A single number hides the decision
“1,939 malicious events got through” is a headline. It isn’t a task list. Treating all 1,939 the same way means either over-reacting to low-risk noise or under-reacting to the 425 events that carry the highest confidence of active compromise attempts. The severity band is derived from the Crime Score assigned to the source, so this breakdown reflects the same scoring logic used everywhere else in the platform, not a separate categorization built for this chart alone.What separates the bands in practice
Low and Medium severity traffic is typically worth logging and reviewing on a normal cadence — reconnaissance-adjacent activity from sources with a thinner track record. High and Critical, together 670 events here, represent sources with enough independent corroboration and score to warrant a blocking decision without waiting for further evidence.Proof of Value engagements produce this same severity breakdown against a client’s own malicious traffic. Start a Proof of Value.