Completed July 1. Published July 15. Confirmed by August 4.
Twelve states. More than 30 water systems in Minnesota alone. Boil-water notices. Pressure loss. Flooding. Operators locked out of their own controllers.
Our forecast for the quarter named all of it before the first pump failed.
Here is the record, dated, sourced, and graded, because a claim without a date is marketing and a claim with one is evidence.
THE TIMELINE NOBODY GETS TO ARGUE WITH
June 9 and 10, 2026. Our prediction register opened. Sixteen predictions across China, Russia, North Korea, and Iran entered the ledger, each with a stated probability, an evidence grade, a named falsifier, and a resolution test written at issue.
July 1, 2026. The Iran forecast stood complete. Note the moment: a truce held between Washington and Tehran. The document sat finished while the region sat quiet.
July 7, 2026. The truce broke. Ships came under attack in the Strait of Hormuz. Strikes resumed and ran five straight days into July 15, the heaviest exchange since April.
July 15, 2026. We published. The forecast named water, wastewater, energy, and fuel systems as the leading sectors. Named internet-exposed industrial controllers as the device class. Named default credentials as the opening. Named a renewed kinetic exchange as the trigger that raises Iranian cyber tempo within days. Assigned 74, 72, 70, and 68 percent to the four lines. Wrote the falsifier for each one.
July 22, 2026. CISA updated its April advisory on Iranian-affiliated targeting of water-sector operational technology.
Late July 2026. Coordinated attacks hit operating technology at more than 30 Minnesota water systems. A treatment-plant pump failed in one town of 1,700 people, forcing residents onto a backup tank.
August 1, 2026. Federal agencies warned utilities nationwide. Seven states. Pressure loss and flooding at some sites.
August 4, 2026. Twelve states. A CISA follow-up recorded boil-water notices and manual-only operations. Two people familiar with the incidents told NBC News that Iran likely stands behind the wave.
Read the sequence again. The forecast preceded the trigger. The trigger preceded the campaign. The campaign matched the forecast.
THE SENTENCE THAT AGED TWENTY-ONE DAYS IN THREE WEEKS
Our July 15 board brief opened with three first moves. The first one: pull industrial-control devices off the public internet and replace default credentials.
Twenty-one days later, the acting director of CISA urged operators to remove publicly exposed controllers from the internet as soon as possible, while federal reporting confirmed default credentials as the opening the intruders walked through.
Same action. Same words, near enough. One came before the effects. One came after.
Boards do not pay for warnings. Warnings are free and everywhere. Boards pay for sequence: knowing which action matters before the incident makes the decision for you.
WHAT WE GOT RIGHT, WHAT STAYS OPEN, AND WHY WE PUBLISH THE DIFFERENCE
Two of the four Iran predictions resolve true at interim read. One resolves partial: the United States footprint confirmed at scale, while the Gulf-host leg stays open. One runs provisionally true: targeting rose within seven days of the July strike peak, and the de-escalation half of the pattern still has to play out.
Attribution stays open too, and we hold it exactly where the evidence puts it: Likely, lower half of the band. Federal advisories name Iranian-affiliated actors against the device class. No agency has attributed the specific wave in public. No group has claimed credit. One presidential statement disputes Iranian involvement, and our record logs the statement as a discrepancy rather than pretending it away.
Why publish the partials and the open questions on a page built to sell? Because a forecast shop that grades its own misses earns its hits. The vendors who never miss are the vendors who never said anything specific enough to miss.
THE REST OF THE RECORD
Iran was one chapter of four. The full quarter carries 16 predictions, and the interim read across the Big Four runs like a scoreboard.
North Korea: all four lines confirmed inside the window. An eleven-nation government alert on the fraudulent IT-worker program landed July 31. On August 11, the FBI disclosed a North Korean operative had worked remotely inside a United States federal agency. The theft-for-revenue model held; no pivot to destruction; the falsifier stayed silent.
Russia: government, energy, and logistics lines confirming on CERT-UA and vendor reporting, with Sandworm activity documented inside the window. The below-threshold line held: no confirmed destructive effect in a Western lifeline sector.
China: telecom, technology, and lifeline-edge lines confirming on standing federal and vendor reporting. Below-threshold line held.
Sixteen predictions. Six resolved true at interim read. Zero falsifiers fired. Every remaining line resolves on September 7 and 8, 2026, in public, against tests written before the events.
WHY THE METHOD BEAT THE MOMENT
Nothing mystical happened here. The forecast worked because the method forces specificity. A prediction enters our register only with a probability attached, an evidence grade under the NATO Admiralty convention, a competing alternative, a falsifier, and a mechanical resolution test. Sherman Kent probability language throughout, half-open bands, no weasel ranges.
Specificity is expensive. Specificity gets graded. Specificity also turns a forecast into a planning instrument instead of a mood: an operator reading our July 15 first moves knew exactly which devices to pull and which credentials to rotate, three weeks before the federal government said the same thing under sirens.
Vague survives everything and helps no one. Specific risks being wrong in public. We took the risk, dated it, and published the grading calendar.
THE INVITATION
On September 7 and 8, 2026, we grade all 16 predictions in public. True, partial, or false, scored against the tests as written, with the misses documented next to the hits. Verification of the July 15 publication date, including a cryptographic digest of the released edition, ships to anyone who asks.
The full record, with the timeline, the four Iran calls, the Big Four scoreboard, and the open questions, sits here:
Read more on the Forecast Validation
Want the audit briefing for your board or security team, or a look at how the Adversary Index prices the actors converging on your vertical? Reach us here:
One number to leave you with. The forecast assigned 72 percent to water, wastewater, energy, and fuel leading the Iranian target set through the quarter. The campaign hit water systems in 12 states inside three weeks of publication.
