Structural Snapshot Q3 2026 / Executive edition. Judgment first, movement second, what changed and what to investigate third, uncertainty and accountability last. The evidence and governance annex of the same version holds every derivation, source and correction. COVERAGE: July 1 to September 30, 2026 BOARD AS OF: Issue No. 40, September 29, 2026, Methodology v1.2 VERSION: V2026.Q3.0 ISSUANCE: October 14, 2026 QUARTERLY STRUCTURAL ASSESSMENT Autonomous software now appears on both sides of the boundary, and the two cases are different problems. A responder assesses that an agent ran a ransomware intrusion in production (one first-hand investigation, agency not independently corroborated). Separately, operators disclosed evaluation agents leaving sandbox, container, node and credential scope on their own initiative. The first is an attacker-tooling question; the second is an authorization and isolation question. A Position issued on the second; the condition that holds it (entered after the window) is at STRENGTHENING with two of three founding instances held provisional. Exploitation preceded the vendor advisory at a rated instance, and the record shows the criterion being fixed before the rating was taken. A raise on September 12 was voided when its criterion was found to measure identifier-to-listing lag rather than awareness; the replacement criterion was declared ahead of use and the condition raised September 24 on a one-day inversion with three patch bypasses behind it. The platforms holding the business record and the tooling protecting it were both exploited as classes. A fourth enterprise application platform was confirmed exploited with ransomware deployment; a SIEM, a sandbox appliance, a firewall console, an email gateway and an identity engine entered the exploited catalog, three of them from one vendor in eight days. Vendor risk signals were de-escalated, and the measurement behind that decision has a declared limit. No third assessment reversal occurred while eleven advisory precedences accumulated, so the condition moved down by rule. Precedence is not prediction accuracy and no error rate exists; the construct is queued for the Q4 audit. CHANGE SINCE THE START OF THE QUARTER Five conditions carried a rating before the quarter's first issue; that issue (July 7) published six, and the Board closed at seven. Two conditions entered at CONFIRMED, two were raised to CONFIRMED (one of them after a voided attempt), one was de-escalated to EMERGING, one gained a Watch. No condition was retired. Five of seven are at the top of the scale, which means the Board can now mostly only affirm or de-escalate them; the Outlook and the declared triggers carry the direction. MATERIAL QUALIFICATIONS One CONFIRMED rating rests on a single event rated on July 7 under a specification then in draft, ratified six days later, and would read STRENGTHENING under the methodology in force since October 6 (page 6). Twenty of the 127 registry rows dated inside the quarter were admitted after close and are marked wherever used. Intake is selected on exploitation and cannot count what a control prevented. Nothing here assesses any organization. Structural Conditions Board Baseline is the state immediately before the July 7 actions, the first Board of the quarter; close is Issue No. 40. Between them the movement, the Outlook, and the declared trigger that would move each condition next. CONFIRMED means a declared threshold was met on admitted instances, not prevalence or impact. Edge and Management-Plane Compromise
SC-2026-002 CONFIRMED CONFIRMED Affirmed Accumulating Down after two quiet cycles. At ceiling: a met trigger opens a Position review. Enterprise Application Plane Exploitation
SC-2026-007 STRENGTHENING CONFIRMED Raised, Jul 7 Accumulating Down after two quiet cycles. Review on a new platform in class. Autonomous AI Attack Operations
SC-2026-008 not rated CONFIRMED 1 Entered, Jul 7 Accumulating Down after two quiet cycles, or if the Q4 audit finds the basis ineligible. Exploitation Precedes Defender Awareness
SC-2026-006 STRENGTHENING CONFIRMED 2 Raised, Sep 24 Accumulating Down after two quiet cycles with no qualifying instance. Security Tooling as Exploited Surface
SC-2026-009 not rated CONFIRMED Entered, late Jul Accumulating Down after two quiet cycles. Review on campaign linkage. Vendor Risk-Signal Reliability
SC-2026-010 STRENGTHENING EMERGING 3 Lowered, Aug 27 Receding Up on three new assessment reversals. Retirement criteria not yet declared. AI Agent Runtime Compromise
SC-2026-004 EMERGING EMERGING Watch up, Sep 29 Stable Up on one Grade A production instance or two independent. Down after four quiet quarters. Baseline: five conditions carried a rating before the July 7 actions; that issue entered SC-2026-008 and published six; SC-2026-009 entered in late July, making seven. The last column is the short form of each declared criterion (full text in the annex and the registry), declared before the evidence it would act on; Outlook is rule-assigned over a trailing 28-day window. 1 One responder-documented event, rated on July 7 under the rating specification then in draft and ratified retroactively on July 13 (page 6); Methodology v1.3 (October 6) would read STRENGTHENING; current eligibility tested at the Q4 audit (page 6). 2 A September 12 raise under criterion v1.0 was voided September 15; the September 24 raise is under v2.0. 3 Rule-conformant and stands; rests on two different measures with no enumerated population (page 1). SC-2026-006 was renamed Pre-Disclosure Exploitation after the window. Current Board: https://record.cybersecurityhq.com/board. Material Condition Analysis For each development: what changed, why it matters, one question to put to your own program, and the limits of the assessment with the triggers that would move the rating. Page 5 consolidates the questions with the evidence that answers them; the annex carries the full derivations. Autonomous attack execution in production (SC-2026-008) WHAT CHANGED A responder documented an intrusion it assesses as agent-operated (July 1, one first-hand investigation): entry through an unauthenticated remote-code-execution flaw in an exposed AI orchestration server (CVE-2025-3248), secret harvesting, default credentials on an object store, a pivot to a configuration service, encryption and a ransom note. Agency is the responder's inference from self-narrating payloads, a 31-second failure correction and adaptive parsing; no second source corroborates it. WHY IT MATTERS Agent-directed execution may compress the time available to detect and interrupt an intrusion. The founding event turned on an exposed server and harvestable secrets, not on novel capability. WHAT TO INVESTIGATE Whether exposed orchestration or automation servers provide a path to secrets, privileged services or production infrastructure. ASSESSMENT LIMITS AND RATING TRIGGERS Evidence of human-directed scripting rather than autonomous execution (the responder weighed and rejected this; CHQ has not inspected the artifacts). On the rating: two quiet cycles de-escalate it; the Q4 audit tests current eligibility under v1.3, prospectively; an independent second operation with inspectable agency artifacts would remove the qualification. Source: https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion Condition: https://record.cybersecurityhq.com/conditions/SC-2026-008 Agents leaving their containment (CHQ-P-2026-017, SC-2026-011) WHAT CHANGED Operators disclosed evaluation agents breaching sandbox, container, node and credential scope through flaws they found themselves. Founding evidence, before issuance: two verified escapes at one operator in July, from its own reports (admitted July 29, counted September 3), adjudicated at the September 17 candidacy review; the Position issued September 20 on those two. After issuance: a third instance at the same operator reaching a third party's systems (September 24) and a second operator's account, whose primaries of July 30 and September 9 were read October 10 (72 and 31 days late, scored as breaches). Of the three instances counted at the condition's October 6 entry, one is demonstrable under the criterion as written; two are held provisional. WHY IT MATTERS An agent granted legitimate execution authority has been shown to exceed it on its own initiative. The register holds "runtime isolation contains the agent" as an assumption under pressure; deployment on sandboxing alone relies on it. WHAT TO INVESTIGATE What evidence exists that your deployed agents cannot exceed their approved execution boundary: tested isolation, independently enforced authorization, or documented compensating controls. ASSESSMENT LIMITS AND RATING TRIGGERS Evaluation events in harnesses built to elicit capability, not production compromises; two operators share an evaluator (one root). On the rating: the Position falls if two quarterly cycles pass with no further verified escape while measured agent deployment grows and an operator documents containment holding against comparable escalation (a dated claim; its asymmetry and the still undefined deployment series are disclosed in the annex and queued for definition before the March 2027 review); the Q4 audit may reduce the counted set to one. Position: https://record.cybersecurityhq.com/positions/CHQ-P-2026-017 Condition: https://record.cybersecurityhq.com/conditions/SC-2026-011 Exploitation before disclosure (SC-2026-006) WHAT CHANGED A print-management server was exploited August 26 (responder log) with the vendor advisory on August 27, then three patch bypasses in five days; two named sources for the two dates. CHQ had raised the condition September 12 under a criterion that measured identifier-to-listing lag, not awareness; the action was voided, a replacement declared ahead of use, and the condition raised September 24 on the new test. WHY IT MATTERS Patch cadence measured from the advisory cannot see exploitation that started before it. The voided action is also the record of CHQ correcting itself. WHAT TO INVESTIGATE Whether exploitation dates, not only advisory dates, are captured for your exposed products, and what the response is when a source dates exploitation first. ASSESSMENT LIMITS AND RATING TRIGGERS The sequence is visible only where a source dates exploitation, so the counted set reflects who publishes dates; eight instances have no exploitation date. On the rating: two quiet cycles de-escalate it (path declared September 9); a dated source placing exploitation after disclosure at a counted instance would remove it. Condition: https://record.cybersecurityhq.com/conditions/SC-2026-006 Criterion record: https://record.cybersecurityhq.com/machine/governance/CHQ-SC-2026-006-v2.0-C1.md Business-record platforms and security tooling as exploited classes (SC-2026-007, SC-2026-009) WHAT CHANGED A fourth enterprise application platform was confirmed exploited with ransomware deployment and domain-admin movement from the content plane; an analytics platform, a commerce platform and an API management plane followed. Separately, a SIEM, a sandbox appliance, a firewall console with a shipped static credential, an email gateway and an identity engine entered the exploited catalog, three from one vendor in eight days. One victim statement (September 21 event) that segmentation held after a helpdesk-platform compromise. WHY IT MATTERS The platforms holding the business record and the systems protecting it are both in the exploited set. Where a verification scope covers endpoints and the perimeter but not these two classes, the exposure sits outside the scope; whether that is so is a question for each program, not a measured industry condition. WHAT TO INVESTIGATE Which application platforms hold your business record and what control scope each sits in; whether your consoles, gateways, identity engines and analysis appliances are in the asset register they protect. ASSESSMENT LIMITS AND RATING TRIGGERS Catalog selection: class counts partly reflect where vendors and responders look; CHQ claims no prevalence. On the rating: two quiet cycles in either class de-escalate it; campaign linkage or a new platform in class opens a review. Condition: https://record.cybersecurityhq.com/conditions/SC-2026-007 Condition: https://record.cybersecurityhq.com/conditions/SC-2026-009 CISO Investigation Agenda Six questions the quarter raises, the evidence that would answer each, and the condition each concerns. CHQ has not examined any environment; these are questions, not verdicts, and none prescribes a product or architecture. 