{
  "generated_at_utc": "2026-07-29T21:59:48.702595+00:00",
  "source": "VERIS Community Database (VCDB)",
  "source_repository": "https://github.com/vz-risk/VCDB",
  "source_commit": "dd01d10395c30aaf9b7ebd61ee7e4283994466d3",
  "source_license": "CC BY-SA 4.0",
  "source_license_url": "https://creativecommons.org/licenses/by-sa/4.0/",
  "input_json_files": 10042,
  "start_year": 2020,
  "eligible_pool_size": 1191,
  "sample_size": 1000,
  "selection_rule": "Most recent eligible incidents, descending by incident date parts then stable incident ID; unknown month/day sort before known values within the same year/month.",
  "eligibility": [
    "incident year >= 2020",
    "security_incident == Confirmed",
    "at least one non-Unknown VERIS action variety",
    "non-empty public reference field",
    "unique stable ID (plus.master_id, then incident_id, then filename)"
  ],
  "exclusions": {
    "before_start_year_or_missing_year": 8728,
    "duplicate_stable_id": 3,
    "no_known_action_variety": 103,
    "no_public_reference": 17
  },
  "sample_cutoff": "2020-07-21",
  "year_distribution": [
    {
      "year": 2026,
      "incident_count": 2,
      "sample_pct": 0.2
    },
    {
      "year": 2025,
      "incident_count": 97,
      "sample_pct": 9.7
    },
    {
      "year": 2024,
      "incident_count": 4,
      "sample_pct": 0.4
    },
    {
      "year": 2023,
      "incident_count": 749,
      "sample_pct": 74.9
    },
    {
      "year": 2022,
      "incident_count": 4,
      "sample_pct": 0.4
    },
    {
      "year": 2021,
      "incident_count": 87,
      "sample_pct": 8.7
    },
    {
      "year": 2020,
      "incident_count": 57,
      "sample_pct": 5.7
    }
  ],
  "derived_campaign_clusters": 226,
  "largest_derived_cluster": 747,
  "focus_family_order": [
    "Known vulnerability exploitation",
    "Credential abuse",
    "Ransomware and disruptive impact",
    "Backdoor and command-and-control",
    "Misconfiguration and exposure",
    "Social engineering",
    "Physical loss and theft",
    "Human error and misuse",
    "Data access and exfiltration",
    "Malware execution",
    "Defense evasion",
    "Application abuse",
    "Other or unmapped"
  ],
  "focus_five_cumulative": {
    "order": 5,
    "added_family": "Misconfiguration and exposure",
    "cumulative_incident_count": 982,
    "cumulative_incident_pct": 98.2,
    "cumulative_cluster_count": 208,
    "cumulative_cluster_pct": 92.04
  },
  "limitations": [
    "VCDB is a convenience sample of publicly disclosed incidents, not a population census.",
    "Disclosure and coding density vary materially by year and campaign.",
    "VERIS action varieties are not one-to-one MITRE ATT&CK techniques.",
    "Derived campaign clusters are sensitivity-analysis constructs, not authoritative campaign attribution.",
    "Public reporting may omit techniques that occurred."
  ]
}