Sector Pulse
What is publicly known, sector by sector.
A read on publicly disclosed cryptography-relevant vulnerabilities, grouped by the sector that typically operates the affected software. This is disclosure activity, not telemetry from any customer estate — it does not measure any named organisation's security, and it is not a prediction. We hold no customer data on this page.
Rolling read over the live CISA KEV catalogue and GitHub Advisory Database, refreshed hourly.
By sector
Ten sectors, one public advisory pool.
Each card shows the count of cryptography-relevant public advisories attributed to that sector in the window above, a small breakdown by failure category, and the most notable recent entries with their real public identifiers. A sector with no qualifying advisory says so — we do not fabricate one to fill the card.
Financial Services
Core banking, payment rails and interbank messaging depend on RSA and ECC for authentication and signing, and DORA now names cryptographic resilience as a supervised control.
Most notable recent
No cryptography-relevant public advisory attributes to this sector in the current window. That is an honest empty, not an omission — we do not invent an advisory to fill this card.
Healthcare
Patient records and connected device telemetry carry confidentiality requirements measured in decades, so ciphertext harvested today stays sensitive long enough to matter on Q-Day.
Most notable recent
No cryptography-relevant public advisory attributes to this sector in the current window. That is an honest empty, not an omission — we do not invent an advisory to fill this card.
Public Sector
National identity, tax and defence systems anchor trust in long-lived PKI and smart-card cryptography that is costly to replace once a compliance deadline is fixed.
Most notable recent
No cryptography-relevant public advisory attributes to this sector in the current window. That is an honest empty, not an omission — we do not invent an advisory to fill this card.
Energy & Utilities
Grid control and SCADA cryptography is often embedded in hardware with decade-plus refresh cycles, which stretches the exposure window well past typical IT patch timelines.
Most notable recent
No cryptography-relevant public advisory attributes to this sector in the current window. That is an honest empty, not an omission — we do not invent an advisory to fill this card.
Telecommunications
Network signalling, remote device management and backhaul encryption run on SSH and TLS at a scale where one library flaw reaches millions of endpoints at once.
Most notable recent
No cryptography-relevant public advisory attributes to this sector in the current window. That is an honest empty, not an omission — we do not invent an advisory to fill this card.
Manufacturing & Industrial
Firmware signing and OT device authentication rely on embedded key material that is rarely rotated across a product's service life.
Most notable recent
No cryptography-relevant public advisory attributes to this sector in the current window. That is an honest empty, not an omission — we do not invent an advisory to fill this card.
Retail & E-commerce
Card-present and card-not-present checkout flows depend on TLS and payment-token cryptography that sits directly inside PCI DSS assessment scope.
Most notable recent
No cryptography-relevant public advisory attributes to this sector in the current window. That is an honest empty, not an omission — we do not invent an advisory to fill this card.
Technology & SaaS
Cryptographic libraries built here are consumed downstream by every other sector on this page, so a single advisory can have the widest blast radius of any on this list.
Most notable recent
No cryptography-relevant public advisory attributes to this sector in the current window. That is an honest empty, not an omission — we do not invent an advisory to fill this card.
Transport & Logistics
Fleet telematics, e-passports and customs systems embed certificates and signatures in devices that are hard to patch once they have shipped.
Most notable recent
No cryptography-relevant public advisory attributes to this sector in the current window. That is an honest empty, not an omission — we do not invent an advisory to fill this card.
Education & Research
Research data and federated identity (campus single sign-on) rely on the same TLS and signature primitives as the rest of this list, with materially smaller security teams to patch them.
Most notable recent
No cryptography-relevant public advisory attributes to this sector in the current window. That is an honest empty, not an omission — we do not invent an advisory to fill this card.
By category
The same pool, grouped by how the cryptography actually failed.
Sector attribution answers who typically runs the affected software. This view answers what kind of cryptographic failure the advisory describes, using the same classification rules published below.
Certificate & PKI validation flaws
0Proxies for CWE-295, CWE-296, CWE-297
No public advisory in the current window matched this category's keywords.
Random-number-generation weaknesses
0Proxies for CWE-330, CWE-338
No public advisory in the current window matched this category's keywords.
Signature-verification bypasses
0Proxies for CWE-347
No public advisory in the current window matched this category's keywords.
TLS/protocol implementation bugs
1Proxies for CWE-322, CWE-325
Key-management & key-exposure failures
0Proxies for CWE-321, CWE-322
No public advisory in the current window matched this category's keywords.
Broken or deprecated primitives
0Proxies for CWE-326, CWE-327, CWE-328
No public advisory in the current window matched this category's keywords.
Side-channel & timing leaks
0Proxies for CWE-208
No public advisory in the current window matched this category's keywords.
Methodology
Every rule on this page, in the open.
This candour is the point of the page. If you can see exactly how a signal was built, you can decide for yourself how much weight to give it.
1 · Feeds & window
- CISA Known Exploited Vulnerabilities catalogue (public JSON).
- GitHub Security Advisories (public REST, no auth).
- Refreshed hourly in production. This sandbox build cannot reach either feed, so the page below is rendering the committed snapshot — see the badge above.
