Editorial methodology and data sources
How records are researched, written, reviewed and updated.
Sources
Primary sources take precedence: vendor and institute disclosures and post-mortems, CVE and advisory records, peer reviewed papers and preprints, official journals and legislative texts, regulator publications and standards catalogues. Secondary reporting is used to identify developments and is verified against primary sources before a record is published or updated. Where a record depends on a single researcher disclosure without independent confirmation, the record says so.
Review
Each record is written by a practitioner and reviewed by a second before publication. Incident records are reviewed when new facts emerge and at least quarterly for the first year. Regulation records are reviewed when a status or date changes and at least quarterly. Tool records are reviewed on major releases. Research summaries are checked against the paper by a reviewer with domain expertise.
Classification
Incidents are classified by type of harm, industry, kind of system and severity, using the OECD incident definition, and are mapped where possible to MITRE ATLAS techniques and OWASP identifiers. Tools are classified by the security task they support, licence, maintainer and language. Papers are classified by topic and publication type. Standards are classified by issuing organisation, document type, status and certifiability. Regulations are classified by jurisdiction, status, whether they are binding, instrument type and who they apply to.
Offensive detail
We describe attack classes, mechanisms and the conditions under which they succeed. We do not reproduce working exploits, jailbreak strings, injection payloads or step-by-step intrusion tradecraft, including when they appear in public sources. Tool records describe what a tool tests for, not how to weaponise it.
Case studies
Case studies are anonymised and some details are composited to protect the organisations involved. The situation, approach and outcome are preserved; figures are those reported by the programme teams and are not independently audited.
Corrections
If you find an error, contact the editorial team. Corrections are logged and the record shows the last updated date.
Limitations
The platform is a research tool. It does not provide legal or security advice for a specific system and records may lag primary publications by a few days.