Reading the age buckets
The counts run from less than 1 hour old up to more than 1 year old: 1 High / 1 Critical in the newest bucket, climbing to 93 High / 118 Critical in the 1–7 day range, tapering through the older buckets down to 45 High / 102 Critical for indicators first seen over a year ago. Two things stand out. First, the 1–7 day bucket carries the highest volume in both columns: most of the current High and Critical activity comes from sources that are recent, not long-tenured signatures on a static list. Second, the over-a-year bucket is not small. 102 Critical events are tied to sources with a track record stretching back more than twelve months, meaning the score never fully decayed because the source kept generating validated activity recently enough to stay elevated.Why age matters alongside severity
A Critical score by itself says how confident the system is that a source is malicious right now. Age adds a second axis: whether that’s a source that just appeared, or one that’s been through the decay model repeatedly and kept re-triggering it. A 1–7 day Critical indicator and a >1 year Critical indicator carry the same enforcement weight, but they describe different attacker behavior: one is a fresh campaign, the other a persistent source that has never gone fully quiet.The origin map and device breakdown alongside it
The map in the middle and the bar chart on the right cover the same ground as the origin and enforcement-point breakdowns elsewhere in this report — geographic concentration, with the US region carrying the highest count at 266, and blocked volume split across the same four devices (Checkpoint-3472409, Checkpoint-198365, Fortigate-infra1, Fortigate-infra2). They’re included here as the surrounding context for the age data, not a separate finding.Proof of Value engagements produce this same age-versus-severity breakdown against a client’s own traffic. Start a Proof of Value.