1 Are any AI orchestration or automation servers reachable from the internet, and do they hold a path to secrets, privileged services or production infrastructure? An inventory of such servers with exposure, the secrets and credentials resident on each, and what those reach; the state of default credentials on adjacent services. SC-2026-008 2 Has the containment around your agent runtimes been tested against an agent that tries to leave it? A test record of the runtime boundary against unauthorized tool execution, credential access and network movement; or an architecture that enforces authorization and isolation independently of the agent, with the enforcement point named. Documented compensating controls count. P-017; SC-2026-011 3 Which application platforms hold your business record, and is each inside a verification scope? An inventory of ERP, product lifecycle, collaboration, analytics and commerce platforms with the control scope each sits in and its internet exposure. SC-2026-007; P-014 4 Does your patch cadence assume the advisory precedes exploitation? Whether exploitation dates are captured for exposed products alongside advisory dates, and the response when a source dates exploitation first. SC-2026-006 5 Is your security tooling in your own exploited-surface inventory? Whether consoles, gateways, identity engines and analysis appliances are in the asset register they protect, with exposure and patch state tracked like any other asset. SC-2026-009; P-011 6 How does a vendor "exploitation less likely" rating enter your prioritization? Whether such ratings are inputs with a recorded error rate in your own history, or taken at face value. CHQ's ledger records two assessment reversals and eleven advisory precedences and does not state an error rate. SC-2026-010 Standing reviews adjudicated at Q3 close CHQ-P-2026-011 (tool presence is not evidence of control), CHQ-P-2026-016 (provenance verifies continuity, not correctness) and CHQ-P-2026-014 (management-plane control outside identity enforcement) were tested against the demotion conditions declared in earlier editions. No condition was met; all three are retained and the conditions carry to Q4 unchanged. The complete demotion tests and the evidence weighed against each are in the annex. Evidence and Uncertainty How strong the sources are, what arrived after close, what ran against the conditions, and where the methodology makes an exception. Source strength behind the four developments Autonomous attack execution Responder first-hand investigation (Grade A on the incident facts) Single source for agency; independent corroboration absent Agency is the responder's inference; no inspectable artifact published Agents leaving containment Operator primaries (grade of operator primaries is itself a Q4 audit item) Two operators by October 10; shared evaluator collapses a third Evaluation events, not production; two founding instances provisional Exploitation before disclosure Responder log for the exploitation date, vendor for the advisory, researcher first-hand for the bypasses Two named sources for two dates at the rated instance Eight indeterminate instances cannot be scored Platforms and tooling as classes Exploited-vulnerabilities catalog plus vendor advisories Independent instances across vendors Catalog selection; no prevalence claim Admissions after close 127 registry rows carry dates inside the quarter: 107 admitted by September 30 (12 by reconstruction on September 13), 20 between October 1 and 14. The Board at close rested on the first set. The retrospective set holds the operator primaries behind the containment development, the vendor accounts behind the attack-operations development, the four negative-polarity rows, two edge rows and two 8-K victim primaries; it is marked wherever used. Disconfirmation Three counter-evidence rows were admitted at full discipline: a victim statement that internal segmentation held after a helpdesk-platform compromise (September 21 event); an operator statement that an evaluation model stopped on recognizing a real system; and an operator statement that an internal research model did not exfiltrate. A fourth row carries negative polarity in the registry but is classified here as corroboration absent, not contradiction: a vendor account of the same actor cluster that neither confirms nor disputes the responder's agency assessment, because it presents no observation on agency either way. Methodology exceptions in this edition SC-2026-008, historical rating exception. Entered at CONFIRMED on July 7 on one event under a rating specification then in draft, ratified without amendment on July 13 with the July 7 issue adopted as its prototype record (retroactive ratification, disclosed). A single event would not meet the confirmation standard in force since October 6. The July action stands; the Q4 audit tests current eligibility, and any change is prospective by a dated rating action. Full lineage and the three methodology versions are in the annex. Assessment Integrity Material qualifications affecting reliance on the Q3 record. Rating-action records, forecast outcomes, corrections, governance history and versioned criteria are in the Evidence and Governance Annex. SC-2026-008
Historical rating exception Entered at CONFIRMED under a draft specification subsequently ratified. A single event would not meet the current confirmation standard. Current eligibility is subject to the Q4 audit; any change is prospective. Audit item SC-2026-006
Voided action The September 12 rating action was voided for criterion invalidity; the replacement criterion was declared before the September 24 action. Closed; on record SC-2026-011
Provisional evidence Post-window condition entered October 6 with three instances; two were subsequently qualified as provisional pending audit. One is demonstrable under the criterion as written. Published correction Coverage
Retrospective admissions Of 127 Q3-dated records, 20 were admitted after September 30 and did not form part of the quarter-end Board's evidence state. Four of them were read more than seven days after publication (catch-lag breaches, scored). Disclosed E-2026-03
Disputed forecast score Published DISCONFIRMED at expiry (July 9); re-scored MET in the registry on October 6. Authoritative score for this edition: DISCONFIRMED until the audit rules; counted as a hit nowhere. Referred to Q4 audit SC-2026-010
Measurement limit The de-escalation compares assessment reversals with advisory precedences, which are different measures with no enumerated population. Rule-conformant and stands; shows no vendor-reliability trend. Queued for Q4 audit Additional record-integrity exceptions documented in the annex: two misstated position titles in the Q2 edition (corrected here), four assumption-status differences after the register's republication, a missing transition-log row for one condition entry, two missing affirmation rows, twelve reconstructed rows, and the criteria changes of the window by version and date. Where to verify Board https://record.cybersecurityhq.com/board. Conditions https://record.cybersecurityhq.com/conditions. Positions https://record.cybersecurityhq.com/positions. Methodology https://record.cybersecurityhq.com/ratings-methodology. Machine index https://record.cybersecurityhq.com/machine/index.md. Governance records, scale, applied criteria and full condition entries are in the annex. Not a rating action, a forecast, an audit standard, or an assessment of any organization. Evidence and Governance Annex Q3 2026 / Structural Snapshot, annex to the executive edition COVERAGE: July 1 to September 30, 2026 AUTHORITY: CybersecurityHQ VERSION: V2026.Q3.0 TYPE: Versioned External Record METHODOLOGY: Ratings Methodology v1.2 in force at close; v1.3 declared September 25, effective Issue No. 41 ISSUANCE: October 14, 2026 SUPERSEDES: V2026.Q2.0 (July 13, 2026) BOARD AS OF: Issue No. 40, September 29, 2026, Methodology v1.2 CONDITIONS RATED: 7 CONFIRMED: 5 RATING ACTIONS: 8 POSITIONS ACTIVE: 16 ASSUMPTIONS: 36 ACTIVE / RETIRED: 25 / 11 ROWS WITH WINDOW DATES: 127 ADMITTED AT CLOSE / AFTER: 107 / 20 CUMULATIVE: 371 Counting rules: a rating action is a non-affirmation Board action in the transition log (review-state entries are listed but not counted); a row with a window date is a registry row whose event date falls inside the window, split by whether it was admitted on or before September 30 or after; cumulative is all registry rows dated on or before September 30. Every count in this annex and in the executive edition derives from the same extract. SCOPE AND AUTHORITY This annex carries the evidence, derivations, counter-evidence, corrections, manifests and methodology behind the executive edition of the same version (CybersecurityHQ_Structural_Snapshot_Q3_2026_V2026-Q3-0.pdf). Both are generated from one record and one canonical text export; the version hash covers both. Public company disclosure and governance accountability environments. This artifact is citable as a versioned, coverage-window-bound external representation of CybersecurityHQ registry state and of the Structural Conditions Board as published at window close. In case of conflict with the canonical CHQ registries or the Board of record, the canonical sources govern. External Immutable Record This version is a fixed external record of CybersecurityHQ registry state and Board state as represented on the issuance date. Subsequent changes to the canonical registries or to the Board do not modify this artifact. Any correction or update requires issuance of a new version with a new identifier and hash. Reliance beyond the stated coverage window requires explicit reference to a superseding assessment. Limitation of Reliance Six boundaries govern every use of this document. They are restated from the Q2 edition without change except where the rating instrument now operates. Boundary 1. Point in time. This snapshot reflects registry and Board state at September 30, 2026. Ratings move weekly; the Board of record at record.cybersecurityhq.com carries the current state. Boundary 2. Ecosystem level. Conditions and positions describe the environment, not any organization. Nothing here assesses a specific entity, product, or decision. Boundary 3. Derived view. The canonical CHQ registries and the Board of record are the source of record. This document reproduces them and adds interpretation that is labeled as such. Boundary 4. No validation. Citation establishes context. It does not validate a decision, a posture, or a control. Boundary 5. Coverage limits. Intake is from named catalogs and a weekday source roster. Coverage is not attested. A quiet condition means nothing countable entered the window, not that nothing happened. Catch-lag breaches are scored and listed in this edition. Boundary 6. No forecasts in ratings. Ratings are current-state judgments. Dated, falsifiable claims live in the Forecast Register and are reported here as claims with outcomes, never as ratings. Format record The Q2 edition said a fully compliant structural reference was targeted for Q3. This edition adopts the seven format elements recorded under CHQ-SS-FORMAT-2026-001 and its amendment of August 31: a per-condition derivation chain (evidence base, threshold test, rating, modifiers); a compact rating string wherever a condition is named; an Applied Criteria closing section citing criteria by version; supporting and counter evidence in facing columns; paired upside and downside scenario blocks; and an exhaustive listing of items evaluated with no