# Structural Condition Board

The Board is the rating of record. Ratings anywhere else are copies.

- **Public landing page:** https://record.cybersecurityhq.com/board

## Current board

```json
[
  {
    "id": "CHQ-SC-2026-002",
    "name": "Edge and Management-Plane Compromise",
    "aliases": [
      "Management Plane Concentration"
    ],
    "rating": "CONFIRMED",
    "outlook": "Accumulating",
    "watch": "none",
    "rating_string": "CONFIRMED / Accumulating / no watch",
    "state": "Affirmed",
    "criterion": "v1.0",
    "rating_as_of": "2026-09-22",
    "next_review": "2026-09-29"
  },
  {
    "id": "CHQ-SC-2026-007",
    "name": "Enterprise Application Plane Exploitation",
    "aliases": [],
    "rating": "CONFIRMED",
    "outlook": "Accumulating",
    "watch": "none",
    "rating_string": "CONFIRMED / Accumulating / no watch",
    "state": "Affirmed",
    "criterion": "v1.0",
    "rating_as_of": "2026-09-22",
    "next_review": "2026-09-29"
  },
  {
    "id": "CHQ-SC-2026-008",
    "name": "Autonomous AI Attack Operations",
    "aliases": [
      "Autonomous Adversary Operations"
    ],
    "rating": "CONFIRMED",
    "outlook": "Accumulating",
    "watch": "none",
    "rating_string": "CONFIRMED / Accumulating / no watch",
    "state": "Affirmed",
    "criterion": "v1.0",
    "rating_as_of": "2026-09-22",
    "next_review": "2026-09-29"
  },
  {
    "id": "CHQ-SC-2026-009",
    "name": "Security Tooling as Exploited Surface",
    "aliases": [],
    "rating": "CONFIRMED",
    "outlook": "Accumulating",
    "watch": "none",
    "rating_string": "CONFIRMED / Accumulating / no watch",
    "state": "Affirmed",
    "criterion": "v1.0",
    "rating_as_of": "2026-09-22",
    "next_review": "2026-09-29"
  },
  {
    "id": "CHQ-SC-2026-006",
    "name": "Exploitation Precedes Defender Awareness",
    "aliases": [
      "Exploitation Timing Precedes Defender Awareness"
    ],
    "rating": "STRENGTHENING",
    "outlook": "Stable",
    "watch": "none",
    "rating_string": "STRENGTHENING / Stable / no watch",
    "state": "UNDER REVIEW (evaluation 2026-09-24 under criterion v2.0)",
    "criterion": "v2.0, effective 2026-09-24. v1.0 invalidated on construct validity, 2026-09-15.",
    "rating_as_of": "2026-09-22",
    "next_review": "2026-09-24"
  },
  {
    "id": "CHQ-SC-2026-004",
    "name": "AI Agent Runtime Compromise",
    "aliases": [
      "Automation Trust Inheritance"
    ],
    "rating": "EMERGING",
    "outlook": "Stable",
    "watch": "none",
    "rating_string": "EMERGING / Stable / no watch",
    "state": "Affirmed",
    "criterion": "v1.0",
    "rating_as_of": "2026-09-22",
    "next_review": "2026-09-29"
  },
  {
    "id": "CHQ-SC-2026-010",
    "name": "Vendor Risk-Signal Reliability",
    "aliases": [],
    "rating": "EMERGING",
    "outlook": "Receding",
    "watch": "none",
    "rating_string": "EMERGING / Receding / no watch",
    "state": "Affirmed",
    "criterion": "v1.0",
    "rating_as_of": "2026-09-22",
    "next_review": "2026-09-29"
  }
]
```

## Registered, not on the weekly board

```json
[
  {
    "id": "CHQ-SC-2026-001",
    "name": "Trust Boundary Inversion",
    "status": "RATIFIED"
  },
  {
    "id": "CHQ-SC-2026-003",
    "name": "Verification Collapse",
    "status": "RATIFIED"
  },
  {
    "id": "CHQ-SC-2026-005",
    "name": "Disclosure Governance Divergence",
    "status": "RATIFIED"
  }
]
```

