Data-driven insights on cybersecurity breaches, vulnerabilities, and infrastructure signals.
DMARC has been public since 2012. Across 67,336 company domains we checked, 45.1% have no record at all, and of the rest, most are set to p=none: collecting reports, not enforcing a policy.
A public-source review of 40 European organisations and public bodies publicly linked to Palantir. Evidence quality varies: some are confirmed deployments, others are pilots, partnerships, letters of intent, reported relationships or infrastructure observations.
We looked at the apex and www records for 19,450 European company entities and mapped each to its internet-facing infrastructure vendor. US-headquartered vendors serve the majority of primary company websites in the UK and the Netherlands, the plurality in Italy, Spain, and France. Cloudflare is the largest single vendor in every one of the seven markets.
Someone told us European procurement teams looking for a sovereign cybersecurity alternative are stuck choosing a foreign incumbent. We started counting EU-headquartered vendors instead. The shortage is not in the supply. It is in what gets seen.
77% of the European sites we observed running Meta Pixel also exposed Google Analytics, but the deeper pattern is how analytics, advertising, consent and infrastructure products repeatedly arrive as a bundle.
CipherCue observed the public web perimeter of 2,165 Polish organisations. At the hosting layer they prefer European providers. At the outsourced perimeter layer (CDN, hosted mail, consent, WAF) the credible non-European choice is conceded. Where European sovereign alternatives exist, this is an account map.
I matched MX records against a vendor rule dictionary for 2,584 SEC EDGAR-linked entities. The Microsoft 365 share was unsurprising. The gateway market is a duopoly: Proofpoint and Mimecast account for 91.4% of non-mailbox MX matches.
Nearly 24,000 ransomware leak-site claims tracked over five years show volume growing at 31% annually. Gartner puts security spending growth at 10%. The gap is widening.
We analysed 1,031 breach notification filings that include time-to-detection data. Ransomware is found in a median of 19 days because it announces itself. Malware that exfiltrates silently takes 93 days. Non-profits take 160. Detection is getting faster, but only for the loud attacks.
129 ransomware groups posted 7,655 victim claims to leak sites over 376 days. We broke down every group, sector, country, and monthly trend in the data.
We combined SEC Form 4 insider transactions, FINRA short interest data, and public breach signals for 78 companies. 17 showed both insider dispositions and short interest movements within days of a breach date.
We analysed 171 ICO enforcement actions from January 2022 to February 2026. Public sector bodies received reprimands 80% of the time. Private companies were fined. Thirteen organisations appeared more than once.
Browse observed tech stacks, DNS posture, and open services for organisations. All data sourced from public authority records.
CIPHERCUE