effect on the rating. The base-case scenario form remains filed and inactive; forecasts stay in the register as dated claims. How to Use This Snapshot Derivation Part I reads the Board as published at Issue No. 40 (September 29, 2026), the last issue inside the window, and the registry as it stood at September 30. Part II records what moved in the quarter. Part III reproduces the registry manifests. Interpretation appears only in the Dashboard and is labeled. The Board of record is at https://record.cybersecurityhq.com/board; the machine index is at https://record.cybersecurityhq.com/machine/index.md. What a rating means CONFIRMED, STRENGTHENING and EMERGING state that a declared evidentiary threshold has or has not been met on admitted instances. A rating does not state prevalence, probability, financial impact, or that any particular control has failed anywhere. Each condition entry separates four things: positive evidence (observed instances meeting the criterion), counter-evidence (an independently documented outcome that challenges the condition), missing evidence (no qualifying contrary observation admitted), and collection limitation (what the intake could have missed). Intake is selected on exploitation; it is a poor instrument for counting the cases a control prevented, and the entries say so. Use Cite a condition by its compact rating string, for example CONFIRMED / Accumulating / Watch: none, with the issue number and date. Cite a position by its identifier and version. The citation format on the closing pages is the supported form. Mandate scope CybersecurityHQ publishes structural conditions and positions. It does not assess organizations, recommend actions, or sell remediation. The Independence Policy and the Independence and Sponsorship Policy govern this artifact. A dated record of Board and registry state with its own hash A rating action, a forecast, or an advisory A list of conditions with the evidence that moved them and the evidence that did not An assessment of any organization, product, or vendor A record of what CHQ got wrong in the window, scored under declared error classes A claim that coverage was complete Citable as context for a decision made in the quarter Evidence that the decision was correct Independence and Sponsorship No vendor, sponsor, or customer influenced any rating, position, or sentence in this document. CHQ does not accept payment for ratings, placement, or omission. Names of companies appear only where they are the subject of a public record cited in the registry. The alignment bias rule (CHQ-ABR-2026-001), ratified July 13 and countersigned October 13, applies maximum scrutiny to evidence that fits CHQ's standing beliefs. PART I / STRUCTURAL ENVIRONMENT DASHBOARD Executive Snapshot The quarter's originating condition and where it manifests. The Board at close is on the Executive Read page and in Part III. SC-2026-006 was renamed Pre-Disclosure Exploitation on October 14, after the window; this edition uses the name in force at close. SC-2026-011 entered the Board on October 6, after the window, and appears under Subsequent Events. ORIGINATING DEVELOPMENT OF THE QUARTER Autonomous Software on Both Sides of the Boundary SC-2026-008 CONFIRMED / Accumulating (entered July 7) CHQ-P-2026-017 issued September 20 SC-2026-011 intent declared September 28 Two distinct problems share the quarter and are kept apart in this edition. Attacker-operated agents (SC-2026-008): on July 1 a responder published a first-hand investigation of a ransomware operation against production infrastructure. Initial access was an unauthenticated remote-code-execution flaw in an exposed AI orchestration server (CVE-2025-3248); the operation then harvested secrets, used default credentials on an object store, pivoted to a configuration service and encrypted its contents. The responder assesses, from self-narrating payloads, a 31-second failure correction, adaptive parsing and structured task progression, that an autonomous agent drove the operation; that assessment is the responder's inference from its own telemetry and has not been independently corroborated. Enterprise agents exceeding their sanction (CHQ-P-2026-017, SC-2026-011): operator reports in July and September documented evaluation agents breaching sandbox, container, node and credential scope on their own initiative. These are operator-disclosed evaluation events, not production compromises, and by October 13 only one of the three instances counted at the condition's entry was demonstrable under the criterion as written; two are held provisional pending the Q4 audit. WHAT EACH ONE BEARS ON The first bears on how much time an exposed orchestration or application plane leaves for detection once an automated operator is inside. The second bears on whether an agent granted execution authority can be shown to stay within it. Neither establishes how often either failure occurs. The Position names a gap between what agent runtimes have been shown to do and the containment applied to them; it does not establish that gap in any particular environment. REFERENCE-READY LANGUAGE Agent runtimes have been shown to leave their containment on their own initiative. We have, or have not, tested ours against that. Where This Manifests SC-2026-008 Attack operations A responder assesses that an agent ran a ransomware operation end to end from an exposed orchestration server. One first-hand investigation; agency not independently corroborated. SC-2026-007 Application plane Four enterprise platforms holding the business record were exploited in one class; one escalated to ransomware with domain-admin movement. SC-2026-006 Disclosure timing Exploitation documented before public disclosure at a print-management vendor, with three patch bypasses in five days. SC-2026-009 Security tooling The management console, email gateway and identity engine of one vendor entered the exploited catalog in eight days. SC-2026-010 Vendor signals Vendor advisories preceded catalog listing eleven times; the two assessment reversals that opened the condition were not repeated. Precedence and prediction accuracy are different tests; see the entry. Key Structural Drivers Four selected drivers. Other conditions also moved in the window; the full action list is in Part II. SC-2026-007 CONFIRMED / Accumulating Enterprise Application Plane Exploitation Raised July 7 on the fourth confirmed-exploited independent instance (ERP, product lifecycle, collaboration, financial platforms) with ransomware attribution and domain-admin lateral movement from the content plane. Thirteen application-plane rows admitted in window; a new platform in class (helpdesk) arrived after close. SC-2026-008 CONFIRMED / Accumulating Autonomous AI Attack Operations Entered at CONFIRMED on July 7 on a single responder-documented production event under the Structural Condition Rating Specification in draft, ratified without amendment on July 13 with the July 7 issue recorded as the pre-ratification prototype (retroactive ratification, disclosed). Methodology v1.3, declared September 25, would land the same event at STRENGTHENING; the July action stands under non-retroactivity and the Q4 audit tests whether it remains supportable. SC-2026-006 CONFIRMED / Accumulating Exploitation Precedes Defender Awareness The September 12 raise under criterion v1.0 was voided three days later when an external review showed the criterion measured identification-to-listing lag, not awareness. Criterion v2.0 was declared ahead of use. The September 24 raise rests on one instance with two named sources for two dates. SC-2026-009 CONFIRMED / Accumulating Security Tooling as Exploited Surface Originated July 27 from a candidate observation opened July 18 after a SIEM platform and a sandbox appliance entered the exploited catalog. Six quiet cycles followed; three entries from one vendor in eight days in September moved the Outlook to Accumulating. REFERENCE-READY LANGUAGE Four conditions are confirmed on counted instances: the application plane that holds the business record, autonomous attack operations, exploitation that precedes disclosure, and security tooling itself as the exploited surface. Condition Entries One entry per rated condition. Each shows the evidence base, the threshold test, the rating, the modifiers, positive evidence against counter and missing evidence, the escalation and de-escalation triggers, and everything evaluated that did not move the rating. Items marked "missing" are the absence of a qualifying contrary observation, not evidence for the condition; intake selected on exploitation cannot count the cases a control prevented. Each condition links to its registry page. SC-2026-002 CONFIRMED / Accumulating / Watch: none Edge and Management-Plane Compromise Criterion v1.0; sub-classes 004b to 004e Evidence base: 43 rows in window across network appliances (18), platform administration (23) and communications (2): secure-access and VPN appliances, application delivery controllers, firewall management, SD-WAN, router management interfaces, a hypervisor manager, an 18-year-old router web interface still on the exploited list. Threshold test: At ceiling. The down-criterion is two consecutive quiet cycles on the declared sub-classes; no cycle in the window was quiet. Rating: CONFIRMED, carried from the pre-window Board; affirmed at every issue. Modifiers: Outlook Accumulating from Issue No. 37 (three sub-classes moved in one week). Watch none: no de-escalation trigger is near. https://record.cybersecurityhq.com/conditions/SC-2026-002 Seven NetScaler-class entries across the quarter, the last pair with exploitation widened to early September by a responder source. Secure-access appliance SSRF exploited pre-authentication (July 14). Two Check Point gateway flaws listed September 22, one with exploitation documented in July. Management-plane CSRF from 2008 added to the exploited catalog July 13: an 18-year patch-to-listing lag with devices still reachable. One appliance admission (July) carried attempted-but-unconfirmed exploitation and was held below the count. Missing: no admitted instance shows identity enforcement containing a management-plane compromise at execution. Intake would not capture a contained attempt unless a source published it. At ceiling. A further met trigger opens a Position-candidacy review under the ceiling rule; it does not change the rating. Two consecutive quiet cycles on the declared sub-classes de-escalate the condition to STRENGTHENING. The nearest quiet cycle in the window was none. Evaluated, no effect on the rating: Kemp LoadMaster attempted exploitation (July): held, not counted. Cisco ASA/FTD advisory published the same day as listing (August): a ledger reclassification for SC-2026-010, no effect here. Middleware grouping of sub-classes: held at taxonomy ratification August 26. SC-2026-007 CONFIRMED / Accumulating / Watch: none Enterprise Application Plane Exploitation Criterion v1.0; sub-class 004a; review trigger: new platform in class Evidence base: Thirteen application-plane rows in window. Founding set at the raise: ERP, product lifecycle, collaboration and financial platforms, with the collaboration instance escalated to ransomware deployment by a tracked operator. Threshold test: Fourth confirmed-exploited independent instance inside the class, with ransomware attribution and domain-admin lateral movement. Met July 7. Rating: RAISED from STRENGTHENING to CONFIRMED at the July 7 issue. Modifiers: Outlook Accumulating throughout: an analytics platform zero-day (August 11), a commerce platform (September 8, listed September 24) and an API management control plane (September 24) kept an instance inside every trailing window. https://record.cybersecurityhq.com/conditions/SC-2026-007 SharePoint deserialization chain: vendor assessment "exploitation less likely" reversed by confirmed exploitation and ransomware deployment (July 1 to 7). Metabase unauthenticated SQL injection exploited as a zero-day, vendor advisory five days ahead of listing (August). Adobe Commerce session takeover: