Guides
How to read the DEFCON level
The level of the day shows at a glance how serious the cyber threat is: what each level means, what to do and how to read the briefing.
The five levels
Like the scale it is named after, the level goes from DEFCON 5, the calmest, to DEFCON 1, the most severe. Each level also says what to do.
| Level | What to do |
|---|---|
| DEFCON 1 · Critical risk | Mass attacks under way: act now. |
| DEFCON 2 · Severe risk | Check now whether it affects you, and update. |
| DEFCON 3 · Substantial risk | If you use the products under attack, update them now. |
| DEFCON 4 · Moderate risk | Update the affected products in your normal cycle. |
| DEFCON 5 · Low risk | No urgency: routine maintenance. |
The level measures the threat of that day, not the security of your network: DEFCON 1 does not mean you have been attacked, but that attacks are under way on widely used products, and the briefing says which ones.
The level of the day and the current level
- The level of the day comes with the 05:00 UTC briefing and then never changes. It is the level of the public DefenceLevel Index, day by day.
- The current level is recalculated at every collection, about every 30 minutes, on the last 24 hours, and rises immediately when an immediate alert is sent.
Alerts
- DEFCON 1 and 2: an immediate alert by email, as soon as the vulnerability is verified, without waiting for the next briefing. At DEFCON 1 it always reaches every subscriber; at DEFCON 2 everyone, or only for their own products with the “Only my products” choice in My Defence.
- DEFCON 3: a quick alert only for those who chose “Only my products” and use an affected product.
- DEFCON 4 and 5: no alert; the vulnerabilities are in the briefing.
How it is calculated
The level is set by explicit, verifiable rules, published in the methodology with their version: with the same data the result is always the same. Each vulnerability reported by hundreds of sources is assessed on technical severity, real-world exploitation, impact and the attention of the sources. The level of the day is the most severe among those of the vulnerabilities in the briefing: the new ones and those still ongoing, the latter one step lower. Artificial intelligence never decides the level, the selection or the order of the vulnerabilities.
How to read the briefing
The briefing opens with the level and a summary, then the sections: “New in the last 24 hours”, “Still ongoing”, “Other exploited vulnerabilities”, “Worth watching” and “Much discussed, but no cause for alarm today”. For each vulnerability you find the title (always in English, as in the sources), the level, the severity, the exploitation status, the affected products, what to do and why we are talking about it now. Each part has a precise origin:
- Level, selection and order: the rules of the methodology, never artificial intelligence.
- Data: CVSS score, EPSS probability, addition to the KEV catalogue, products, fixed versions, dates and sources come from official sources (NVD, cve.org, FIRST, CISA, national CERTs, vendor advisories) and from the independent sources we read.
- Texts: before sending, an artificial intelligence system checks every briefing and every alert against our data, corrects wrong attributions and writes the texts. Automatic checks with fixed rules compare the numbers, versions and products in the texts with the sources.
Frequently asked questions
Can the level change during the day?
The level of the day cannot: it is set with the 05:00 UTC briefing. The current level can, at every collection, and an immediate alert raises it at once.
Does DEFCON 1 mean my company is under attack?
No: it means mass attacks are under way on widely used products. If you use those products, act now; the briefing and the alert say which ones and what to do.
Who decides the level?
The rules of the methodology, public and versioned. If a piece of information turns out to be attributed to the wrong vulnerability, it is excluded and the level is recalculated with the same rules.
Can I receive alerts only for my products?
Yes, with My Defence: you map your infrastructure, zone by zone, and choose “Only my products” for alerts and for the briefing.