# Methodology — California Cybersecurity Risk Report 2027

## 1. Scope and design

The report analyzes cybersecurity risk affecting California businesses using public, authoritative data only. No surveys were conducted. No intSignal customer or telemetry data was used. Nothing extrapolates from intSignal's client base to the California business population. Data vintage: the most recent complete-year federal data is calendar 2025 (FBI IC3 2025 report, published April 2026; Verizon DBIR 2026, published May 2026); the California Attorney General register is analyzed through August 24, 2026.

## 2. FBI IC3 analysis

Source facts (complaint counts, loss dollars, state tables, crime-type tables, 60+ tables, cryptocurrency tables) were transcribed from the FBI's published annual reports (2022–2025 editions) and the FBI Los Angeles field office releases. Each transcribed figure carries a claim ID and page/section reference in 03_CLAIM_EVIDENCE_REGISTER.csv.

intSignal calculations on IC3 figures are arithmetic and reproduced in scripts/calc_ic3_california.py, with outputs preserved in calculations/ic3_california_results.txt:

- Year-over-year change: (new − old) / old, on exact published figures.
- Shares: California value ÷ national value, both from the same report edition.
- Per-day averages: annual figure ÷ 365 (illustrative uniform average).
- Per-resident: FBI's published per-100K figure ÷ 100,000 (the FBI computes per-100K using 2025 Census population estimates; intSignal performs no independent population adjustment).
- Ranks are read directly from FBI tables, never computed.

Rules: dollars are nominal (no inflation adjustment); percentage calculations use only exact published figures — the 2022 California loss, published at "more than $2 billion" precision, is displayed at that precision and excluded from all percentage calculations.

## 3. California Attorney General breach register analysis

**Data.** The Attorney General publishes a CSV export of every breach notice submitted under Cal. Civ. Code §§ 1798.29/1798.82 (breaches affecting more than 500 California residents), with three fields: organization name, date(s) of breach (if known), reported date. intSignal captured the export on August 25, 2026 and preserved the capture verbatim at raw-data/ca_ag_breach_register_capture.csv. The analysis window is all notices with reported dates from January 2, 2024 through August 24, 2026 (n = 1,536). The raw capture was never edited; all handling occurs in a separate script.

**Unit of analysis.** One row = one notification. Notices are not deduplicated into incidents: supplemental or repeated notices are counted as filed, because the register records notifications, not incidents. This is stated wherever counts appear.

**Annual counts.** Count of rows by calendar year of reported date. Same-period comparison uses January 1 – August 24 of each year.

**Notification lag.** lag_days = reported date − earliest breach date, using only breach dates on or before the reported date. Exclusions from lag statistics only (rows retained in all counts): 90 rows with no breach date listed; 4 rows whose only listed breach dates post-date the reported date (source data-entry errors, e.g., a breach dated 2027). No other cleaning. Statistics reported: median, mean, 90th percentile, max, and shares within 30/60 days and beyond 180/365 days. Interpretation rule stated in the report: this measures occurrence-to-notice (the victim exposure window), not legal compliance, because California's statutory clock runs from discovery.

**SB 446-era cohort.** Notices reported in 2026 whose earliest breach date is on or after January 1, 2026, versus 2026-reported notices for earlier breaches. The cohort is right-censored (slow notices for 2026 breaches had not yet been filed at capture); this is disclosed wherever the cohort is cited, and the report commits to re-measuring the complete 2026 cohort in the next edition.

**Repeat notifiers.** Counts of exact organization-name matches after casefolding and whitespace collapsing. Deliberately conservative: name variants (e.g., "Keenan & Associates" vs "Keenan & Associates (Keenan)") are not merged, so repeat counts are floors.

**Vendor cascades.** Rows grouped by identical breach-date string; groups with 5+ distinct normalized organization names are reported as cascade indicators. A shared date string does not by itself prove a shared incident; reported cascades were corroborated by the composition of the filers (e.g., 32 pharmaceutical manufacturers and patient-assistance programs sharing the 02/21/2024 signature, alongside notices from the distribution-services provider itself). The method undercounts cascades whose members list differing date strings.

All register computations are in scripts/analyze_ag_register.py; outputs in calculations/ag_register_results.txt. Chart data derivations are in scripts/make_charts.py.

## 4. Verizon DBIR 2026

Findings are quoted from the published 2026 report (percentages of breaches, initial access vectors, ransom payment statistics, KEV remediation, third-party involvement) and cross-checked against multiple independent analyses of the report. DBIR describes a global incident dataset; the report never presents DBIR findings as California-specific.

## 5. Collection environment

Sources were retrieved through authenticated web fetches with recorded URLs and access dates. The analysis environment operates on an allow-listed network and cannot download directly from oag.ca.gov or ic3.gov; source content was therefore captured through recorded web fetches and transcribed verbatim into the research package before programmatic analysis. Consequence and control: the register capture should be verified against a fresh download of the live export before publication (a row-count and spot-check procedure is specified in 12_RESEARCH_PACKAGE_INDEX.md); the canonical raw data remains the state's live export, and the Data Availability statement provides access instructions.

## 6. Standards

Every quantitative public-facing claim carries a claim ID mapping to source, fields, formula, result, and limitations (03_CLAIM_EVIDENCE_REGISTER.csv). Claim types are labeled SOURCE FACT, INTSIGNAL CALCULATION, or INTSIGNAL INTERPRETATION. No statistic was invented, estimated, or modeled. Records were never silently cleaned, removed, combined, or reinterpreted; every exclusion is enumerated with counts. Corrections will be logged publicly in 14_CORRECTIONS_LOG.md and reflected in 13_VERSION_HISTORY.md.