Cyber and Disaster Exposure, November and December
A quiet storm season's last weeks, a record pace of exploited flaws and a slow declaration pipeline
The physical catastrophe risk left in the year is narrow and largely priced, while the cyber exposure is running at a record pace and concentrated on internet-facing edge devices; the slowest-moving risk into year end is the federal declaration pipeline that turns storm damage into recovery money.
2 calls from this report, among 22 in Infrastructure & Catastrophe Risk.
Each line is one call in the domain, from the day it was written to the day it resolves. This report's calls are lit; point at any line to read it.
- CLM-2026-433The total number of entries in the CISA Known Exploited Vulnerabilities catalog with a date added on or before 31 December 2026.a range · resolves in 79 d
- CLM-2026-434The President declares a major disaster for the State of Florida for Hurricane Isaias on or before 31 December 2026.80% · resolves in 83 d
| ID | Statement | p | Made on | Resolves by | Status | Outcome |
|---|---|---|---|---|---|---|
| CLM-2026-433 | The total number of entries in the CISA Known Exploited Vulnerabilities catalog with a date added on or before 31 December 2026. | 1790 to 1840 entries (central 1815) | 2026-10-16 | 2027-01-04 | Locked | |
| CLM-2026-434 | The President declares a major disaster for the State of Florida for Hurricane Isaias on or before 31 December 2026. | 0.80 | 2026-10-16 | 2027-01-08 | Locked |
A claim is entered in the brief's own words and carries its publication date and the day it entered the ledger: the register's briefs on 8 September 2026, when the standard was first applied; the forward benchmark on the day it was locked. It resolves only against a dated public source. The scoring rule is on the Methodology page.
For the last two months of the year the infrastructure risk that moves is digital, not meteorological. The hurricane season's tail is thin under the El Nino shear, and the one hurricane that did land produced losses the market can absorb. The exploited-vulnerability catalog, by contrast, is growing at a record rate, with attackers working the same class of exposed edge devices that federal directives have targeted all year. On the disaster side the risk that remains is administrative: whether and when the Gulf Coast storm and the summer's other events receive major disaster declarations, which govern how quickly federal recovery money flows.
Open-source intelligence current through 16 October 2026. The publication carries a 14-entry source registry, explicit confidence tags, limitations, and deterministic resolution rules for its forward claims.
The source tiers, estimative language, forward-claim rule, scoring, and corrections record are public on the Methodology page.