diff --git a/README.md b/README.md
index 2e6ba4c..49271bc 100644
--- a/README.md
+++ b/README.md
@@ -82,7 +82,7 @@ Every file answers one question: **which controls from framework X address vulne
 | **70+** open-source tools | Catalogued and organised by function |
 | **25** eval profiles | Runnable Garak (13) + PyRIT (6) + LAAF (6) tests mapped to OWASP entries |
 | **<!-- stats:frameworks-mapped -->26<!-- /stats -->** compliance reports | Per-framework gap assessments auto-generated from data layer (MD, CSV, JSON, OSCAL) |
-| **<!-- stats:incidents -->135<!-- /stats -->** documented incidents | Real-world + research incidents with MAESTRO layer attribution (MD, CSV, JSON, STIX 2.1) |
+| **<!-- stats:incidents -->136<!-- /stats -->** documented incidents | Real-world + research incidents with MAESTRO layer attribution (MD, CSV, JSON, STIX 2.1) |
 | **LAAF v2.0** | First agentic LPCI red-teaming framework — fully integrated with 6-stage × OWASP crosswalk |
 
 All free. All open-source. Built for practitioners.
diff --git a/data/stats.json b/data/stats.json
index 854ec56..13d0644 100644
--- a/data/stats.json
+++ b/data/stats.json
@@ -61,7 +61,7 @@
     }
   },
   "incidents": {
-    "total": 135
+    "total": 136
   },
   "evidence": {
     "incidents_annotated": 17,
diff --git a/docs/incidents.js b/docs/incidents.js
index 80fdddf..98d4219 100644
--- a/docs/incidents.js
+++ b/docs/incidents.js
@@ -1,5 +1,5 @@
 // Auto-generated by scripts/generate.js — do not edit manually
-// Incidents: 135
+// Incidents: 136
 window.CROSSWALK_INCIDENTS = [
   {
     "id": "INC-001",