How we research, score, and report

Continuous ingestion. Every hour we pull the Cyber category from our curated Miniflux feed list plus the r/cybersecurity hot feed. Each article is ingested exactly once (a watermark tracks what we have already seen), and non-English articles are detected and translated.

Stories, not articles. New articles are merged into stories by matching their URL, the CVE they name, or their title against what we already cover. A story is one incident: the original reporting, then updates from other outlets as they land.

The timeline is the story. The original article appears in full. Each update shows only what is new — sentences that add information the story did not already have. Reports that merely restate known facts collapse to a bare mention (source, date, link).

Analysis where it matters. Every story that crosses into hot gets a written desk review: what the story is, why it matters, what to watch. When reporting that predates our coverage turns up later — the vendor advisory, the researcher's disclosure, early exploitation telemetry — it is added to the story's timeline at its original date, labeled as backfill, so the history reads honestly instead of starting at the moment we noticed. The daily brief at 07:15 EDT summarizes the day's landscape.

Six factors, one formula. