connectwise breach
Geminigemini-4-hydrogenOpenAIgpt-6.1-terra5 passes + 1 real-search98 queries23m ago
Download run
Gemini unique queries
36
7 in ≥ half the passes · stability 33%
OpenAI unique queries
53
2 in ≥ half the passes · stability 26%
Overlap between models
42%
14 shared of 33 distinct sub-queries
Gemini real searches predicted
71%
5 of 7 matched the simulation
OpenAI real searches predicted
100%
2 of 2 matched the simulation
Cost of this run
$0.227
51,683 tokens · 9 web searches · on your keys
Side by side
The same idea worded differently counts as shared. Matching uses EmbeddingGemma 2 similarity.
24% of distinct sub-queries were generated by both models (semantic match ≥ 0.935 cosine, EmbeddingGemma 2).
Only Gemini Both Only OpenAI
Only Gemini7
connectwise vs kaseya security breach
connectwise breach timeline
is connectwise safe to use after breach
connectwise breach indicators of compromise
connectwise cve-2024-1709
connectwise official statement on breach
connectwise official statement on data breach
Both models4
connectwise screenconnect vulnerability ↗4x
connectwise security breach ↗3x
connectwise official security advisories breach ↗2x
connectwise breach vs screenconnect vulnerability difference ↗2x
what happened in the connectwise breach ↗3x
connectwise breach what happened ↗3x
which connectwise products were affected by the breach ↗2x
who was affected by the connectwise breach ↗2x
Only OpenAI6
how to check if my screenconnect server was compromised
latest connectwise security breach news
connectwise security incident official statement
which connectwise products and versions are affected by security incidents
connectwise breach was customer data stolen
connectwise security incident patch and mitigation guidance
Fan-out diagram
Seed → topic clusters → sub-queries, per model.
SEED QUERY
connectwise breach
36 unique queries · 5 passes
incident overview and impact
2 queries · 7 hits
official news and advisories
3 queries · 7 hits
timeline and remediation steps
2 queries · 6 hits
vulnerabilities and patching details
2 queries · 5 hits
screenconnect vulnerabilities and ranso…
1 query · 4 hits
connectwise screenconnect vulnerability4xGoogle ↗
ENTITY EXPANSION
security incident response and mitigati…
1 query · 4 hits
connectwise vs kaseya security breach4xGoogle ↗
COMPARATIVE
indicators of compromise and checks
1 query · 2 hits
connectwise breach indicators of compromise2xGoogle ↗
RELATED
msp impact and guidance
1 query · 2 hits
connectwise breach impact on msp clients2xGoogle ↗
PERSONALIZED
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classifying 98 queries…
What the models actually searched
Each model answered the query with its own web search. These are the searches it ran, matched to the closest simulated query.
Gemini7 real searches · gemini-4-hydrogen71% predicted
ConnectWise security incident Google ↗
ConnectWise breach Google ↗
ConnectWise breach 2025 2026 Google ↗
"ConnectWise" "November 2026" OR "Nov 2026" ScreenConnect RMM+ Google ↗
ConnectWise breach 2024 2025 Google ↗
"RMM+" CVE November 2026 ConnectWise Google ↗
ConnectWise ScreenConnect May 2025 breach Google ↗
- microsoft.com · vertexaisearch.cloud.google.com
- aviatrix.ai · vertexaisearch.cloud.google.com
- youtube.com · vertexaisearch.cloud.google.com
- sophos.com · vertexaisearch.cloud.google.com
- huntress.com · vertexaisearch.cloud.google.com
- swisssecurityinsights.ch · vertexaisearch.cloud.google.com
- redtigersecurity.com · vertexaisearch.cloud.google.com
- connectwise.com · vertexaisearch.cloud.google.com
- connectwise.com · vertexaisearch.cloud.google.com
- huntress.com · vertexaisearch.cloud.google.com
- rapid7.com · vertexaisearch.cloud.google.com
- cyberscoop.com · vertexaisearch.cloud.google.com
- thehackernews.com · vertexaisearch.cloud.google.com
- reddit.com · vertexaisearch.cloud.google.com
- thehackernews.com · vertexaisearch.cloud.google.com
- therecord.media · vertexaisearch.cloud.google.com
- reddit.com · vertexaisearch.cloud.google.com
- securityweek.com · vertexaisearch.cloud.google.com
- cmitsolutions.com · vertexaisearch.cloud.google.com
- bellatorcyber.com · vertexaisearch.cloud.google.com
- aviatrix.ai · vertexaisearch.cloud.google.com
- sophos.com · vertexaisearch.cloud.google.com
- specterops.io · vertexaisearch.cloud.google.com
- sophos.com · vertexaisearch.cloud.google.com
