forecasts

[FORECAST] Iran-Linked Cyber Risk Is Real. The Evidence Bar Is Harder (Updated: 2026-05-14)

The forecast is 29%, but the operational risk is still worth preparing for this week.

The threat actor brought vibes. The forecast asked for receipts.

This is the 6th installment of our What's Iran gonna do next series of forecasts:

(2026-03-17) Forecast 1 - From Password Sprays to Tenant Sabotage: The 8-Week Iran Cyber Risk for U.S. and Israeli Orgs
(2026-03-26) Forecast 2 - From Password Sprays to Tenant Sabotage: The 8-Week Iran Cyber Risk for U.S. and Israeli Orgs - UPDATED: 2026-03-26
(2026-04-08) Forecast 3 - Beyond PLCs: Are Iran-Linked Operators More Likely to Chase New Targets, New Tooling, or New Impact?
(2026-04-23) Forecast 4 - Iran’s Cyber Window Stays Open—But the Novelty Bar Is Tougher Now
(2026-05-05) Forecast 5 - Iran’s Cyber Window Is Still Open—But the Qualification Clock Is Now the Hardest Adversary (Updated 2026-05-05!)

Forecast in one line

Our current call is 29% that Iran-linked cyber operators clear the full novel + material + attributed threshold against a U.S. or Israeli organization by May 20, 2026.

That does not mean the threat is quiet.

It means the public evidence bar is strict.

For this forecast to resolve “yes,” we need more than Iran-linked activity, more than disruption, and more than a noisy claim. We need one qualifying incident with three things at once:

credible attribution
material impact
a genuinely new dimension

That is a hard bar to clear in the final week.

And that is the point.

The call..

[SIGNALS WEEKLY] Edge Access, False Flags, and Emerging AI Attack Surfaces

The edge box blinked. PAN-OS, Ivanti, Teams lures, ClickFix, AI agents. Different doors. Same ugly pattern: access keeps hiding in the plumbing. The boring surface became the breach path.

[FORECAST] Will Akira trigger a week-long hospital disruption by end of 2026? (Updated 2026-05-11)

We’re revising the Akira hospital disruption forecast down to 2%. The risk is real, but the question is narrower than it looks.

[FORECAST] Device-Bound Sessions Are Coming. Defaults Are the Hard Part.

“Secure by default” sounds great until it meets BYOD, VDI, federated SSO, and the help desk exception list from hell. Device-bound sessions help. Waiting for every SaaS vendor to flip the default is not a strategy.

[SIGNALS WEEKLY] Patch Cliffs, Supply Chain Drift, and Soft DevOps Underbellies

The industry keeps treating emergency patches like a finish line. Meanwhile, exposed control panels, self-managed DevOps boxes, and forgotten appliances are still out there collecting bad decisions like loyalty points.