Measured truth, not manufactured

Verlumia measures citizen cyber-risk with deterministic statistical code over official sources. No published figure comes out of a generative AI: AI helps us build and audit the system, never to produce the data. Every number carries its grade of evidence and its full lineage, and anyone can reproduce it.

The path of every datum is the same and doesn't change from one edition to the next: an official source (an administrative registry or a government survey) is downloaded and sealed with its digital fingerprint —a hash that fixes exactly which file was used—; a deterministic computation turns it into an index; and the result is signed with its lineage, so that another person with the same inputs obtains the same number. Today the index is fed by the SESNSP fraud registry (RNID), INEGI's cyberbullying survey (MOCIBA) and CONDUSEF's annual cross-check.

Not all data carry the same weight, and Verlumia says so with a grade of evidence visible on every figure:

Teal is not a brand color: it signals measured truth and nothing else. If something is teal and does not point to a grade-A datum, that's a defect.

Today the index has two public pillars: Citizen fraud, monthly and grade A, and Cyberbullying, annual and grade B. Other dimensions are declared in incubation and are neither published nor forcibly filled in: Data exposure and Citizen defense —no stable official source, after the dissolution of INAI (2025) and the continuity risk to ENDUTIH from the wind-down of the IFT— and direct cyber-harm —remote crimes against the person (extortion by other means and identity impersonation), measured since their 2026 baseline but without a comparable series yet—. The gap is declared; it isn't dressed up. To measure is not to publish: Verlumia measures from day one and publishes a figure only when it is meaningful.

"Citizen fraud" measures the crime of fraud in all its forms (RNID/SESNSP): what is reported —there is under-reporting, the dark figure—, it includes digital fraud but is not limited to it, and it is one pillar of the ICC, not total cyber-risk.

For months already closed, the headline is the measured official datum. The early estimate for the current month (the nowcast) exists and is published, but as an annex, never as the headline: estimates are kept distinct from measured data.

The pipeline is a deterministic Python codebase, versioned under version control (git), where the identity of each computation is fixed by the commit, not by a file name. The computation methodology is also versioned, with explicit rules about what may change and what breaks the comparability of the series.