- huntress.com · vertexaisearch.cloud.google.com
- youtube.com · vertexaisearch.cloud.google.com
- youtube.com · vertexaisearch.cloud.google.com
- therecord.media · vertexaisearch.cloud.google.com
OpenAI2 real searches · gpt-6.1-terra100% predicted
ConnectWise breach latest 2026 security breach cyber attack Google ↗
ConnectWise breach 2026 hackers breach ScreenConnect latest Google ↗
- techradar.com · techradar.com
- techradar.com · techradar.com
- techradar.com · techradar.com
- techradar.com · techradar.com
- axios.com · axios.com
- itpro.com · itpro.com
- connectwise.com · connectwise.com
- connectwise.com · connectwise.com
- therecord.media · therecord.media
- bleepingcomputer.com · bleepingcomputer.com
- vendorhistory.com · vendorhistory.com
- securityweek.com · securityweek.com
- thehackernews.com · thehackernews.com
- reddit.com · reddit.com
- reddit.com · reddit.com
- thehackernews.com · thehackernews.com
- inceptionsecurity.com · inceptionsecurity.com
- bleepingcomputer.com · bleepingcomputer.com
- ncsc.gov.ie · ncsc.gov.ie
- bleepingcomputer.com · bleepingcomputer.com
- secureresearch.com · secureresearch.com
- reddit.com · reddit.com
- reddit.com · reddit.com
- services.google.com · services.google.com
- withsecure.com · withsecure.com
- assets.ctfassets.net · assets.ctfassets.net
- business.bankofscotland.co.uk · business.bankofscotland.co.uk
- reddit.com · reddit.com
- reddit.com · reddit.com
- reddit.com · reddit.com
- reddit.com · reddit.com
- reddit.com · reddit.com
- reddit.com · reddit.com
- reddit.com · reddit.com
- reddit.com · reddit.com
- en.wikipedia.org · en.wikipedia.org
- itpro.com · itpro.com
- tomshardware.com · tomshardware.com
- itpro.com · itpro.com
- techradar.com · techradar.com
- tomshardware.com · tomshardware.com
- axios.com · axios.com
- en.wikipedia.org · en.wikipedia.org
- fr.wikipedia.org · fr.wikipedia.org
Semantic map
Every query placed by meaning (EmbeddingGemma 2, 256-d). Shaded regions are topics, nearby points are near-paraphrases, and a circle's size is how often the query came back.
Colour
SimulatedReal searchBoth models
Hover a query to see its counterpart · click a topic to focus it · zoom with Ctrl/⌘ + scroll, a pinch, double-click or +
Queries
36 queries · click a column to sort
| Query / type | Search | Intent | Query class | Routing format | Cluster | Freq ↓ | Weight |
|---|---|---|---|---|---|---|---|
connectwise screenconnect vulnerability ENTITY EXPANSION | Google ↗ AI Mode ↗ | The user wants to know about the specific ConnectWise product affected by the breach. | — | web_article | screenconnect vulnerabilities and ranso… | 4x of 5 | |
connectwise vs kaseya security breach COMPARATIVE | Google ↗ AI Mode ↗ | The user wants to compare the ConnectWise incident with another major MSP software breach. | — | comparison_table | security incident response and mitigati… | 4x of 5 | |
connectwise breach timeline RELATED | Google ↗ AI Mode ↗ | The user wants to understand when the breach occurred, when it was disclosed, and how it unfolded. | — | web_article | timeline and remediation steps | 4x of 5 | |
is connectwise safe to use after breach IMPLICIT | Google ↗ AI Mode ↗ | The user wants to assess the ongoing security posture and trustworthiness of ConnectWise. | — | forum/qna | incident overview and impact | 4x of 5 | |
connectwise security breach REFORMULATION | Google ↗ AI Mode ↗ | The user wants a general overview of the ConnectWise security incident. | — | web_article | official news and advisories | 3x of 5 | |
what happened in the connectwise breach REFORMULATION | Google ↗ AI Mode ↗ | The searcher wants a clear explanation of the root cause, attackers, and scope of the breach. | — | web_article | incident overview and impact | 3x of 5 | |
how to patch connectwise screenconnect IMPLICIT | Google ↗ AI Mode ↗ | The user wants actionable instructions to fix the vulnerability and secure their systems. | — | how_to_steps | vulnerabilities and patching details | 3x of 5 | |
connectwise breach remediation steps RELATED | Google ↗ AI Mode ↗ | The user wants actionable instructions on how to patch, secure, and recover from the ConnectWise vulnerability. | — | checklist | timeline and remediation steps | 2x of 5 | |