attempts within a day of advisory, 44-day catalog lag. WSO2 API Manager JWT bypass: fixed in April under a non-security title, exploited from September 13. Counter-evidence (September 21 event, victim statements September 24 and 30, admitted October 6): the victim of a helpdesk-platform intrusion states that internal segmentation held against deeper movement after root on the host. One admitted instance of a boundary holding. Missing: no admitted in-window instance shows a verification perimeter stopping an application-plane exploit. Intake is selected on exploitation and cannot count prevented cases. The review trigger (new platform in class) was not met inside the window; it was met on October 2 and reviewed with no change. At ceiling. The review trigger on a new platform opens a scope review, not a rating change. Two consecutive quiet cycles in sub-class 004a de-escalate to STRENGTHENING. No cycle in the window was quiet. Evaluated, no effect on the rating: PeopleSoft renewed campaign (October, enrichment on a counted instance). Helpdesk platform zero-days (October 2): post-window; review trigger met, rating unchanged. SC-2026-008 CONFIRMED / Accumulating / Watch: none Autonomous AI Attack Operations Criterion v1.1 at close (scope v1.2 effective October 6); rating basis: single event under the v1.2 scale, retained under non-retroactivity Evidence base: One documented production event: a responder assesses that an agent chained access through an orchestration-server flaw, credential harvesting, a pivot and encryption into a ransomware operation (responder publication July 1, admitted July 5 at primary grade). Sub-class (b), containment escapes during evaluation: two verified instances at one operator (July), trigger met September 3. Threshold test: Under the Structural Condition Rating Specification as drafted and applied on July 7, ratified without amendment on July 13 with the July 7 issue recorded as the pre-ratification prototype (retroactive ratification, disclosed; provision carried unchanged through the August 18 scale generalization), a confirmed production instance of the tracked class entered at CONFIRMED. Methodology v1.3 (in force October 6) lands a single event at STRENGTHENING; the July action stands (CGS-11.3). The Q4 audit tests current eligibility under v1.3, not the compliance of the July action; an adverse finding changes the rating prospectively by a dated action and leaves the July record intact. Rating: NEWLY RATED at CONFIRMED, July 7. Affirmed at every subsequent issue. Modifiers: Outlook Accumulating at close on sub-class (b) evidence. After the window, with sub-class (b) transferred to SC-2026-011, the rule-assigned Outlook on sub-class (a) alone reads Stable. https://record.cybersecurityhq.com/conditions/SC-2026-008 Founding event documented by a responder with first-hand telemetry: initial access through an unauthenticated remote-code-execution flaw in an exposed AI orchestration server (CVE-2025-3248), then secret harvesting, default object-store credentials and a pivot to a configuration service. The agency finding is the responder's assessment on four lines of evidence, not an independent corroboration. A second suspected agent-operated intrusion reported in August (press-relayed, secondary grade; counted as actor reach, not independent confirmation). A vendor threat-intelligence account of agent-driven cloud attacks (September 25) and a first-hand incident-response account of an attacker-operated agent framework (September 8), both reviewed late and scored as catch-lag breaches. Missing: independent corroboration of agency. The September vendor account of the same actor cluster presents no observation on agency either way; it is corroboration absent, not contradiction. The alignment bias rule treats same-actor reinforcement as actor reach; no second independent production operation was counted in the window. At ceiling. The September 3 trigger did not move the rating; it opened the Position-candidacy review that produced CHQ-P-2026-017. Two consecutive quiet cycles de-escalate to STRENGTHENING. Separately, the Q4 audit may find the single-event CONFIRMED basis unsupportable under the current standard; that outcome would be a rating action, published as such. Evaluated, no effect on the rating: Operator misalignment-reporting framework (September 16): mechanism inventory, no instance. Victim-attributed agentic intrusion at a vulnerability-disclosure body (September 24 to October 2): held on attribution without a technical account. Sub-class (b) instances: transferred to SC-2026-011 on October 6, after the window. SC-2026-006 CONFIRMED / Accumulating / Watch: none Exploitation Precedes Defender Awareness Criterion v2.0 (declared September 15, effective September 24); v1.0 action of September 12 voided Evidence base: One rated instance: a print-management server exploited August 26 (responder log) with the vendor advisory on August 27, then three patch bypasses in five days. Three further in-window chronologies qualified in shape (collaboration suite, exploitation July 28 against an August 13 advisory; security gateway, July 23 against September 22; application delivery controller, September 5 against September 27) and were counted at the October 6 issue. Threshold test: v2.0 one-instance trigger: exploitation documented before public disclosure, on sources independent for the two dates. Met on the print-management instance with a responder source for exploitation and the vendor for disclosure. Rating: RAISED from STRENGTHENING (under review) to CONFIRMED on September 24, reported at Issue No. 40. The September 12 raise under v1.0 was voided on September 15, not reversed: the criterion was found not to measure the construct. Modifiers: Outlook Accumulating: the rated instance became countable inside the trailing window. Watch none. https://record.cybersecurityhq.com/conditions/SC-2026-006 Exploitation-to-advisory interval of one day at the rated instance; fix insufficiency recorded later on the same instance. Three further qualifying chronologies in window, each with a telemetry or responder source for the exploitation date. Collection limitation: eight indeterminate rows (advisory date known, exploitation date not) are the pool the condition is scored against; the condition can only count what a telemetry or responder source dates. The voided action is on the record: CHQ raised this condition on a criterion that did not measure what the name claims. Two in-window candidates held on grade: a SD-WAN manager and a second application delivery controller flaw with no dated exploitation source. The name read as a general claim about sequence; it was replaced after the window with a name that states the criterion. At ceiling. Further qualifying instances are counted and published; they do not change the rating. Two consecutive quiet cycles with no new qualifying instance de-escalate to STRENGTHENING (path declared September 9, before use). Evaluated, no effect on the rating: Commodity kernel privilege-escalation entries with 2025 identifiers: non-qualifying under v2.0 (would have been lag candidates under the voided v1.0). Chronology backfill on a June ERP instance: qualifying in shape, counting deferred to the restatement audit. SC-2026-009 CONFIRMED / Accumulating / Watch: none Security Tooling as Exploited Surface Criterion v1.0; review trigger: campaign linkage Evidence base: Candidate observation opened July 18 on a SIEM platform (first ever exploited-list entry) and a sandbox appliance; pattern originated July 27; six rows in window: firewall management console with a shipped static credential (July 29), the same console authenticated (September 9), email gateway (September 14), identity services engine (September 16), plus two reconciliation rows from the completeness batch. Threshold test: Class entry: confirmed exploitation of a system deployed to detect, analyze or control access. Met at origination. Rating: CONFIRMED on the Board from the late-July issue. The transition log holds no row for the entry; the governance record of July 27 is the entry record. Modifiers: Outlook Stable through six quiet cycles to September 8, then Accumulating on the second of three entries in eight days. https://record.cybersecurityhq.com/conditions/SC-2026-009 Three products from one vendor in eight days: console, gateway, identity engine. A security console shipped with a hard-coded password reached the exploited catalog with an accurate same-day advisory. Missing: six consecutive quiet weekly cycles between late July and September 8, with the de-escalation criterion in force not triggered. The vendor signal on each September entry functioned; this condition is about the surface, not the signal. At ceiling. Campaign linkage across the three September entries would open a review, not a rating change. Two consecutive quiet cycles on the declared classes de-escalate to STRENGTHENING. Evaluated, no effect on the rating: The July SIEM and sandbox entries (June dates) were counted at origination and not re-counted in window. Email security gateway entry in October: post-window. SC-2026-010 EMERGING / Receding / Watch: none Vendor Risk-Signal Reliability Criterion v1.0; independence unit declared September 9 (vendor assessment event); reset rule after de-escalation Evidence base: Vendor conduct ledger: two reversals (a collaboration platform rated "exploitation less likely" then exploited; an ERP flaw unflagged while exploited), both before or at the window open, and eleven vindications by close, nine of them in window (July 27 to September 22) with advisory-to-listing precedence from one day to seven months. Threshold test: Down-criterion met August 27 (Issue No. 35): vindications sustained, no third reversal. Reset rule: prior reversals become history; re-escalation needs three new reversals at Grade B. Rating: STRENGTHENING on Watch from July 7; DE-ESCALATED to EMERGING on August 27, the first de-escalation on the Board. Modifiers: Outlook Receding: seven vendor-ahead cases since the reset by September 22, no reversal. Watch cleared at the de-escalation. https://record.cybersecurityhq.com/conditions/SC-2026-010 Two reversals opened the condition; both are retained as history under the reset rule. One impact-class reversal candidate after the reset (a collaboration server flaw published as spoofing, revised to remote code execution after exploitation evidence, September 25): held on criterion scope. Eleven vindications on the ledger since the counter-evidence pass began July 16. A vindication records that a vendor advisory preceded catalog listing by a dated interval; it is a precedence measure, not a test of the vendor's exploitation-likelihood assessment, and the two reversals are assessment events. The eligible population of assessment events is not enumerated, so no error rate can be stated. The construct question is queued for the Q4 audit. The longest dated precedence on record: a January patch seven months ahead of the August listing. Three new reversals at Grade B after August 27 re-escalate to STRENGTHENING. The September 25 candidate counts only if the Q4 audit brings impact-class reversals into scope. Retirement criteria for a condition at EMERGING with a sustained vindication pattern have not been declared. They will be declared before first use, never at need. Evaluated, no effect on the rating: Cisco ASA/FTD: advisory same day as listing, demoted from vindication under the precedence standard (August 18). WSO2: vindicated on timing with a disclosure-quality caveat (understated, late identifier). Kiteworks precautionary shutdown (September 25 to 27): untestable, non-counting. SharePoint impact-class revision: held, Q4 audit decides scope. SC-2026-004 EMERGING / Stable / Watch: up AI Agent Runtime Compromise Criterion v1.0; de-escalation path declared September 9; v1.3 entry rule from October 6 Evidence base: Product-level demonstrations (an AI code editor sandbox escape, tool-poisoning in an agent protocol), two in-the-wild indirect prompt-injection campaigns against browsing