## Under review

```json
[
  {
    "id": "CHQ-SC-2026-006",
    "name": "Exploitation Precedes Defender Awareness",
    "displayed_rating": "STRENGTHENING",
    "review_state": "UNDER REVIEW (evaluation 2026-09-24 under criterion v2.0)",
    "voided_actions": [
      {
        "date": "2026-09-12",
        "action": "STRENGTHENING to CONFIRMED",
        "ground": "Criterion v1.0 failed construct validity; action voided under CHQ-STATE-MACHINE-2026-002",
        "record": "CHQ-SM-2026-018"
      }
    ],
    "next_adjudication": "2026-09-24",
    "criterion": "v2.0, effective 2026-09-24. v1.0 invalidated on construct validity, 2026-09-15.",
    "governing_record": "CHQ-SM-2026-018"
  }
]
```

## Published triggers

```json
[
  {
    "id": "CHQ-SC-2026-002",
    "name": "Edge and Management-Plane Compromise",
    "near": false,
    "escalation": "New confirmed-exploitation entry in a declared sub-class",
    "deescalation": "Two consecutive quarterly cycles with no new confirmed-exploitation entry across the declared sub-classes"
  },
  {
    "id": "CHQ-SC-2026-007",
    "name": "Enterprise Application Plane Exploitation",
    "near": false,
    "escalation": "New confirmed-exploited platform in the class (ERP, PLM, collaboration, financial processing)",
    "deescalation": "Two consecutive quiet quarterly cycles"
  },
  {
    "id": "CHQ-SC-2026-008",
    "name": "Autonomous AI Attack Operations",
    "near": false,
    "escalation": "Second instance within a sub-class. Sub-class (b) met 2026-09-03; at the rating ceiling this opens Position candidacy (CGS-8.7). A novel-discovery campaign forces review",
    "deescalation": "Two quiet quarterly cycles across both sub-classes"
  },
  {
    "id": "CHQ-SC-2026-009",
    "name": "Security Tooling as Exploited Surface",
    "near": false,
    "escalation": "Campaign linkage forces review",
    "deescalation": "Two consecutive quarterly cycles with no new confirmed-exploitation entry across the declared classes"
  },
  {
    "id": "CHQ-SC-2026-006",
    "name": "Exploitation Precedes Defender Awareness",
    "near": true,
    "escalation": "A qualifying instance is exploitation documented by a vendor or authority before the first public disclosure by any party, with T_exploitation and T_disclosure each dated and sourced (CGS-3.3). A label without a date does not qualify.",
    "deescalation": "Two consecutive quarterly cycles without a qualifying instance move it down one tier; a qualifying instance resets the sequence (declared 2026-09-09)"
  },
  {
    "id": "CHQ-SC-2026-004",
    "name": "AI Agent Runtime Compromise",
    "near": false,
    "escalation": "First confirmed production incident reclassifies to CONFIRMED",
    "deescalation": "Retirement review after four consecutive quiet quarterly cycles, with retirement criteria declared before first use (declared 2026-09-09)"
  },
  {
    "id": "CHQ-SC-2026-010",
    "name": "Vendor Risk-Signal Reliability",
    "near": false,
    "escalation": "Three new documented reversals after the 27 Aug de-escalation",
    "deescalation": "Retirement criteria declared before first use (not yet declared)"
  }
]
```