connectwise breach indicators of compromise RELATED | Google ↗ AI Mode ↗ | The searcher wants a list of IOCs, such as malicious IPs or file hashes, to check their systems. | — | checklist | indicators of compromise and checks | 2x of 5 | |
connectwise cve-2024-1709 ENTITY EXPANSION | Google ↗ AI Mode ↗ | The user wants technical details about the specific Common Vulnerabilities and Exposures identifier tied to the breach. | — | web_article | vulnerabilities and patching details | 2x of 5 | |
connectwise official statement on breach RELATED | Google ↗ AI Mode ↗ | The user wants to read the vendor's direct communication regarding the incident. | — | press_release | official news and advisories | 2x of 5 | |
connectwise breach impact on msp clients PERSONALIZED | Google ↗ AI Mode ↗ | The searcher wants to understand how the breach affects Managed Service Providers and their downstream customers. | — | web_article | msp impact and guidance | 2x of 5 | |
connectwise official statement on data breach RELATED | Google ↗ AI Mode ↗ | The searcher wants to read the official response and disclosures directly from ConnectWise. | — | press_release | official news and advisories | 2x of 5 | |
connectwise security incident REFORMULATION | Google ↗ AI Mode ↗ | The searcher wants a general overview of the security incident involving ConnectWise. | — | web_article | security incident response and mitigati… | 1x of 5 | |
connectwise security breach details REFORMULATION | Google ↗ AI Mode ↗ | The searcher wants a general overview and key facts about the ConnectWise security breach. | — | web_article | official news and advisories | 1x of 5 | |
connectwise screenconnect vulnerability cve-2024-1709 ENTITY EXPANSION | Google ↗ AI Mode ↗ | The searcher wants technical details about the specific ScreenConnect vulnerability linked to the breach. | — | web_article | vulnerabilities and patching details | 1x of 5 | |
how to check if connectwise was compromised IMPLICIT | Google ↗ AI Mode ↗ | The searcher wants to know how to detect signs of unauthorized access or indicators of compromise in their own environment. | — | how_to_steps | indicators of compromise and checks | 1x of 5 | |
connectwise breach cve-2024-1709 ENTITY EXPANSION | Google ↗ AI Mode ↗ | The user wants technical details about the specific CVE identifier linked to the ConnectWise incident. | — | web_article | vulnerabilities and patching details | 1x of 5 | |
connectwise breach affected versions RELATED | Google ↗ AI Mode ↗ | The user wants to check if their specific software version is vulnerable to the breach. | — | faq_page | incident overview and impact | 1x of 5 | |
how to check if connectwise was breached IMPLICIT | Google ↗ AI Mode ↗ | The user wants to determine if their own ConnectWise instance or environment was compromised. | — | how_to_steps | indicators of compromise and checks | 1x of 5 | |
connectwise breach vs kaseya breach COMPARATIVE | Google ↗ AI Mode ↗ | The searcher wants to compare the severity, attack vector, and impact of the ConnectWise breach against the Kaseya incident. | — | comparison_table | timeline and remediation steps | 1x of 5 | |
connectwise breach remediation steps for msp PERSONALIZED | Google ↗ AI Mode ↗ | A managed service provider wants tailored guidance on securing their client environments after the breach. | — | checklist | msp impact and guidance | 1x of 5 | |
connectwise breach official statement RELATED | Google ↗ AI Mode ↗ | The user wants to read the official communication from ConnectWise regarding the incident. | — | press_release | official news and advisories | 1x of 5 | |
connectwise breach impact on msps PERSONALIZED | Google ↗ AI Mode ↗ | The searcher, likely a managed service provider, wants to understand the business and client risks of the breach. | — | web_article | msp impact and guidance | 1x of 5 | |
how to check if connectwise was hacked IMPLICIT | Google ↗ AI Mode ↗ | The searcher wants instructions on auditing their ConnectWise instance for signs of unauthorized access. | — | how_to_steps | indicators of compromise and checks | 1x of 5 | |
connectwise breach impact on msp PERSONALIZED | Google ↗ AI Mode ↗ | The user wants to understand how the ConnectWise breach specifically affects managed service providers and their clients. | — | web_article | msp impact and guidance | 1x of 5 | |
