# Attack Volume Is Not Evidence of Harm ## Claim The number of blocked attack attempts measures attacker interest, not defender failure, so a record attack volume is compatible with a near-zero compromise rate. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Holds where a working mitigation (forced update, WAF rule, virtual patch) was widely deployed before or during the attack window — as it was for WP2Shell. - Breaks where the affected population is largely unpatched, in which case attack volume and compromise rate do track together and the reassurance doesn't apply. - Breaks as a reassurance whenever the compromise measure used is itself a proxy (e.g. a vendor's support-ticket queue) that a competent attacker would specifically avoid triggering — the absence of visible compromise isn't the same as the absence of compromise. ## Evidence Wordfence reports over 11 million WP2Shell attack attempts alongside a comparatively low compromise rate, attributing the gap to coordinated response: AI-assisted early discovery, forced core updates, and host-level WAF coordination landing before or during peak exploitation. > [!quote] > it's important to distinguish attempted attacks from successful compromises ## Links - [[3. Resources/Permanent Notes/Patch-to-Exploit Speed Makes Route-Aware Detection Part of Patching]] — because extends; that note argues detection has to be part of patching because exploitation now outpaces patch adoption — this note explains why that combination (fast detection + fast patching) is what kept volume from becoming harm here. - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — because applies-in; directly shapes how incident communications should read attack-volume statistics. ## Tests / falsifiers - Across historical vulnerabilities with published telemetry, regress incident-response caseload on blocked-attempt volume. A strong positive correlation refutes the general claim. - If compromise counts from independent incident responders (not the firewall vendor reporting the attack volume) diverge sharply from the vendor's own compromise estimate, this specific instance is unsupported even if the general principle holds elsewhere. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Literature Notes/WP2Shell WordPress Exploit Technical Analysis and Real Attack Data (Wordfence)]] — reports the attack-volume figure and the coordinated-response explanation for the low compromise rate.