How the reading is calculated

All arithmetic happens in a published, deterministic model. The same code computes both the five-year history and this morning's reading.

1. An event's starting value
2. Decay
3. Aggregation
4. Gates and floors
5. Ceilings
6. Daily limiter
7. Warning level
Worked example: today's reading

1. An event's starting value

Every event gets a starting value I from its type's severity and four factors. The factors describe who is behind the act, what it targeted, how large it was and – for statements – who spoke.

I = \min (100, S \cdot m) \cdot a \cdot g \cdot w

S = severity, m = magnitude, a = attribution, g = target, w = speaker.

Attribution (a)	Factor
Officially attributed	1.00
State-linked suspect	0.75
Deliberate, actor unknown	0.50
Cause unknown	0.30
Accident or non-hostile	0.10

Target (g)	Factor
Finland	1.00
Serving Finland	0.70
Regional	0.40
Elsewhere in Europe	0.20

Magnitude (m)	Factor
Minor	0.70
Significant	1.00
Major	1.30

Speaker (w)	Factor
Not a statement	1.00
President	1.00
Minister or ministry	0.80
Spokesperson	0.60
Security Council deputy chair	0.50
Other	0.20

2. Decay

x (t) = I \cdot 2^{- (t - t_{0}) / h}

An event's effect halves every half-life h of its type, starting from the moment t₀ it was first reported. The effect is dropped entirely after 8 half-lives. This is why the reading drifts down gradually even when there is no new information.

3. Aggregation

Events of the same type, types within a pillar and state variables are combined with a damped noisy-OR rule D. The largest value sets the level, and each further value closes part of the remaining gap to 100. Values are sorted from largest to smallest.

D (x_{1}, \dots, x_{n}) = x_{1} + (100 - x_{1}) (1 - \prod_{i = 2}^{n} (1 - δ \frac{x_{i}}{100}))

The damping is δ = 0.5. For example, two values of 40 combine to 52, not 80. The combined value of one type is also capped at the type's cap.

C = \sum_{p} w_{p} \cdot P_{p}

The pillar values P are weighted and summed into the composite C.

4. Gates and floors

Some events and decisions are such clear signs that the reading must not stay below them, however little other information there is. A gate sets a floor F. An event-based floor holds for the gate's time window and then fades with a 30-day half-life, so the reading does not fall off a cliff.

Gate	Floor	Condition
G1 War	90	State of defence, or an officially attributed large-scale invasion of Finland.
G2 Armed conflict	80	25 or more battle deaths, Finland invoking Article 5 or the EU mutual assistance clause, or NATO invoking Article 5 for Finland.
G3 Use of force	70	Emergency conditions over an armed attack, or an armed attack or clash against Finland in the last 30 days.
G4 Militarised crisis	55	Emergency conditions over the threat of attack, reservists in extraordinary service, or Article 4 consultations requested by Finland.
G5 Hybrid campaign	40	Emergency conditions over hybrid influence, or sabotage officially attributed to a state in the last 60 days.
G6 Hybrid pressure active	20	Eastern border crossings closed over instrumentalised migration, or weaponised migration in the last 30 days.

5. Ceilings

Ceilings U keep the model cautious. Without use of force (gates G1–G3 inactive) the reading can be at most 49. If there is also a militarised crisis (gate G4, an offensive force concentration or an officially stated military threat), the ceiling is 64. A floor always beats a ceiling.

W_{raw} = \max (F, \min (U, C))

6. Daily limiter

The reading can fall by at most 3 points and rise by at most 15 points a day. The limiter stops a single error from swinging the reading. A floor based on verified information overrides the rise limit, so that, for example, a declared state of defence shows immediately.

7. Warning level

The warning level is computed on every run from the reading, its changes, the CUSUM detector, gates and tripwires. The highest condition met wins. The level rises immediately but steps down one level at a time, only after the condition has been lower for the time shown in the table.

Warning level	Raised when	Steps down after
1 Elevated	reading at least 35, a 7-day rise of at least 5, or any B tripwire	7 days
2 High	reading at least 50, a 7-day rise of at least 10, CUSUM at least 6, or any A tripwire	5 days
3 Severe	reading at least 65, a one-day rise of at least 10, two A tripwires, or gate G4	3 days
4 Critical	reading at least 80, or any of gates G1–G3	2 days

S_{t} = \max (0, S_{t - 1} + Δ W_{t} - k)

CUSUM accumulates day-to-day rises: Δ W is the day's change and k = 0.5 is the allowed slack. When the sum S passes 6, a slow but steady climb raises the warning level even if no single day is large.

Tripwires

Tripwires are individual warning signs. An A tripwire holds for 30 days and a B tripwire for 14 days after the event; a state-based tripwire holds for as long as the state does.

Code	Tripwire
TA1	Ultimatum or territorial claim against Finland
TA2	Russian mission or foreign embassies leave
TA3	Offensive force concentration
TA4	Extraordinary Finnish readiness measures
TA5	Pretext narrative about Finland
TA6	Major state-linked cyberattack
TB1	Snap inspection or major exercise nearby
TB2	Several sabotage or cyber incidents within a week
TB3	Severe GNSS interference
TB4	Article 4 consultations in the region or NATO reinforcement
TB5	Mobilisation in Russia
TB6	High-level threat of force against Finland
TB7	Troop reinforcement at the Finnish border

Worked example: today's reading

This is how the reading for 24 Oct 2026 comes about.

Pillar	`P`	`w`	`w`·`P`
K Kinetic and physical attacks	2.8	0.30	0.84
H Hybrid operations	31.9	0.20	6.38
F Finnish state posture	39.9	0.20	7.98
A Adversary posture and intent	46.7	0.15	7.00
N Allied and international signals	15.0	0.10	1.50
M Market and open-data anomalies	0.0	0.05	0.00
Composite `C`			23.7

Floor F = 20.0 (active gates: G6).
Ceiling U = 49.
max(F, min(U, C)) = 23.7. After the daily limiter the reading is 23.7, rounded 24 – band Hybrid pressure.

Pillar values are rounded to one decimal, so the sum can differ in the last decimal.