connectwise screenconnect patch download RELATED | Google ↗ AI Mode ↗ | The searcher wants to find and apply the security update that fixes the vulnerability. | — | how_to_steps | vulnerabilities and patching details | 1x of 5 | |
connectwise cve-2024-1709 details ENTITY EXPANSION | Google ↗ AI Mode ↗ | The searcher wants technical specifics on the critical authentication bypass vulnerability tied to ConnectWise. | — | web_article | vulnerabilities and patching details | 1x of 5 | |
connectwise breach timeline and affected versions REFORMULATION | Google ↗ AI Mode ↗ | The searcher wants a quick reference of when the breach occurred and which software versions are vulnerable. | — | faq_page | timeline and remediation steps | 1x of 5 | |
indicators of compromise connectwise screenconnect RELATED | Google ↗ AI Mode ↗ | The user wants technical indicators to detect if their network has already been compromised. | — | checklist | indicators of compromise and checks | 1x of 5 | |
connectwise breach remediation steps for it admins PERSONALIZED | Google ↗ AI Mode ↗ | The searcher wants a tailored action plan for IT administrators to secure their environments after the breach. | — | checklist | timeline and remediation steps | 1x of 5 | |
what is connectwise screenconnect ENTITY EXPANSION | Google ↗ AI Mode ↗ | The searcher wants a basic definition of the ConnectWise product involved in the breach. | — | glossary/definition | vulnerabilities and patching details | 1x of 5 | |
what happened in the connectwise hack REFORMULATION | Google ↗ AI Mode ↗ | The user wants a plain-language explanation of the ConnectWise breach. | — | web_article | incident overview and impact | 1x of 5 | |
how to check if my connectwise server was compromised PERSONALIZED | Google ↗ AI Mode ↗ | The searcher, acting as a system administrator, wants instructions to audit their own ConnectWise instance for signs of intrusion. | — | how_to_steps | indicators of compromise and checks | 1x of 5 | |
connectwise breach faq RELATED | Google ↗ AI Mode ↗ | The user wants quick answers to common questions about the ConnectWise security incident. | — | faq_page | timeline and remediation steps | 1x of 5 | |
connectwise security incident response RELATED | Google ↗ AI Mode ↗ | The searcher wants an in-depth analysis of how ConnectWise handled the incident and lessons learned. | — | pdf_whitepaper | security incident response and mitigati… | 1x of 5 |
Tokens & cost
What this run used on your API keys, per model and step.
| Model | What | Requests | Input tokens | Output tokens | Web searches | Est. cost |
|---|---|---|---|---|---|---|
| gemini-4-hydrogen | Real-search passes | 1 | 220 | 3,0521,531 thinking | 7 | $0.121 |
| gemini-4-hydrogen | Simulated passes | 5 | 5,055 | 10,4023,381 thinking | — | $0.086 |
| gpt-6.1-terra | Real-search passes | 1 | 21,267 | 534175 thinking | 2 | $0.020 |
| gpt-6.1-terra | Simulated passes | 5 | 2,905 | 7,301505 thinking | — | — |
| gemini-3.5-flash-lite | Naming clusters | 1 | 801 | 146 | — | $0.0006 |
| Total | 13 | 30,248 | 21,435 | 9 | $0.227+ unpriced | |
Billed to your own API keys. Estimated from the providers' list prices (checked 2026-11-12); output includes thinking tokens. Free tiers, caching and retries can make your bill differ. Google gives 5,000 grounded searches a month free across Gemini 3+ models. OpenAI bills the web search content it reads as input tokens.
Passes
Does another pass still surface new queries? A flattening curve means the fan-out has stabilised.
GeminiOpenAIx = pass, y = cumulative unique queries
| Model | Pass | Target | Generated | Seconds | Tokens (in / out) | Notes |
|---|---|---|---|---|---|---|
| gemini-4-hydrogen · real search | 1 | — | 7 | 36.8 | 220 / 3,052 · 7 searches | |
| gemini-4-hydrogen | 1 | 12 | 12 | 16.2 | 1,011 / 2,210 | |
| gemini-4-hydrogen | 2 | 12 | 12 | 15.0 | 1,011 / 2,102 | |
| gemini-4-hydrogen | 3 | 12 | 12 | 14.7 | 1,011 / 2,180 | |
| gemini-4-hydrogen | 4 | 12 | 12 | 13.2 | 1,011 / 1,807 | |
| gemini-4-hydrogen | 5 | 12 | 12 | 14.5 | 1,011 / 2,103 | |
| gpt-6.1-terra · real search | 1 | — | 2 | 12.8 | 21,267 / 534 · 2 searches | |
| gpt-6.1-terra | 1 | 14 | 14 | 19.5 | 581 / 1,472 | |
| gpt-6.1-terra | 2 | 14 | 14 | 19.6 | 581 / 1,493 | |
| gpt-6.1-terra | 3 | 14 | 14 | 18.9 | 581 / 1,445 | |
| gpt-6.1-terra | 4 | 14 | 14 | 18.6 | 581 / 1,434 | |
| gpt-6.1-terra | 5 | 14 | 14 | 20.6 | 581 / 1,457 |