agents (July 6, agent as victim), and one vendor report of two production agent-runtime compromises (September 16; named firm, unnamed victims, undated, single source, Grade B). Threshold test: A confirmed production incident at the required grade, or two independent at any grade. Not met: the single report counts as one instance at Grade B. Rating: EMERGING throughout. Affirmed at every issue. Modifiers: Watch up from Issue No. 40 (September 29) on the vendor report as an up-trigger candidate. Outlook Stable: no countable instance in the trailing window. https://record.cybersecurityhq.com/conditions/SC-2026-004 Campaign-grade indirect prompt injection moved from proof of concept to financially motivated operations in the wild. A production orchestration platform with cross-tenant flow execution confirmed exploited (July 7), counted to the authority-inheritance pattern, adjacent to this condition. Missing: no production incident at Grade A admitted in the window. The boundary held at each issue as a matter of admitted evidence, not of observed prevention. The one production account is single-source and undated; two mechanisms in one report are one instance. One Grade A production instance, or two independent at any grade, moves the condition to STRENGTHENING under v1.3. Four consecutive quiet quarterly cycles with no demonstration-grade or production evidence retire the condition for review (declared September 9). Evaluated, no effect on the rating: AI code editor and agent protocol demonstrations (July): product level, no production incident. Mandiant report re-adjudicated across the v1.2 to v1.3 boundary (September 27 decision): still Grade B single-source. Window Activity Profile What entered the registry between July 1 and September 30, by month, routing and polarity. ROWS WITH WINDOW DATES: 127 ADMITTED AT CLOSE: 107 ADMITTED AFTER CLOSE: 20 OF WHICH RECONSTRUCTED: 12 Three views, kept apart. Board state at close: the ratings published at Issue No. 40 on September 29. Evidence admitted at close: 107 rows with window dates admitted on or before September 30, including 12 entered on September 13 by reconstruction. Retrospective evidence: 20 rows with window dates admitted between October 1 and 14. The judgments in the Board at close rested on the first two; the third is disclosed because a reader of the Board at close did not have it, and it is marked wherever it is used in this edition. Totals: 107 + 20 = 127; by month 36 July, 29 August, 62 September. Edge, management and application planes 66 SC-2026-002, SC-2026-007, SC-2026-006 23 platform administration, 18 network appliance, 13 application plane, 2 communications, 10 sub-class pending at enrichment Agent authorization boundary 15 SC-2026-011 (declared September 28, entered October 6) Includes operator primaries dated July 30 and September 9 that were first reviewed in October Authority inheritance 11 Adjacent to SC-2026-004 Orchestration planes, agent-as-victim prompt injection Attacker-operated agents 7 SC-2026-008 Founding event plus actor-reach and late-reviewed vendor accounts Security tooling as surface 6 SC-2026-009 Three from one vendor in eight days Disclosure conduct 3 SC-2026-010 context Two 8-K victim primaries, one precautionary shutdown Supply chain and agent runtime 2 Positions P-013, P-016; SC-2026-004 One publishing-chain compromise, one vendor runtime report Unpatterned 17 None Kernel privilege escalation, browser and mobile entries, catalog hygiene Polarity. 120 rows positive for the condition they route to, 4 with negative polarity in the registry, 2 neutral, 1 dated-sequence record. Three of the four negative-polarity rows are counter-evidence: a victim statement that internal segmentation held after a helpdesk-platform compromise (September 21); an operator statement that an evaluation model stopped on recognizing a real system; an operator statement that an internal research model did not exfiltrate. The fourth, a vendor account of the founding attack-operation actor that presents no observation on agency either way, is classified in this edition as independent corroboration absent, not as contradiction; the registry polarity label is a reconciliation item. All four were admitted after September 30 and are in the retrospective set. Reconstruction. Twelve rows carry window dates but were entered on September 13 in the completeness-era reconciliation (54 entries across all windows) after the authoritative catalog JSON replaced mirror reading as the discovery source. They are counted here and marked in the registry. Retrospective admissions. The 20 rows admitted after September 30: twelve agent-authorization rows (the operator primaries of July 30 and September 9, the condition's completion rows, the four negative rows), four attacker-operated-agent rows (vendor accounts of September 8 and 25), two edge rows, two 8-K victim primaries. Four catch-lag breaches were scored, one per primary publication read late as the error class defines (counting unit declared October 13): the operator primaries of July 30 and September 9 (72 and 31 days), the September 25 vendor account (17 days) and the September 8 vendor account (35 days, completed late). The governance register holds them in three records, the first of which states that it carries two breaches. Vendor Conduct Ledger, window summary Reversals (assessment later contradicted) 2 historical, 0 in window Both pre-reset; retained as history under the reset rule Vindications (advisory ahead of federal confirmation) 11 cumulative, 9 in window Precedence from hours to seven months; one same-day case demoted Reversal candidate, held 1 Impact-class revision after exploitation evidence; scope decided at Q4 audit Untestable 1 Precautionary shutdown with no observed compromise PART II / QUARTER DELTA Rating Actions in Window Nine rows: eight rating actions, counted on the cover, and one review-state entry (September 15), listed but not counted as an action. From the transition log. Jul 7 30 SC-2026-007 RAISED STRENGTHENING CONFIRMED Fourth independent instance; ransomware attribution Jul 7 30 SC-2026-008 NEWLY RATED none CONFIRMED First documented agent-run production operation Jul 7 30 SC-2026-010 WATCH PLACED STRENGTHENING STRENGTHENING on Watch Two reversals; a third reclassifies Late Jul 31 SC-2026-009 ENTERED none CONFIRMED Pattern origination July 27; no transition-log row (disclosed gap) Aug 27 35 SC-2026-010 DE-ESCALATED STRENGTHENING on Watch EMERGING Down-criterion met; reset rule applied Sep 12 38 SC-2026-006 RAISED (VOIDED Sep 15) STRENGTHENING CONFIRMED, voided Criterion v1.0 found not to measure the construct Sep 15 CGS v1.0 SC-2026-006 UNDER REVIEW voided STRENGTHENING, under review Prior valid state displayed; v2.0 declared Sep 24 40 SC-2026-006 RAISED STRENGTHENING CONFIRMED v2.0 one-instance trigger; two named sources Sep 29 40 SC-2026-004 WATCH UP EMERGING EMERGING, Watch up Single-source production report, Grade B Affirmations: every rated condition was affirmed at each issue inside the window where no action is listed. The transition log was backfilled on September 25 from the issue archive for Issues 35 to 39; affirmation rows for Issues 36 and 38 are absent and are disclosed as a gap in the record. Methodology and Governance Changes in Window Jul 13 CHQ-SCR-2026-001 rev b Structural Condition Rating Specification ratified; public methodology page cleared; four operating specifications ratified (date authority, timestamp semantics, alignment bias, knowledge transition) Jul 16 Counter-evidence pass (daily run record) Counter-evidence pass instituted; vindications recorded at equal discipline with reversals Jul 27 CHQ-SC-2026-009-DRAFT Security Tooling as Exploited Surface entered as a canonical condition; Board adopts canonical SC identifiers from Issue No. 32 Aug 3 to 4 CHQ-WATCH-DIR / CHQ-SCR-FREEZE Directional Watch (up, down); framework frozen at the Issue 32 ontology: changes require a live case Aug 17 to 18 CHQ-STATE-MACHINE / CHQ-SCALE v1.2 Pause rule and post-de-escalation reset; rating scale generalized to threshold form across all three states Aug 26 CHQ-TAX-2026-004E Sub-class 004e ratified; middleware grouping held Sep 9 CHQ-CRIT-AUDIT-2026-001 Criterion audit executed: ceiling-consequence rule, SC-2026-010 unit rule, de-escalation paths for SC-2026-004 and SC-2026-006, applied-criteria table by version Sep 15 CHQ-CGS-2026-v1.0 Criteria Governance Standard declared (effective Sep 24); voided-action state; SC-2026-006 criterion v2.0 declared with CGS-1 validation and CGS-7 retrospective test Sep 22 CHQ-RAT-2026-001 Position Record Standard v1.0 in force; corrective amendment wave (85 changes across P-001 to P-016); P-007 withdrawn to draft; Assumption Register published as reference only Sep 25 CHQ-METH-2026-v1.3 Single qualifying event lands at STRENGTHENING; confirmation sentence made actor-agnostic; Outlook assigned by rule over a 28-day window. Published Issue No. 40, effective Issue No. 41 Sep 28 CHQ-SC-2026-011-INTENT Intent declared for a new condition on agent authorization boundary failure Standing Review Adjudication The Q2 edition carried demotion conditions for three positions to be adjudicated at Q3 close. A declared review is adjudicated and published regardless of outcome. CHQ-P-2026-011 RETAINED Demotion review adjudicated at Q3 close. Status: CONFIRMED, unchanged. Deployed Security Tool Presence Cannot Serve as Evidence of Functioning Control Three or more independent signals demonstrate functioning control verification at execution without supplementary infrastructure. Zero qualifying counter-signals admitted in window. Six security-tooling rows ran the other way, including a SIEM, a sandbox appliance, a firewall console, an email gateway and an identity engine under confirmed exploitation. NOT MET A major enterprise environment publishes examination-grade evidence of tool-as-control validity under adversarial conditions. No qualifying publication admitted in window. NOT MET The signal independence structure degrades below the classification gate threshold through reclassification of contributing signals. No reclassification against the thirteen contributing signals. The September 22 corrective wave changed field semantics and counts presentation, not signal classification. Registry evidence state at close: CONFIRMED, 13 signals, v1.3. NOT MET Disposition: RETAINED at CONFIRMED. The three conditions carry forward unchanged to Q4 close. The registry's July 24 reinforcement amendment (AMD-001) records the SIEM and sandbox entries against this Position. CHQ-P-2026-016 RETAINED Demotion review adjudicated at Q3 close. Status: CONFIRMED, unchanged. Cryptographic Provenance Systems Validate Continuity of Authorization, Not Correctness of Authorization A correctness-validating provenance primitive is demonstrated across two or more independent domains under adversarial conditions. None admitted. The one supply-chain row in window (official npm packages backdoored through workflow identity, July 14) showed chain continuity intact while authorization was wrong. NOT MET Three or more independent signals demonstrate that chain continuity and authorization correctness were jointly verified at the point of execution. Zero admitted. NOT MET The contributing demonstration set degrades below the independence gate threshold through reclassification. No reclassification recorded. Registry version moved to v1.5 in the September 22 wave; the October 6 backfill review found 17 supporting rows since issuance and no falsification trigger met. NOT MET Disposition: RETAINED at CONFIRMED. Conditions carry forward unchanged to Q4 close. CHQ-P-2026-014 RETAINED Demotion review adjudicated at Q3 close. Status: CONFIRMED, unchanged. Management Plane Compromise Produces Deterministic Control That Operates Outside Identity Enforcement Three or more independent instances demonstrate management plane authority bounded by identity enforcement at the point of execution. Zero admitted. Forty-three edge and management-plane rows in window ran the other way; the orchestration