# CHQ-SC-2026-006

- **Artifact ID:** CHQ-SC-2026-006
- **Status:** RATIFIED
- **Public record:** https://record.cybersecurityhq.com/conditions/chq-sc-2026-006
- **Machine-record SHA-256:** `ad3f517e2e6b099f6bc827de96b667b8183815bd61fe5a732c28770f447f94fa`

## Complete structured record

```json
{
  "id": "CHQ-SC-2026-006",
  "name": "Exploitation Precedes Defender Awareness",
  "domain": "Vulnerability Operations",
  "status": "RATIFIED",
  "persistence": "REINFORCING",
  "first_observed": "2026-01",
  "reinforcement": {
    "date": "2026-06-09",
    "evidence": "CHQ-EX-2026-021",
    "basis": "The exhibit expressly references SC-006 and records a six-to-seven-week pre-awareness credential exposure interval."
  },
  "definition": "Vulnerability exploitation by threat actors is occurring before public disclosure in a material fraction of confirmed cases, creating an operational window during which disclosure-based remediation controls have no available response. The exposure boundary is defined by the gap between attacker exploitation start and public knowledge, not by organizational patch velocity or response capability.",
  "linked_positions": [
    "CHQ-P-2026-011",
    "CHQ-P-2026-012",
    "CHQ-P-2026-013",
    "CHQ-P-2026-015"
  ],
  "linked_evidence": [
    "CHQ-P-2026-011",
    "CHQ-P-2026-012",
    "CHQ-SM-2026-013",
    "CHQ-EX-2026-021",
    "CHQ-SM-2026-018"
  ],
  "falsification_condition": "VulnCheck annual exploitation analysis shows same-day-or-prior exploitation falling below 10% of KEVs for two consecutive years, AND Mandiant M-Trends mean time to exploit returns to positive double digits in breach caseload, AND no confirmed pre-disclosure exploitation window exceeding 14 days is documented in a 12-month period.",
  "evidence_count": 4,
  "last_reinforced": "2026-06-09",
  "linked_assumptions": [],
  "linked_constraints": [
    "CHQ-ASC-2026-005"
  ],
  "rating": "STRENGTHENING",
  "outlook": "Stable",
  "watch": "none",
  "review_state": "UNDER REVIEW (evaluation 2026-09-24 under criterion v2.0)",
  "criterion_version": "v2.0, effective 2026-09-24. v1.0 invalidated on construct validity, 2026-09-15.",
  "escalation_criterion": "A qualifying instance is exploitation documented by a vendor or authority before the first public disclosure by any party, with T_exploitation and T_disclosure each dated and sourced (CGS-3.3). A label without a date does not qualify.",
  "deescalation_criterion": "Two consecutive quarterly cycles without a qualifying instance move it down one tier; a qualifying instance resets the sequence (declared 2026-09-09)",
  "rating_as_of": "2026-09-22",
  "rating_source": "Structural Condition Report Issue 39",
  "next_review": "2026-09-24",
  "aliases": [
    "Exploitation Timing Precedes Defender Awareness"
  ],
  "name_history": [
    {
      "date": "2026-09-22",
      "from": "Exploitation Timing Precedes Defender Awareness",
      "to": "Exploitation Precedes Defender Awareness",
      "ground": "Aligned to the name published on the weekly Structural Condition board since July 2026 (DM decision 2026-09-22). Definition unchanged."
    }
  ],
  "voided_actions": [
    {
      "date": "2026-09-12",
      "action": "STRENGTHENING to CONFIRMED",
      "ground": "Criterion v1.0 failed construct validity; action voided under CHQ-STATE-MACHINE-2026-002",
      "record": "CHQ-SM-2026-018"
    }
  ]
}
```