The KFC Effect — How Automated Threat Pipelines Feed on Their Own Output
The Short Version
You discover a vulnerability. An advisory publishes. Media covers it. More articles follow ("CISA urges hardening", "Vendors respond", "Here's what we know"). Your scraper picks them all up. Your detector screams "SURGE!" You publish another advisory. The cycle repeats.
One vulnerability → nine articles over 23 days. Five of them were follow-ups of the first.
We call this the KFC Effect — Knowledge → Fix → Create — and it's the silent noise amplifier in every automated threat intelligence system.
What Is the KFC Effect?
Knowledge — A real vulnerability is found. Advisory drops.
Fix — Vendors patch. CISA issues guidance. Media writes follow-up stories.
Create — Scrapers ingest follow-ups. Detectors flag a spike. New advisory publishes. 🔁
The problem isn't bad journalism. It's that automated systems can't tell the difference between a genuine spike in vulnerabilities and a spike in coverage of one vulnerability.
Real Data. Real Example.
The SharePoint CVE cascade — one vulnerability, tracked across our 90-day feed:
| 📅 Date | 📰 Headline | 🏷️ Type |
|---|---|---|
| Jun 23 | Unpatched SharePoint servers opened the door to multiple attackers | 🆕 Original |
| Jul 2 | SharePoint RCE CVE added to CISA KEV | 🆕 Confirmed |
| Jul 2 | CISA: SharePoint RCE now actively exploited | 🆕 Advisory |
| Jul 9 | Helix vishing group exploits SharePoint data theft | 🔁 Follow-up |
| Jul 15 | CISA urges patching of SharePoint flaws | 🔁 Follow-up |
| Jul 15 | CISA urges immediate patching — SecurityWeek | 🔁 Follow-up |
| Jul 16 | CISA urges immediate SharePoint hardening | 🔁 Follow-up |
One CVE. Seven articles. Four are follow-ups. Without dedup, a detector would count all seven as independent signals.
The Pipeline Numbers
Across 90 days: 25 duplicate/followup items out of 1,237. That's only 2% overall — but during high-activity windows it jumps to 12.9%. When the detector needs accuracy most (real surges), the KFC Effect is at its worst.
The Fix
Three changes, all applied at detection time:
1. CVE Dedup
If a title contains a CVE already seen in the current detection window, count it as coverage — not a new signal. The story is the vulnerability, not the article.
2. Followup Filter
Articles matching known followup patterns ("urges patch", "hardening advisory", "coordinated disclosure") are tagged as KFC followups. They still go into the database. They just don't inflate the surge count.
3. Time-Decay Weight
Followup articles referencing the same CVE get a decaying weight based on age. Day 1 = 100%. Day 3 = 30%. Day 7 = 0%. The signal naturally fades.
Why This Matters for OT
OT operators don't need to know there are more articles about a vulnerability. They need to know if there are more vulnerabilities. The KFC Effect inverts that priority. Fixing it means operators see actual signal — not amplified noise.
And honestly? It's also pretty funny. We're building a system that gets confused by its own publication schedule. The fix is simple: measure events, not headlines.
OTFeed matches public ICS advisories to the gear a customer actually runs. otfeed.com