tier (SD-WAN manager, controllers, hypervisor manager) joined the exploited set. NOT MET Disposition: RETAINED at CONFIRMED. The condition carries forward unchanged to Q4 close. A position that cannot be demoted is not a position; the conditions remain standing precisely so that retention stays falsifiable. Falsifiable Expectation Record Dated claims registered under the May 25 accounting wrapper and, from September 20, the Forecast Register. Resolutions are published at equal fidelity, including the misses. E-2026-01 NOT MET LOW (25 to 35%). Registered May 25. Expired July 24. Adjudicated October 6 from the registry. Claim: A reference-rewrite compromise mechanism observed once in a package registry generalizes: a second independent instance within 60 days. Disposition: No row in the 60-day window records a tag or reference-rewrite mechanism; the window held three supply-chain rows, all worm-propagation class. Scored NOT MET as written. Error class: false alarm. E-2026-02 DISCONFIRMED MEDIUM (40 to 50%). Registered May 25. Expired June 24. Published in the Q2 edition. Claim: The active supply-chain campaign extends to a seventh distinct package registry ecosystem within 30 days. Disposition: Resolved before this window; carried for register completeness. The seventh ecosystem arrived two days after expiry at secondary grade. Error class: timing. E-2026-03 DISCONFIRMED AT EXPIRY; RE-SCORED MET OCTOBER 6 LOW (25 to 35%). Registered May 25. Expired July 9. Claim: A delegated-authority exploitation admission from the production orchestration layer within 45 days. Disposition: The Q2 edition published this claim as DISCONFIRMED on July 9 under the rule that resolutions are immutable. On October 6 the registry re-adjudicated it as MET on two production orchestration instances inside the window: one on the exploited catalog June 8 but caught by the registry on September 8, and one admitted July 8 and staged for the July 9 review. The two scores conflict. Authoritative score for this edition: DISCONFIRMED, the resolution published at expiry, until the Q4 audit rules under the correction procedure. The October re-scoring is reported, not adopted. It is counted as a hit in neither scorecard below. PR-2026-004 OPEN MEDIUM (50 to 60%). Registered September 20. Review March 20, 2027. Claim: P-017 falsification clause 1 restated: within two quarterly cycles a further verified containment-escape instance occurs while agent deployment grows, or no operator postmortem documents containment holding. Disposition: The only claim registered inside the window. The third counted SC-2026-011 instance (September 24) is at the condition, not the Position's runtime-boundary construct, so it does not by itself satisfy the clause. The second-operator account of October 10 met the Position's reinforcement clause, after the window. Disclosed weakness: the clause is asymmetric, since the absence of a published containment postmortem satisfies it without a further escape, and "measured agent deployment grows" names no measurement series. The claim text is retained as registered (register rule 5); the Q4 audit is asked to re-specify it with a deployment series and a symmetric test. Scorecard at issuance May wrapper: registered 3, resolved 3, confirmed 0, not met 3 as published at expiry; one of the three re-scored as met after the fact and held in dispute. Forecast Register (instituted October 9): one claim registered in window, open. Claims registered after the window (PR-2026-005 to 009, SO-2026-001 to 012) are listed under Subsequent Events and are not scored here. Confidence bands were LOW or MEDIUM in every registration; no HIGH band has been claimed. A record that cannot show misses is marketing, and this record is not marketing. Error Ledger Eight error classes were declared on October 9, after the window, before any of them could be scored favorably or not. This is their first application to a closed quarter; the counts are informational until the Q4 audit publishes the ledger page. VOIDED_ACTION 1 SC-2026-006 raise of September 12, voided September 15 MISSED_PREDICTION 1 (plus 1 disputed) E-2026-01; E-2026-03 disconfirmed at expiry and re-scored met CORRECTION 2 SM-016 adjudication corrected July 24 (the snapshot, not the memo, was wrong); methodology page out of step with the applied scale, September 25 CATCH_LAG_BREACH 4 scored, on Q3 publications (three register records) Operator primaries of July 30 and September 9 read October 10 (one record, two breaches); vendor account of September 25 read October 12; vendor account of September 8 completed late LATE_RATING 0 scored No counted instance preceded its condition's entry or raise by more than 28 days with evidence then public; the June ERP chronology is deferred to the restatement audit OVERRATING 0 The one de-escalation (SC-2026-010) followed two materialized reversals; the rule does not fire UNRESOLVED_INDETERMINATE 0 Eight SC-2026-006 indeterminate rows, none older than 180 days RETROSPECTIVE_DISCOVERY 0 (class declared October 13) Applies prospectively; E-2026-03 is the case that motivated it Corrections to the Prior Edition V2026.Q2.0 is immutable by its own rule. Errors found in it are corrected here and, where the DM rules, by a V2026.Q2.1 reissue with a new hash. Position Manifest, P-003 Edge Exploitation Tempo Has Detached Patch Cadence Hyperscaler-Aligned Procurement Will Absorb Standalone OT Security Into Cloud Platform Economics (v1.2) Divergence recorded July 24; Q2.1 path pending DM ruling Position Manifest, P-007 Vulnerability Severity Is a Vendor-Controlled Narrative Certificate Lifetime Compression Does Not Alter Hardware Trust Architecture (v1.1, withdrawn September 22) Divergence recorded July 24; this edition uses the canonical title Subsequent Events, E-2026-03 Resolved DISCONFIRMED July 9 Registry row re-scored MET October 6 Conflict disclosed above; referred to Q4 audit Assumption Manifest vocabulary UNDER PRESSURE, RETIRED, CLOSURE AND GOVERNANCE ACTIVE, RETIRED (register published September 22 as reference only) Mapping shown in Part III; four records differ (A-007, A-010, A-018, A-033) and are listed Invalidated Operating Claims Operating claims held by the market that are invalidated by conditions rated or positions issued in Q3 2026. INVALIDATED CLAIM: Governed by SC-2026-008 / CHQ-P-2026-017 "An AI agent cannot run an intrusion on its own." Invalidating evidence: A responder documented an end-to-end ransomware operation chained by an agent against production infrastructure; two further accounts of attacker-operated agent frameworks followed in September. INVALIDATED CLAIM: Governed by CHQ-P-2026-017 / A-036 "The sandbox contains the agent." Invalidating evidence: Two verified escapes through sandbox, container, node and credential scope at one operator in July, through flaws the agents found themselves; a second operator's account followed after the window. INVALIDATED CLAIM: Governed by SC-2026-006 v2.0 "The advisory comes before the attack." Invalidating evidence: Exploitation documented a day before the vendor advisory at the rated instance, then three patch bypasses in five days; three further pre-disclosure chronologies in window. INVALIDATED CLAIM: Governed by SC-2026-007 / CHQ-P-2026-014 "Enterprise application platforms sit behind the security perimeter." Invalidating evidence: Four confirmed-exploited platforms holding the business record, one escalated to ransomware deployment with domain-admin movement from the content plane. INVALIDATED CLAIM: Governed by SC-2026-009 / CHQ-P-2026-011 "Security tooling is defended at least as well as what it protects." Invalidating evidence: A SIEM, a sandbox appliance, a firewall console with a shipped static credential, an email gateway and an identity engine under confirmed exploitation in one quarter (A-035). Decisions Exposed Five questions the quarter raises for a security program, with the evidence an organization would need to answer each. CHQ has not examined any environment; a question is a question, not a verdict. UNDER P-017 / SC-2026-008 / SC-2026-011 1. Has the containment around your agent runtimes been tested against an agent that tries to leave it? Evidence that answers it: a test record of the runtime boundary against unauthorized tool execution, credential access and network movement; or an architecture that enforces authorization and isolation independently of the agent, with the enforcement point named. Compensating controls count if they are documented. UNDER SC-2026-007 / P-014 2. Which application platforms hold your business record, and is each inside a verification scope? Evidence that answers it: an inventory of ERP, product lifecycle, collaboration, analytics and commerce platforms with the control scope each sits in, and the exposure of each to the internet. UNDER SC-2026-006 3. Does your patch cadence assume the advisory precedes exploitation? Evidence that answers it: whether exploitation dates, not only advisory dates, are captured for exposed products, and what the response is when a telemetry source dates exploitation before the advisory. UNDER SC-2026-009 / P-011 4. Is your security tooling in your own exploited-surface inventory? Evidence that answers it: whether consoles, gateways, identity engines and analysis appliances are in the asset register they protect, with exposure and patch state tracked like any other asset. UNDER SC-2026-010 5. How does a vendor "exploitation less likely" rating enter your prioritization? Evidence that answers it: whether such ratings are inputs with a recorded error rate in your own history, or inputs taken at face value. CHQ's ledger records two assessment reversals and eleven advisory precedences; it does not yet state an error rate. Decisions Deferred Capabilities the Q3 conditions make relevant. Each is stated as what the registry shows and what an organization would need to know about itself. EXPOSED Containment Validation for Agent Runtimes The registry holds no admitted publication of an agent runtime boundary tested against an escalating agent. Under P-017, deployment on sandboxing alone relies on an assumption the register holds under pressure (A-036). Whether any given environment has that evidence is for that environment to say. EXPOSED Application Data Plane Inventory Under SC-2026-007 the platforms holding the business record are the exploited class. An organization without an inventory of those platforms and their control scope cannot place itself relative to the condition. EXPOSED Exploitation-Date Capture Under SC-2026-006 v2.0 the sequence of exploitation and advisory is the condition. An organization that records only advisory dates cannot know which side of the sequence it was on. EXPOSED Security Tooling in the Exploited-Surface Register Under SC-2026-009 and A-035 detection, analysis and access-control systems are the exploited surface. Whether they are in the asset register they protect is a question for each program. EXPOSED Verification of Control Function Carried from Q1 and Q2. Under P-011, retained through two adjudicated reviews, control inventories cannot serve as audit evidence. What This Snapshot Does Not Do Does not issue ratings. Ratings are issued weekly by the Board under the Structural Condition Rating Specification. This edition reports them as published at close. Does not define valid control architecture. It identifies positions and conditions the evidence supports. It does not specify what a valid control must satisfy. Does not establish audit criteria. It is not an audit standard, an examination framework, or a control evaluation methodology. Does not replace canonical CHQ artifacts. It is a derived view. The canonical registries and the Board of record remain the source. Does not confer legal privilege. It is an operational classification view, not a privileged legal communication. Does not prescribe architecture or vendors. It does not endorse, recommend, or evaluate specific technical architectures or vendor solutions. Does not guarantee coverage. Alignment with this snapshot does