This is TheLiveMap’s own level. It is not an official government rating. It moves only on an official agency (such as CISA or the FBI) or two trusted sources. Unvetted tips never move it, and routine additions to CISA’s Known Exploited Vulnerabilities list do not move it on their own.
- QUIET No confirmed cyberattack disrupting a service in the last 48 hours, and no newly mass-exploited flaw in the last 7 days, and no major provider outage that meets the rule below.
- ISOLATED At least one confirmed attack or breach in the last 48 hours, limited to one company or service, with no wide outage. Or one major technology provider posts a significant outage on its own official status page (see major provider outages below).
- ENHANCED Any of: mass exploitation of widely used software (for example Microsoft or VPNs); a CISA and FBI advisory on an active campaign, or on security flaws with concern about exploitation; a confirmed attack taking a major company or service down for hours; an internet outage visible on Cloudflare Radar that was caused by an attack; or major provider outages (below).
- CRITICAL Any of: a CISA emergency directive; an attack disrupting regional critical services (hospitals, utilities, airlines, pipelines, 911); a campaign confirmed by two or more national agencies; a country-level internet outage attributed to an attack.
- EXTREME An attack disrupting critical infrastructure inside the United States or across several states or countries, or a government declaring a national cyber emergency.
Major provider outages (counted separately from attacks). Major providers: Microsoft (including Azure and GitHub), Google, Amazon Web Services, Cloudflare, Akamai, Apple and Slack. ENHANCED when, in the last 6 hours, two or more of these providers post a significant incident on their own official status pages; or one of them posts a broad incident that names three or more of its services and says it affects multiple services or regions; or two or more of AP, Reuters, BBC and CNN report outages at two or more of these providers, or at one provider that has also posted an official incident. ISOLATED when one of these providers posts a significant, narrower incident. Still-open incidents count for up to 24 hours. After 6 hours with no qualifying outage, the outage level drops one step. Downdetector or social media reports alone never count, and an outage is not called a cyberattack unless an official source says so.
Quiet, Isolated and Enhanced are set automatically. Critical and Extreme are shown only after approval by TheLiveMap. With 48 hours of no new qualifying activity, the level drops one step. Every level shows a one-line reason with its sources.