Precision is
a feature.

Not the number of affected users globally. The set of components you declared that sit on the incident's attack path, plus the neighbours those components can reach. It is a graph property, which is why the product draws one.

Reserved for incidents where a party has stated that access occurred. Ferroscope never upgrades an intersection to a breach. The gap between the two words is the product's entire ethical position.

Primary surface, then same-category siblings, then peak, then containment. It is not a physics model. It is a communication device for the word “lateral”.

Computed as 0.55 + 0.45 × (present ÷ affected). It is a coverage fraction, not a probability. Four of four surfaces present scores 1.0; one of four scores 0.66.

Railway, Zeabur, Onamae, TiDB Cloud. If an attacker owns the control plane, they own every host beneath it — which is why hosting incidents have disproportionate blast radii.

No randomness at request time. Graph jitter comes from an FNV-1a hash of the node id. The seed exists so screenshots and tests agree with production.

The planner's ranking key. A three-minute certificate refresh that removes 12 points scores 4.0/min; a ninety-minute rebuild that removes 20 scores 0.22/min. The first one wins, and that ordering is the product.

Exposure is not compromise. A laptop trusts the eMudhra root — that is exposure. Nobody has used the corresponding key against that laptop — that is the absence of compromise. Ferroscope only ever claims the first.

2FA, password manager, automatic updates. They do not prevent a specific incident; they lower the weight of whole vector classes. That is why they are modelled separately from remediation actions.

The eMudhra incident involved eight intermediates with trivially weak P-384 private keys. Browsers blocked those intermediates; the parent root stayed in several bundles.

An incident matches when at least one of its affected stack ids is present in your profile, or when it is region-scoped and your region matches. Everything else is context.

2FA, a password manager, and automatic updates each subtract from an incident's raw weight, capped at 80%. The cap exists because partial controls are not a force field.

An incident where you have zero affected items but two or fewer missing ones. The graph shows these at lower opacity because they are the honest answer to “what would installing this cost me?”.

Reductions compound multiplicatively with a 0.72 haircut per action, so residual risk approaches zero but the arithmetic never goes negative. The planner shows baseline and residual side by side for exactly this reason.

If a root is compromised, every certificate beneath it can be forged. Browser vendors can block the intermediate, but a non-browser store that still trusts the root remains exposed.

e ≈ 2.718, π ≈ 3.14. The seed is a constant in the repository, printed in the footer, and returned by /api/healthz so a deployment can be checked against the dataset it claims to serve.

An updater, a registry, a CI workflow, a vendor's signing pipeline. The victim does nothing wrong; the channel does. This is why signature verification is necessary but insufficient.

Windows, Firefox, Chrome, Java, Node, and Python each keep their own. Updating one does not update the others. certifi, Python's bundle, is vendored and follows PyPI, not Windows Update.