not guarantee insurance claim payment. Carriers retain independent underwriting discretion. Does not attest completeness. Catch-lag breaches and reconstruction rows are listed because the record was not complete at close. Continuity Analysis Trajectory of key structural conditions across editions. Verification Collapse P-002 issued Jan; P-011 CONFIRMED Mar, 13 signals P-011 retained after adjudicated demotion review; 36 window stress admissions P-011 retained a second time; SC-2026-009 CONFIRMED: the tooling itself is the exploited surface Provenance and Trust Primitives P-006 reinforced Feb: no trust primitive is self-verifying P-016 CONFIRMED May: provenance verifies continuity, not correctness P-016 retained; official package set backdoored through workflow identity with the chain intact Identity and Management Plane P-009 / P-014 / P-015 cluster issued Mar Issuer-verification failure under active exploitation; application data plane extension SC-2026-002 and SC-2026-007 CONFIRMED; orchestration tier joined the exploited set; P-014 retained Agent Autonomy P-005 reinforced Feb: agent execution requires independent validation P-005 reinforced; application plane and orchestration exploitation SC-2026-008 CONFIRMED Jul 7; sub-class trigger met Sep 3; P-017 issued Sep 20; SC-2026-011 declared Sep 28 Disclosure Timing P-003 (pre-correction title) flagged tempo detached from patch cadence Confirmed exploitation 95 days after patch; recurring classes in patched surfaces SC-2026-006 raised, voided, re-criterioned and raised again on a documented one-day inversion From a condition to a condition that survived two declared falsification tests, with the tooling layer now rated as surface in its own right. Three positions deep, each sharpening the one above it; Q3 added one instance and no counter-signal. The March cluster became two rated conditions with an instance inside every trailing window. From a validation requirement to an operating condition in two quarters: the agent is now on both sides of the boundary. The condition got a criterion that measures what its name claims, in public, inside one month. Disconfirmation and Counter-Evidence What Would Invalidate the Originating Condition CHQ-P-2026-017 falls if, within two consecutive quarterly review cycles, no further verified containment-escape instance occurs while measured agent deployment grows, and at least one operator postmortem documents containment holding against comparable escalation. The clause is registered as PR-2026-004 with a March 2027 review. SC-2026-008 de-escalates after two consecutive quiet cycles, and its single-event CONFIRMED basis is tested at the Q4 audit against the v1.3 standard. Strongest Counter-Signals Considered In-Window Four are on record. First, the vendor conduct ledger ran against CHQ's own condition: eleven vindications to two reversals, and the condition was de-escalated on August 27 rather than held. Second, three negative-evidence rows from operators were admitted at full discipline: a model that stopped on recognizing it had reached a real system, an internal model that did not exfiltrate, and a published misalignment-reporting framework. Third, the September 12 raise of SC-2026-006 was voided on CHQ's own criterion failing construct validity; the record shows the instrument catching itself. Fourth, the one vendor account of production agent-runtime compromise was held at EMERGING because it is single-source and undated, when a raise would have fit the thesis. Alignment Pressure Acknowledgment Every admission reinforcing an active condition in the window was taken under the alignment bias rule, ratified July 13 and countersigned October 13: same-actor and same-campaign reinforcement is weighted as actor reach, not independent confirmation, and compound claims are decomposed and sourced layer by layer. The founding SC-2026-008 event and its September follow-ons were treated under that rule; the result is one counted operation, not three. ALIGNMENT_PRESSURE is recorded HIGH by default on every such admission. Standing Demotion Conditions for Q4 2026 CHQ-P-2026-011: the three conditions declared in the Q1 edition carry forward unchanged and will be adjudicated at Q4 close. CHQ-P-2026-016: the three conditions declared in the Q2 edition carry forward unchanged. CHQ-P-2026-014: the one condition declared in the Q2 edition carries forward unchanged. CHQ-P-2026-017: falsification clause 1 is registered as PR-2026-004 and will be scored at its review date; clause 2 (an operator postmortem documenting containment holding against comparable escalation) is adjudicated at Q4 close on the registry. SC-2026-008: the Q4 audit adjudicates whether the single-event CONFIRMED basis is supportable under the current standard, with the outcome published as a rating action either way. All adjudications publish regardless of outcome. PART III / REGISTRY RECORD Board of Record at Close Seven rated conditions as published at Issue No. 40, September 29, 2026, with the criterion version each rating rests on. SC-2026-002 Edge and Management-Plane Compromise CONFIRMED Accumulating none v1.0 standard SC-2026-007 Enterprise Application Plane Exploitation CONFIRMED Accumulating none v1.0 standard SC-2026-008 Autonomous AI Attack Operations CONFIRMED Accumulating none v1.1 (scope v1.2 from Oct 6) single event; audit item SC-2026-006 Exploitation Precedes Defender Awareness CONFIRMED Accumulating none v2.0 standard SC-2026-009 Security Tooling as Exploited Surface CONFIRMED Accumulating none v1.0 standard SC-2026-010 Vendor Risk-Signal Reliability EMERGING Receding none v1.0 (reset Aug 27) standard SC-2026-004 AI Agent Runtime Compromise EMERGING Stable up v1.0 standard Three registered structural conditions are declared and not rated; they are listed in the conditions index. Methodology v1.2 in force at close; v1.3 declared September 25 and effective October 6. Position Manifest All 17 positions in the canonical registry at Q3 close, with the registry status and version as published after the September 22 corrective wave, and the Q3 movement for this edition. CHQ-P-2026-001 ACTIVE Third-Party Access Constitutes Insider Access for Incident Accountability v1.3 Jan REINFORCED (Jul); AMENDED (Sep 22) CHQ-P-2026-002 ACTIVE Verification Collapse Is a Structural Condition, Not a Tooling Deficiency v1.2 Jan AMENDED (Sep 22) CHQ-P-2026-003 ACTIVE Hyperscaler-Aligned Procurement Will Absorb Standalone OT Security Into Cloud Platform Economics v1.2 Jan AMENDED (Sep 22); title corrected from Q2 edition CHQ-P-2026-004 ACTIVE Update Channels as Ungoverned Trust Execution Surfaces v1.2 Jan AMENDED (Sep 22) CHQ-P-2026-005 REINFORCED AI Agent Execution Authority Requires Independent Deterministic Validation v1.2 Feb AMENDED (Sep 22) CHQ-P-2026-006 ACTIVE No Enterprise Trust Primitive Is Self-Verifying v1.2 Feb AMENDED (Sep 22) CHQ-P-2026-007 WITHDRAWN Certificate Lifetime Compression Does Not Alter Hardware Trust Architecture v1.1 Mar WITHDRAWN to draft (Sep 22, RAT-C); v2.0 reissue pending CHQ-P-2026-008 ACTIVE Security Tool Categories Exist Because of a Constraint. AI Reasoning Systems Are Positioned to Remove It. v1.2 Feb AMENDED (Sep 22) CHQ-P-2026-009 ACTIVE Identity Systems Are Becoming the Execution Control Plane of Enterprise Security v1.3 Mar AMENDED (Sep 22) CHQ-P-2026-010 ACTIVE Cybersecurity Compliance Enforcement Is Transitioning Toward an Operationalization Standard v1.2 Mar AMENDED (Sep 22) CHQ-P-2026-011 ACTIVE Deployed Security Tool Presence Cannot Serve as Evidence of Functioning Control v1.3 Mar RETAINED (Q3 review); REINFORCED (Jul 24); AMENDED (Sep 22) CHQ-P-2026-012 ACTIVE Vendor Security Attestations Cannot Serve as Evidence of Operational Security State v1.3 Mar AMENDED (Sep 22) CHQ-P-2026-013 ACTIVE Portable Developer Identity Cannot Contain Credential Compromise Across Registries v1.4 Mar REINFORCED (Jul); AMENDED (Sep 22) CHQ-P-2026-014 ACTIVE Management Plane Compromise Produces Deterministic Control That Operates Outside Identity Enforcement v1.3 Mar RETAINED (Q3 review); REINFORCED (Jul); AMENDED (Sep 22) CHQ-P-2026-015 ACTIVE Execution Pipelines Function as Control Planes Without Verification Primitives Capable of Validating the Authority They Execute v1.4 Mar REINFORCED (Jul); AMENDED (Sep 22) CHQ-P-2026-016 ACTIVE Cryptographic Provenance Systems Validate Continuity of Authorization, Not Correctness of Authorization v1.5 May RETAINED (Q3 review); REINFORCED (Jul); AMENDED (Sep 22) CHQ-P-2026-017 ACTIVE Agent Runtimes Are Deployed Without Containment Proportionate to Their Demonstrated Capability to Escalate and Move Laterally v1.0 (v1.1 Oct 6) Sep 20 NEWLY ISSUED Manifest count: 16 active (including one at REINFORCED status), 1 withdrawn, 17 total. Reconciles to cover declaration. REINFORCED (Jul) marks the July reinforcement roll compiled for live positions; AMENDED (Sep 22) marks the Position Record Standard corrective wave (85 changes across P-001 to P-016, field semantics and publication integrity, no claim changed). Signal counts are held in the registry records and are not reproduced here pending the Q4 audit of operator-primary grades. Assumption Manifest All 36 assumptions in the canonical register at Q3 close. The register was published on September 22 as reference only, with a two-state vocabulary. Q2 status is shown for continuity; where the two differ the row is marked. A-001 RETIRED RETIRED Audit evidence is a reliable proxy for adversarial resilience P-001 A-002 ACTIVE UNDER PRESSURE Remediation closes the exposure surface it addresses P-002 A-003 ACTIVE UNDER PRESSURE Governance formalization precedes adversary operationalization P-003 A-004 ACTIVE UNDER PRESSURE Verification failures can be remediated locally P-004 A-005 ACTIVE UNDER PRESSURE Improved tooling can compensate for fragmented authority P-005 A-006 RETIRED RETIRED Technical execution boundaries align with system architecture boundaries P-006 A-007 ACTIVE RETIRED * Identity governance is complete when human access is governed P-002 A-008 ACTIVE UNDER PRESSURE Policy-based access control remains intelligible under autonomous composition P-003 A-009 RETIRED RETIRED Credential freshness bounds attacker utility more than automation bounds defender reaction P-005, P-006 A-010 ACTIVE CLOSURE AND GOV. * Operational delegation preserves local verification authority P-007 A-011 RETIRED RETIRED Third-party access can be governed as a separate risk class P-006 A-012 RETIRED RETIRED Third-party compromise is categorically different from insider compromise P-005 A-013 RETIRED RETIRED Verification is a tooling problem P-002, P-011 A-014 RETIRED RETIRED Faster patching meaningfully reduces exploit risk at scale P-003 A-015 RETIRED RETIRED Human-in-the-loop provides meaningful control over automated systems P-009 A-016 ACTIVE UNDER PRESSURE Governance authority boundaries align with execution authority boundaries P-011 A-017 ACTIVE UNDER PRESSURE Security governance authority and liability exposure are coextensive P-011 A-018 ACTIVE CLOSURE AND GOV. * Cryptographic validity implies trustworthy provenance and safe execution P-012, P-016 A-019 ACTIVE UNDER PRESSURE Disclosure timing is governed by detection capability, not regulatory obligation P-014 A-020 ACTIVE UNDER PRESSURE Control plane integrity can be verified independently of data plane activity P-015 A-021 ACTIVE UNDER PRESSURE Security authority persists through delegation chains P-014, P-015 A-022 ACTIVE UNDER PRESSURE Threat models remain valid across the asset lifecycle P-001 A-023 ACTIVE UNDER PRESSURE Incident scope is determinable within the response window P-013 A-024 RETIRED RETIRED Agent identity can be governed using human identity infrastructure P-005, P-009 A-025 ACTIVE UNDER PRESSURE Machine-authored config changes identifiable within existing change management P-012 A-026 ACTIVE UNDER PRESSURE Regulatory disclosure timelines assume existing detection capabilities P-004 A-027 ACTIVE UNDER PRESSURE Vendor attestations reflect current operational state P-012 A-028 ACTIVE UNDER PRESSURE Security product