Filings tagged: Deep dive
Long-form original research: one subject, taken apart properly. Longer reads than our usual filings, fully sourced.
Each of these belongs to a research project with its own hub, carrying the method, the findings, and a reading order: see all research.
-
The vulnerability that gets you is nine months old
· Security Deep dive
We measured the gap between a vulnerability being published and being confirmed as exploited. The median is 272 days, and nearly half take more than a year. Watching only the new ones misses most of what matters.
-
Counting vulnerabilities tells you almost nothing about risk
· Security Infrastructure Deep dive
The Linux kernel has 8,053 recorded vulnerabilities and almost none get exploited. FortiOS has 113 and one in five does. Sorting software by how many flaws it has had is close to sorting it backwards.
-
97% of critical vulnerabilities are never exploited by anyone
· Security Deep dive
Of 20,491 vulnerabilities scored 9.0 or higher, 570 show any evidence of being used in an attack. Meanwhile one in eight confirmed-exploited flaws was scored below 7, and 141 had no score at all.
-
The patching rule that beats "just do the criticals"
· Security Deep dive
We analysed 248,176 public vulnerability records against the list of flaws confirmed as exploited. Sorting by CVSS severity gives you 89,697 things to patch. A different rule gives you 3,513 and catches nearly as many of the ones that matter.
-
The quiet tribunal that ran the .uk internet for 25 years
· Deep dive Commentary
Nominet's Dispute Resolution Service decided 5,525 fights over .uk domain names across 25 years. We analysed every published decision. This is the story they tell, from the first land-grab to the WIPO handover.
-
The .uk domain dispute service changes hands on Tuesday
· Deep dive Infrastructure
From 7 July 2026, disputes over .uk domain names are filed with WIPO in Geneva, not Nominet. What changes for anyone who owns a .uk domain, what stays the same, and the one deadline before the switch.
-
The case law nobody voted for
· Deep dive Commentary
With no statute and no judges, .uk domain disputes grew a genuine body of precedent: 3,365 citations anchored on a dozen home-grown decisions. And the foundations are the cases the brands lost.
-
The .uk land-grab happened twice, and the second one was scheduled
· Deep dive Infrastructure
When Nominet opened direct .uk names in 2014, the obvious ones were reserved for their .co.uk holders for five years. The month that protection lapsed, disputes surged, and they were overwhelmingly naked brand grabs.
-
A quarter of a century of .uk dispute records is moving to Geneva
· Deep dive Commentary
From Tuesday, the public record of every .uk domain dispute is hosted by WIPO, Nominet's own search tool is on a retirement path, and the data protection basis for the move is a question nobody has publicly answered.
-
What decides a .uk domain dispute: the story, not the paperwork
· Deep dive Security
Typosquatters lose 98% of .uk disputes. Holders of ordinary dictionary words usually keep them. Three-letter domains are a coin flip. What 5,525 decisions reveal about how domain cases are actually won and lost.
-
Who wins the fight for a .uk name (and the man who never lost)
· Deep dive Commentary
Big brands win .uk domain disputes 95% of the time or better. Individuals win 64%. And one respondent faced 28 complaints across 14 years and won every single one. What 25 years of decisions say about power in the naming system.