Tracked Threats (TT)
The size of the standing threat board — whistleblowers, journalists, regulators, and movements under watch.
Formula
Thresholds & Bands
| Band | Range | State |
|---|---|---|
| Stable | < 40 | ok |
| Rising | 40-55 | warn |
| Surge | > 55 | crit |
Why This Metric Matters
The Tracked Threats count represents the size and workload of the Directorate's active threat board — the roster of individuals, organizations, and movements deemed to pose a material risk to operational continuity. Each tracked threat consumes Influence Operations resources: surveillance allocation, dossier maintenance, and pre-positioned response plans. A stable, manageable board size indicates that threats are being resolved (neutralized, co-opted, or downgraded) at roughly the rate they are identified. An expanding board signals either a genuine increase in opposition activity or a failure in the Directorate's upstream containment mechanisms.
Threshold Justification
The "Stable" ceiling of 40 reflects the maximum dossier load that the current Influence Operations staffing model can maintain with full coverage — meaning active surveillance, weekly reassessment, and pre-staged response plans for each entry. Above 55, resource dilution forces triage decisions that leave lower-tier threats unmonitored for extended periods, creating blind spots that historically precede surprise escalation events.
Historical Context
The threat board averaged 18-22 entries through 2021-2023, a period of relative stability following the consolidation of the Halcyon Wellness Accord. The count rose sharply to 48 in mid-2024 following a coordinated leak by an internal whistleblower (since resolved), which temporarily energized external investigative efforts. Post-incident reforms in compartmentalization and PANACEA's predictive threat-identification module have brought the count back to the low 30s as of Q2 2026.
Collection Method
Influence Operations maintains the master threat registry, with entries sourced from PANACEA's automated threat-identification pipeline, field intelligence reports, and referrals from partner divisions (Compliance, Legal, Security). Each entry undergoes BCL grading to classify containment requirements. The daily count is a snapshot of all active dossiers across tiers, published to the PANOPTICON dashboard via the Synaptic Data Fabric.
Known Failure Modes
The count can understate true exposure when threats operate through decentralized, leaderless structures that resist individual profiling — PANACEA's entity-resolution model struggles with diffuse movements that lack identifiable nodes. Conversely, the count can overstate the board during periods of aggressive automated identification, when PANACEA flags low-confidence entries that inflate the roster without representing actionable threats. Delayed dossier closure after threat neutralization can also produce stale entries that artificially elevate the count.