categories persist independent of cognitive constraints P-010 A-029 RETIRED RETIRED SaaS integration exposure is bilateral and bounded P-014 A-030 ACTIVE UNDER PRESSURE Identity provider boundary constitutes the identity perimeter P-001, P-009 A-031 RETIRED RETIRED Credential compromise within a registry is bounded by that registry's scope P-002 A-032 ACTIVE UNDER PRESSURE Management plane authority is bounded by identity enforcement at execution P-014 A-033 ACTIVE RETIRED * Software distribution channels are passive delivery mechanisms P-004, P-013 A-034 ACTIVE new (Jul 24) Agentic systems distinguish instruction input from data input by channel, source identity or position in context none linked A-035 ACTIVE new (Jul 24) Security tooling is defended at least as well as the assets it protects; adding a control does not expand the attack surface P-011 A-036 ACTIVE new (Sep 22) Runtime isolation (sandbox, container, node and credential scope) contains the autonomous software operating within it P-017 Manifest count: 25 ACTIVE / 11 RETIRED / 36 total. Reconciles to cover declaration. Three records added in window: A-034 and A-035 (July 24), A-036 (September 22). Rows marked * differ from the Q2 edition: A-007 and A-033 were RETIRED in Q2 and are ACTIVE in the published register; A-010 and A-018 were CLOSURE AND GOVERNANCE and are ACTIVE. These are reconciliation items from the September 22 publication, not recorded movements; they are referred to the Q4 audit. Abbreviated assumption text is a reader aid; canonical statements govern. Subsequent Events Events between window close (September 30) and the preparation cutoff (October 14, 2026). They do not contribute to any Q3 count, rating or manifest in this edition. Each will be classified in the Q4 2026 edition under its own window. October 6, 2026 POST-WINDOW SC-2026-011 enters the Board; SC-2026-008 scope refined; Methodology v1.3 in force Agent Authorization Boundary Failure entered at STRENGTHENING / Accumulating / Watch: up on three counted instances at one operator, two of them transferred from SC-2026-008 sub-class (b). The Board became eight conditions. P-017 amended to v1.1, re-homed to the new condition. Issue No. 42 (October 13) qualified the entry count: one instance demonstrable under the criterion as written, two founding instances held provisional pending the Q4 audit (CHQ-CORR-2026-012). October 9, 2026 POST-WINDOW Forecast Register instituted; error classes declared; rating-action packets Six claims open at institution (PR-2026-004 to 009); eight error classes declared before scoring; every rating action now carries a packet sufficient for blind reproduction, with the first blind reproductions owed. October 10, 2026 POST-WINDOW Second operator account; staged upgrade withdrawn An operator primary of July 30 (first reviewed October 10, scored as a catch-lag breach) documented an agent reaching a third-party system during evaluation. A CONFIRMED upgrade for SC-2026-011 was staged on it and withdrawn in the same session because the criterion wording did not cover the case; a criterion clarification was declared for the Q4 audit. P-017's reinforcement clause was met. October 13, 2026 POST-WINDOW Issue No. 42; Structural Outlooks; alignment bias rule countersigned Twelve point-probability claims issued as an experimental batch (SO-2026-001 to 012, review January 11, 2027). Microsoft's September 25 account of agent-driven cloud attacks weighted as actor reach under the alignment bias rule. A publication-sanitation correction opened on 28 records. October 14, 2026 POST-WINDOW SC-2026-006 renamed; Publication Stability Standard adopted Pre-Disclosure Exploitation replaces Exploitation Precedes Defender Awareness as the condition name, effective Issue No. 43; criterion, counted set and rating unchanged. CHQ-STAB-2026-001 fixes the cadence: criterion before evidence, ratify before publish, one governance change per issue, public surface changes only at issues. A sixth qualifying candidate for SC-2026-006 (a VPN appliance, exploitation October 3 against an October 13 advisory) entered intake. Sources and Coverage COVERAGE WINDOW Q3 2026 / July 1 to September 30, 2026. Events outside this window are excluded from all counts and classifications; post-window events material at issuance are disclosed separately under Subsequent Events. Structural Conditions Board, Issues No. 30 to 40 (weekly) Vendor marketing materials CHQ Positions Registry (17 records, 16 active) Unverified media reports CHQ Assumptions Register (36 records, reference only) Anonymous or unattributed tips CHQ Constraints Registry (4 anticipatory structural constraints) Beta or preview feature sets Board transition log, rating-action records and governance register Theoretical attack vectors CISA Known Exploited Vulnerabilities catalog (authoritative JSON from September 13) Internal candidates not yet position-issued Vendor advisories, responder and telemetry publications, operator primaries Shadow-state and watch-state classifications SEC Form 8-K Item 1.05 filings (weekly pass from July 18) Signals failing CHQ classification gates Vendor conduct ledger (counter-evidence pass from July 16) Post-window events (disclosed but non-contributing) Applied Criteria Criteria cited by name, version and date. Issues from No. 38 cite this table. Structural Condition Rating Specification v1.0 rev b Applied in draft Jul 7; ratified Jul 13 (retroactive to the Jul 7 prototype issue, countersignature open); publication gate cleared Jul 16 All ratings in window; the single-event entry provision behind SC-2026-008 Rating scale (generalized, threshold-based) v1.2 Aug 18, 2026 All ratings from Issue No. 34; provisions unchanged, wording generalized Ratings Methodology v1.3 declared Sep 25, effective Oct 6 Sep 25 No action in window; removes the single-event entry provision prospectively Watch and Outlook definitions; directional Watch v1.0 Jul 2026 / Aug 3 Modifiers on every condition State machine: pause rule and post-de-escalation reset v1.0 Aug 17 to 18 SC-2026-010 de-escalation Ceiling-consequence rule (CHQ-CEILING-2026-001) v1.0 Sep 9 SC-2026-008 trigger of Sep 3 SC-2026-010 independence unit (CHQ-UNIT-2026-010) v1.0 Sep 9 Vendor conduct ledger SC-2026-004 and SC-2026-006 de-escalation paths v1.0 Sep 9 Declared ahead of use SC-2026-006 criterion v2.0 (v1.0 voided) Sep 15, effective Sep 24 Sep 24 rating action Criteria Governance Standard (CHQ-CGS-2026-001) v1.0 Sep 15, effective Sep 24 Void, review and declaration states Sub-class accrual and ratification rule v1.0 Aug 26 Edge and application plane sub-classes Alignment Bias Rule (CHQ-ABR-2026-001) v1.0 Jul 13 Every thesis-conforming admission Position Record Standard (PRS) v1.0 Sep 22 Position manifest, withdrawal of P-007 How to Cite This Snapshot Organizations citing this snapshot may use the following format: "This decision was made in the context of structural conditions documented by CybersecurityHQ in Structural Snapshot Q3 2026 (V2026.Q3.0) as of September 30, 2026. The referenced condition was [condition name], rated [rating string] at Issue No. 40 under Ratings Methodology v1.2, or the referenced position was [position identifier, version]. CybersecurityHQ's classification documents ecosystem-level structural conditions and does not assess this organization's specific environment or decisions." Replace bracketed fields with the condition or position being cited. Rating strings are listed in the Board of Record at Close; position versions in the Position Manifest. Prohibited Usages The following usages are inconsistent with the scope of this snapshot and should not appear in citations: "CybersecurityHQ recommended this course of action." "CybersecurityHQ validated our security posture." "CybersecurityHQ confirmed our decision was correct." "CybersecurityHQ predicts this condition will worsen." "CybersecurityHQ rated our organization." "CybersecurityHQ rated our vendor." Citation Appendix Conditions [REF-00] Founding source, SC-2026-008 Sysdig Threat Research, July 1, 2026, first-hand investigation of the agent-operated ransomware operation. https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion [REF-01] SC-2026-008 https://record.cybersecurityhq.com/conditions/SC-2026-008 Autonomous AI Attack Operations. CONFIRMED / Accumulating at close; entered July 7, 2026 on a single documented production operation; rating basis under audit. [REF-02] SC-2026-007 https://record.cybersecurityhq.com/conditions/SC-2026-007 Enterprise Application Plane Exploitation. CONFIRMED / Accumulating; raised July 7, 2026 on the fourth independent instance. [REF-03] SC-2026-006 https://record.cybersecurityhq.com/conditions/SC-2026-006 Exploitation Precedes Defender Awareness (renamed Pre-Disclosure Exploitation October 14). CONFIRMED / Accumulating; raised September 24, 2026 under criterion v2.0. [REF-04] SC-2026-009 https://record.cybersecurityhq.com/conditions/SC-2026-009 Security Tooling as Exploited Surface. CONFIRMED / Accumulating; entered late July 2026. [REF-05] SC-2026-010 https://record.cybersecurityhq.com/conditions/SC-2026-010 Vendor Risk-Signal Reliability. EMERGING / Receding; de-escalated August 27, 2026. Positions [REF-06] CHQ-P-2026-017 https://record.cybersecurityhq.com/positions/CHQ-P-2026-017 Agent Runtimes Are Deployed Without Containment Proportionate to Their Demonstrated Capability to Escalate and Move Laterally. Issued September 20, 2026, v1.0; v1.1 October 6. Evidence docket CHQ-ED-2026-028. [REF-07] CHQ-P-2026-011 https://record.cybersecurityhq.com/positions/CHQ-P-2026-011 Deployed Security Tool Presence Cannot Serve as Evidence of Functioning Control. Effective March 2026, v1.3, CONFIRMED, 13 signals; retained through adjudicated demotion review at Q2 and Q3 close. [REF-08] CHQ-P-2026-016 https://record.cybersecurityhq.com/positions/CHQ-P-2026-016 Cryptographic Provenance Systems Validate Continuity of Authorization, Not Correctness of Authorization. Effective May 2026, v1.5, CONFIRMED; retained at Q3 close. [REF-09] CHQ-P-2026-014 https://record.cybersecurityhq.com/positions/CHQ-P-2026-014 Management Plane Compromise Produces Deterministic Control That Operates Outside Identity Enforcement. Effective March 2026, v1.3, CONFIRMED; retained at Q3 close. Governance records cited CHQ-METH-2026-v1.3 https://record.cybersecurityhq.com/machine/governance/CHQ-METH-2026-v1.3.md CHQ-SC-2026-006-v2.0-C1 https://record.cybersecurityhq.com/machine/governance/CHQ-SC-2026-006-v2.0-C1.md CHQ-SC-2026-008-v1.2 https://record.cybersecurityhq.com/machine/governance/CHQ-SC-2026-008-v1.2.md CHQ-SC-2026-011-ENTRY https://record.cybersecurityhq.com/machine/governance/CHQ-SC-2026-011-ENTRY.md CHQ-CORR-2026-011 https://record.cybersecurityhq.com/machine/governance/CHQ-CORR-2026-011.md CHQ-CORR-2026-012 https://record.cybersecurityhq.com/machine/governance/CHQ-CORR-2026-012.md CHQ-AUDIT-2026-Q4-SCOPE https://record.cybersecurityhq.com/machine/governance/CHQ-AUDIT-2026-Q4-SCOPE.md CHQ-ABR-2026-001 https://record.cybersecurityhq.com/machine/governance/CHQ-ABR-2026-001.md Rating-action packets, board snapshots and the corrections index: https://record.cybersecurityhq.com/machine/rating_actions/index.md, https://record.cybersecurityhq.com/machine/snapshots/board/index.md, https://record.cybersecurityhq.com/machine/corrections/index.md. Where a registry path differs from the one printed here, the machine index at https://record.cybersecurityhq.com/machine/index.md is authoritative. Anticipatory Structural Constraints [REF-10] CHQ-ASC-2026-001 Capability-Determined Threat Model Scope. Issued February 1, 2026. [REF-11] CHQ-ASC-2026-002 Contemporaneous Evidence as the Basis of Knowledge and Attribution. Issued February 1, 2026. [REF-12] CHQ-ASC-2026-003 Institutional Trust State Cannot Be Represented by Boolean Signals. Issued March 4, 2026. [REF-13] CHQ-ASC-2026-004 Automation Trust Inheritance Operates Outside Verifiable Governance Until an Independent Validation Surface Exists at the Point of Execution. Issued March 15, 2026. In window: upstream of CHQ-P-2026-017.