Research
Occasionally a public record is worth reading end to end. When we do that, we publish what we found, how we found it, and what the data cannot tell you.
What this is
Most of what we publish is filings: shorter pieces on something that happened this week and what it means for a smaller business. Research projects are different. They take one public record, analyse the whole of it, and report the patterns nobody has looked for because reading 5,000 documents is nobody's afternoon.
These are longer, and they take weeks rather than hours. They are also the work we are most confident about, because the findings come from complete records rather than from the handful of cases that made the news.
How we work
Four rules apply to everything on this page.
- Public records only. We analyse what is already published. We do not claim to hold, archive, or redistribute anyone's register, and we link to the source rather than reproducing it.
- The window is always stated. Every figure says what period it covers and how many records it is computed over. A finding without a denominator is not a finding.
- The caveats are published with the findings. Including the ones that weaken them. Where a question cannot be answered from the data, we say so instead of answering a smaller question quietly.
- Corrections are welcome and noted. If a figure is wrong, tell us. We will fix it and record that we did.
Projects
25 years of .uk domain disputes
Between 2001 and 2026, Nominet's Dispute Resolution Service decided 5,525 fights over .uk domain names. We analysed every published decision, from the first land-grab to the handover to WIPO in Geneva. Who wins, what actually decides a case, and how a body of precedent formed without anyone designing one.
Seven filings, with the method and a reading order.
What the vulnerability record actually says
We analysed 248,176 public vulnerability records against the catalogue of flaws confirmed as being used in real attacks. Sorting by severity gives a small business 89,697 things to patch, of which 98% were never exploited. There is a better rule, the typical exploited flaw is nine months old, and counting vulnerabilities per product tells you almost nothing.
Four filings, with the method and a reading order.
Working with us
If you are a journalist, researcher, or practitioner and want to discuss any of this, email [email protected]. If you have a question about your own business rather than the research, the contact page is the place to start.