2 · Cryptography relevance
An advisory qualifies if its identifier or title contains one of 21 keywords, chosen to proxy for 13 CWE categories. Our feed extraction surfaces an advisory's id, title, date and severity but not structured CWE metadata, so keyword matching is the operative signal today — stated plainly, not hidden.
3 · Sector attribution
A vendor or product keyword in the advisory title is matched against a fixed table, first match wins. No match means the advisory is not shown on any sector card. This is a heuristic — "who typically runs this software" — not a confirmed deployment, and it will sometimes be wrong.
4 · Category assignment
Every cryptography-relevant advisory is also filed into one of seven failure categories by the same first-match keyword discipline, so the same advisory can be counted once by sector and once by category without double-counting either roll-up.
The exact rule set, generated straight from the constants the page runs — copy it to check our work against the live feeds yourself:
RULE 1 — Cryptography relevance (case-insensitive substring match)
RSA, ECC, ECDSA, ECDH, AES, TLS, SSL, X.509, PKI, SSH, certificate, signature, cryptograph, encryption, cipher, nonce, key generation, key recovery, private key, CryptoAPI, OpenSSL
RULE 2 — Sector attribution (first vendor/product match wins)
"infineon" -> Public Sector
"windows" -> Public Sector
"java" -> Financial Services
"openssl" -> Technology & SaaS
"putty" -> Technology & SaaS
"ssh" -> Telecommunications
(no match -> advisory is not shown on any sector card)
RULE 3 — Category assignment (first keyword match wins)
certificate, x.509, pki, chain of trust
-> Certificate & PKI validation flaws (proxies CWE-295, CWE-296, CWE-297)
nonce, random number, prng, insufficient randomness, weak random, predictable random
-> Random-number-generation weaknesses (proxies CWE-330, CWE-338)
signature validation, signature verification, signature bypass, forged signature
-> Signature-verification bypasses (proxies CWE-347)
tls, ssl, ssh, handshake, transport protocol
-> TLS/protocol implementation bugs (proxies CWE-322, CWE-325)
private key, key recovery, key generation, hard coded key, key exposure, key management
-> Key-management & key-exposure failures (proxies CWE-321, CWE-322)
md5, sha1, sha 1, rc4, 3des, export cipher, weak cipher, deprecated cipher
-> Broken or deprecated primitives (proxies CWE-326, CWE-327, CWE-328)
timing attack, side channel, padding oracle, cache timing, power analysis
-> Side-channel & timing leaks (proxies CWE-208)Sources & cadence
Named feeds, stated licence, exact window.
CISA Known Exploited Vulnerabilities (KEV) Catalog
The authoritative U.S. government record of vulnerabilities confirmed to be actively exploited.
Published by the U.S. Cybersecurity and Infrastructure Security Agency (cisa.gov). U.S. government work.
Cadence · Fetched live, revalidated every hour in production.
GitHub Advisory Database (GHSA)
GitHub-curated and community-submitted security advisories, including many originating from the CVE program.
Advisory data from the GitHub Advisory Database, © GitHub, Inc. and contributors, used under CC BY 4.0 (github.com/github/advisory-database).
Cadence · Fetched live, revalidated every hour in production.
Exact window covered by the numbers above: Rolling read over the live CISA KEV catalogue and GitHub Advisory Database, refreshed hourly. No other feed, no other vendor telemetry and no customer-estate data contributes to any figure on this page.
Limits
What Sector Pulse does not tell you.
- Sector assignment from advisory text is lossy. We match a vendor or product keyword to the sector that typically operates that software. It is not a confirmed deployment record, and it will sometimes attribute an advisory to the wrong sector.
- Vendor-to-sector mapping is imperfect, and one sector per advisory is a simplification. Our rule assigns exactly one sector per advisory, first match wins. A widely used library can plausibly touch several sectors at once; this page still counts it under only one.
- Category assignment is the same kind of heuristic. An advisory that plausibly fits two failure categories is filed under whichever category keyword matches first, not by verified root cause.
- Counts measure published advisory volume, not risk. A sector or category with more advisories may simply have more researcher attention, more open-source components, or more disclosure obligations — not more actual vulnerable cryptography.
- Absence of advisories is not evidence of safety. A sector or category card showing zero means zero advisories matched our keyword rules in this window — nothing more.
- None of this is derived from any customer's data. Every figure on this page comes from a public feed or the committed public snapshot described above.
- We do not rank named companies, and we will not. Sector Pulse groups public advisories by sector and category. It never names, scores or compares a specific organisation.
Go deeper
From a sector signal to your own estate.
Threat Radar
The full live feed this page draws from, plus the quantum hardware race and every compliance deadline.
Open
The Theos Method
The published scoring methodology a sector signal like this one eventually feeds into, for a single asset in your own estate.
Open
How the exposure score is built
The five-dimension arithmetic behind a single asset's score — separate from, and more precise than, sector-level advisory counts.
Open
Readiness Check
A free self-assessment for your own estate — the honest next step after reading a sector-level signal.
Open