents behind these numbers stream on the early warning feed (RSS included) the moment they form. A free API key reads them the same minute.