---
title: "Sector risk"
method: GET
path: "/ransomware/sector-risk"
tags: ["ransomware"]
---

# Sector risk

`GET /ransomware/sector-risk`

Sector risk analysis from the Redis indexes the sync job builds (no live
HTTP). With `sector`, the 200 body is that sector's cached object (keys
owned by the sync job, among them `sector`, `attacksThisMonth`,
`topGroups[{name, …}]`); 404 when nothing is cached for it. Without
`sector`, `{"sectors": […]}` holds every cached sector sorted by
`attacksThisMonth` descending, each carrying `press{sector,
recentPressCount, latestPressDate, topPressTitle, topPressUrl,
topCitedGroups[{name, count}]}` when `press=true`. Costs one request of
the monthly quota.

## Query parameters

- `sector` string
- `press` string

## Response `200`

One sector object (`sector=`) or `{"sectors": […]}`

- object

## Other responses

- `401` — Unauthorized - Missing or invalid API key
- `404` — `sector=` set and nothing cached for it
- `429` — Too many requests - Rate limit exceeded
- `503` — Sector list not cached yet

## Changes

- **2026-09-23** `edb544398108` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/ransomware/sector-risk/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/edb544398108?raw)