A guide to the CES Economic Security Monitor
The Centre for Economic Security publishes the Monitor every weekday at 08:00 UK time. It is generated by an autonomous engine that reads the open web, classifies what it finds, weighs the picture, and issues a single daily posture judgement.
This page is a plain-English explanation of what the numbers mean, where they come from, and what they can and cannot tell you.
What you see at the top
Every Monitor opens with two figures and one sentence.
The Fusion Posture is a single-number reading of the day’s economic-security picture, on a 0–100 scale. It is not a threat count, a market index, or a probability. It is a rollup of how many independent threat vectors are active today, how severe each of them is, and how much of that severity is corroborated by independent sources. A higher number means more vectors are lit and more of them are corroborated. It moves slowly by design — a single event will nudge it; a coordinated pattern across three or four vectors will lift it several points.
The Band — Low, Guarded, Elevated, High, Severe — is the posture summary that goes with the number. It is the language a decision-maker can act on. “Guarded” says the picture is watchful but not urgent. “Elevated” says brief your stakeholders. “High” says review your posture. “Severe” says act now.
The Scenario Line is one sentence describing the shape of today’s picture — the pattern the analysts (both human and machine) see forming across the vectors.
The sixteen vectors
Underneath the Fusion Posture, the engine tracks sixteen distinct economic-security vectors:
- Cyber — ransomware, breaches, exploits, state-sponsored intrusion
- Climate & Environment — flooding, drought, wildfire, emissions events
- Economic & Financial — sovereign debt, currency, inflation, central-bank action
- Space — satellite, GNSS, orbital events
- Energy — grids, pipelines, refineries, LNG
- Transport — aviation, shipping, rail, freight
- Water — supply, treatment, reservoirs
- Food & Agriculture — crops, harvests, food supply, fertiliser
- Comms & Digital — telecoms, undersea cable, payment rails
- Supply Chains — chokepoints, semiconductor, rare earths
- Disinformation & Influence — coordinated inauthentic behaviour, propaganda
- Defence — military posture, missile activity, defence-ministry action
Each vector is scored independently every day and assigned a tier:
| Tier | Meaning |
|---|---|
| Low | Monitor. Nothing today. |
| Moderate | Watch. Something is developing. |
| Substantial | Brief stakeholders. |
| Severe | Review your posture. |
| Critical | Act now. |
The tier is based on how many events the engine has seen for that vector in the last 72 hours, and whether any of those events are corroborated by more than one independent source.
Where the data comes from
The engine reads the open web through a small number of authoritative feeds:
- GDELT — the global news firehose, filtered and re-classified on the actual article text (not just headline metadata)
- CISA KEV — the US Cybersecurity & Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue
- UCDP — the Uppsala Conflict Data Program
- The Gazette — the UK statutory register of insolvencies
- GOV.UK Tribunals — the UK employment and immigration tribunal service
- UK Parliament — Hansard and parliamentary questions
- IMF PortWatch — global port throughput
- UK BIST (formerly DBT) — the Department for Business, Innovation, Science & Trade
- API Ninjas — general reference data (holidays, currency, sanctions)
Signals from these feeds arrive as HARDFACTS — verified, structured, cite-able items with a source and a licence attached. Every figure in the Monitor traces to a HARDFACT or to a corroborated vector count. Nothing in the brief is invented; nothing is drawn from the model’s training memory.
Attribution: who is doing what to whom
The Monitor separates two questions that are often conflated in the news:
- Origin — who is causing this. The state, actor, or group that took the action.
- Impact region — where it lands. The countries or regions on the receiving end.
Attribution is deterministic in the first pass — the engine looks for named threat actors (APT28, Volt Typhoon, LockBit, and so on), for sanctioning states in economic-statecraft language (“US Treasury designated…”), and for explicit attribution cues in the article body (“attributed to Russia”, “state-sponsored”). Where nothing can be cleanly attributed, the entry is marked unattributed rather than guessed.
The Attribution table in the brief names today’s dominant actor and their target, and shows the supporting evidence.
What the score is not
It is not a threat count. A day with fifty low-tier signals can score lower than a day with three coordinated substantial-tier ones.
It is not a forecast. The Fusion Posture reads the last 72 hours of the picture. The Forecast section is a separate view, framed as trajectory and early-warning indicators, not as probabilities.
It is not a market signal. Financial-market noise gets classified into the Economic & Financial vector, but the Monitor is not designed to move ahead of markets and should not be read as trading input.
It is not a substitute for judgement. The engine is transparent about what it saw, how it scored it, and where the evidence came from. It is designed to support a human analyst’s judgement, not replace it.
Domestic vs adversary signals
Some structured signals — UK employment tribunals, insolvency register notices — get flagged by the engine because they matter to businesses and to the broader economic-health picture, but they cannot be attributed to a foreign adversary. From September 2026 onward these are surfaced in a clearly-labelled Domestic Economic Health subsection at the end of the Threat Indicators log, and are held out of the Fusion Posture calculation. That way the top of the brief is the adversary-attributable threat picture; the context sits underneath.
Corroboration
Any vector or hardfact carrying a “Corroborated: Yes” flag has been confirmed by at least one independent structured source in the same time window. Corroboration matters more than raw count — a single corroborated signal lifts the tier faster than several uncorroborated ones. This is deliberate. The engine is tuned to avoid amplifying a single source’s version of events.
Governance and integrity
Every published brief goes through a two-stage editorial gate:
- A grounding check confirms that every concrete figure and quotation in the draft traces back to the underlying data. Any figure without a citation triggers a rewrite.
- An editor-in-chief pass (a second AI, run separately from the composer) checks voice, structure, and analytical honesty. Anything that reads as speculation or padded language triggers a rewrite. The composer then re-drafts, up to three times, until the editor approves.
Where the editor cannot approve after three drafts, the brief is withheld rather than published, and the withhold reason is logged.
Every daily run is stored with its full source data, so any figure published can be traced to the exact evidence that supported it on the day.
Limitations we own
- Regional coverage skews to English-language sources. The engine reads global news but weights toward what is written in English. We are working to rebalance regional weighting.
- Attribution is conservative. The engine will call something “unattributed” rather than guess. This means some genuine adversary activity is under-attributed on any given day.
- The 72-hour window is deliberate. A slower window would smooth the picture but blunt the signal. A faster window would react to noise. Seventy-two hours is the current setting; we test it.
Reading the brief
The daily Monitor is designed to be read top-to-bottom in under five minutes. If you have thirty seconds, read the banner and the BLUF. If you have two minutes, add Strategic Analysis and Heat Map. If you have five, the whole brief. The Threat Indicators log at the bottom is the evidence backbone — most readers will not need to read it, but any figure in the brief can be traced there.
This document is the methodology reference for the CES Economic Security Monitor. Questions on the method, on a specific brief, or on the underlying data are welcome — please write to bushhouse@rebeccanomics.com.