Our setup
Each morning, AI agents read national cyber authorities, specialist press and news searches, merge the reports into incidents and search each incident for primary evidence. No person reviews a record before it appears, and every record links to its sources.
Our definition
A publicly reported cyberattack or suspected cyberattack on an identifiable organisation or service in at least one European country, dated on or after 1 January 2026.
Six rules the pipeline applies
- 1
One incident, one record
Reports of one event make one record, matched across languages on organisation, dates, place, systems and method. Incidents that share an attacker are linked as a campaign, not merged.
- 2
What counts
Ransomware, DDoS, intrusions, sabotage and data extortion, and outages with an alleged cyber cause. Opinion, marketing and vulnerability reports that name no victim do not.
- 3
Unexplained disruptions stay leads
A disruption with no stated cyber cause, such as a payment-terminal outage, is recorded as an operational anomaly, never as a cyber incident.
- 4
From 1 January 2026
The incident date is the onset, else the detection, else the disclosure. An incident that began before 2026 is left out, even if disclosed later.
- 5
Dates as the source gives them
A date keeps its source’s precision. The pipeline never infers a day, month or year that no source states.
- 6
Europe only
The EU and EEA, the UK, Switzerland, the Western Balkans, Moldova, Ukraine, Belarus, Russia, Türkiye and the South Caucasus. Only an incident’s European countries are recorded.
What each record holds
- What happened
- Summary, organisation, affected system, attack method, consequences and campaign.
- Where
- Countries, and region, city or site where verified.
- Which sector
- One of 14 economic domains, with critical infrastructure flagged.
- When
- Onset, detection, disclosure and recovery, each with its precision.
- How well established
- Evidence state, confidence, contradictions and source links.
- How serious
- Severity and recovery status.
Pipeline Studio
Made in Pipeline Studio
We built this pipeline in Pipeline Studio, the tool we developed from running the Iran Conflict Scenario Monitor. It lets a knowledge worker set up a pipeline like this one in a browser.
A curated toolbox of sources
We chose the authorities, press and searches, and keep them as lists in Pipeline Studio.
Verification steps with dedicated prompts
Each step has its own role, written instructions and record form.
Traceable records
Each record keeps the links it rests on, and each run report shows where every item went.