The Observatory now holds more than 4,328+ verified incidents across all 16 critical-infrastructure sectors and Space Systems. The headline number is the least interesting thing in it. What the record is built to expose is movement — the reuse of a technique proven in one sector against targets in another.
Why movement, not volume
Platform vendors and sector regulators tend to watch one environment at a time. An adversary that develops an intrusion technique against a regional telecom and later reuses it against energy or transportation does not register as one campaign in that model — it registers as several unrelated incidents. Read as a connected system, the same events describe a maturing capability. This is the pattern EWSRC first traced in From Vietnam to Volt Typhoon.
Where the evidence is thin
A record built from open reporting inherits open reporting’s biases. Sectors with mature disclosure regimes are over-represented; sectors that disclose little are almost certainly undercounted. Attribution in open sources is frequently contested, so The Observatory records what is claimed and by whom rather than asserting certainty. And a rise in recorded incidents can reflect better reporting rather than more activity.
The full record, including methodology and sector coverage, is open at The Observatory.