## Rating actions

```json
[
  {
    "id": "RA-2026-011",
    "date": "2026-09-15",
    "condition": "CHQ-SC-2026-006",
    "action": "VOIDED",
    "from_state": "CONFIRMED",
    "to_state": "STRENGTHENING (under review)",
    "basis": "Criterion v1.0 failed construct validation",
    "source": "CHQ-SM-2026-018",
    "cgs_provisions": [
      "CGS-8.3",
      "CGS-8.6"
    ],
    "status": "VALID"
  },
  {
    "id": "RA-2026-010",
    "date": "2026-09-12",
    "condition": "CHQ-SC-2026-006",
    "action": "RAISED",
    "from_state": "STRENGTHENING",
    "to_state": "CONFIRMED",
    "basis": "Lag instance under criterion v1.0",
    "source": "Issue 38",
    "cgs_provisions": [],
    "status": "VOIDED",
    "voided_by": "RA-2026-011"
  },
  {
    "id": "RA-2026-009",
    "date": "2026-09-03",
    "condition": "CHQ-SC-2026-008",
    "action": "TRIGGER_MET_RATING_UNCHANGED",
    "from_state": "CONFIRMED",
    "to_state": "CONFIRMED",
    "basis": "Second verified containment escape (sub-class b); Position-candidacy review opened",
    "source": "Issue 37",
    "cgs_provisions": [
      "CGS-8.7"
    ],
    "status": "VALID"
  },
  {
    "id": "RA-2026-008",
    "date": "2026-08-27",
    "condition": "CHQ-SC-2026-010",
    "action": "LOWERED",
    "from_state": "STRENGTHENING",
    "to_state": "EMERGING",
    "basis": "Second consecutive qualifying cycle; first de-escalation on the board; prior reversals become historical context",
    "source": "Evaluation 2026-08-27",
    "cgs_provisions": [],
    "status": "VALID"
  },
  {
    "id": "RA-2026-007",
    "date": "2026-08-04",
    "condition": "CHQ-SC-2026-008",
    "action": "SCOPE_REFINED",
    "from_state": "definition v1.0",
    "to_state": "definition v1.1",
    "basis": "Two sub-classes declared: (a) adversarial operation, (b) containment escape",
    "source": "Issue 32",
    "cgs_provisions": [],
    "status": "VALID"
  },
  {
    "id": "RA-2026-006",
    "date": "2026-08-04",
    "condition": "CHQ-SC-2026-009",
    "action": "RAISED",
    "from_state": "STRENGTHENING",
    "to_state": "CONFIRMED",
    "basis": "Escalation trigger met; independence audit published with adjacency flag",
    "source": "Issue 32",
    "cgs_provisions": [],
    "status": "VALID"
  },
  {
    "id": "RA-2026-005",
    "date": "2026-07-28",
    "condition": "CHQ-SC-2026-009",
    "action": "NEWLY_RATED",
    "from_state": "none",
    "to_state": "STRENGTHENING",
    "basis": "Three security products from three vendors under confirmed exploitation, each by a distinct mechanism; entered below CONFIRMED as a self-originated condition",
    "source": "Issue 31",
    "cgs_provisions": [],
    "status": "VALID"
  },
  {
    "id": "RA-2026-004",
    "date": "2026-07-07",
    "condition": "CHQ-SC-2026-004",
    "action": "WATCH_PLACED",
    "from_state": "EMERGING",
    "to_state": "EMERGING (Watch)",
    "basis": "New product-level demonstrations; a production incident reclassifies",
    "source": "SCR 2026-07-07",
    "cgs_provisions": [],
    "status": "VALID"
  },
  {
    "id": "RA-2026-003",
    "date": "2026-07-07",
    "condition": "CHQ-SC-2026-010",
    "action": "WATCH_PLACED",
    "from_state": "STRENGTHENING",
    "to_state": "STRENGTHENING (Watch)",
    "basis": "Two vendor assessment reversals in cycle; a third reclassifies",
    "source": "SCR 2026-07-07",
    "cgs_provisions": [],
    "status": "VALID"
  },
  {
    "id": "RA-2026-002",
    "date": "2026-07-07",
    "condition": "CHQ-SC-2026-008",
    "action": "NEWLY_RATED",
    "from_state": "none",
    "to_state": "CONFIRMED",
    "basis": "First documented end-to-end agent-operated ransomware operation (CHQ-EX-2026-022)",
    "source": "SCR 2026-07-07",
    "cgs_provisions": [],
    "status": "VALID"
  },
  {
    "id": "RA-2026-001",
    "date": "2026-07-07",
    "condition": "CHQ-SC-2026-007",
    "action": "RAISED",
    "from_state": "STRENGTHENING",
    "to_state": "CONFIRMED",
    "basis": "Fourth independent confirmed-exploited platform in the class, with ransomware attribution",
    "source": "SCR 2026-07-07",
    "cgs_provisions": [],
    "status": "VALID"
  }
]
```

## Track record

```json
{
  "new_ratings": 2,
  "upgrades": 3,
  "upgrades_voided": 1,
  "downgrades": 1,
  "watch_placements": 2,
  "scope_refinements": 1,
  "triggers_met_rating_unchanged": 1,
  "actions_voided": 1,
  "snapshot_corrections": 1,
  "expectations": {
    "issued": 3,
    "confirmed": 0,
    "disconfirmed": 3,
    "open": 0
  }
}
```

## Build metadata

- built_at: 2026-09-22T18:30:21.535Z
- registry_sha256: `523fea58d04df3e70e1ec4e062191e37dd2a0271fb1a25b13a9db4e5e385fe5b`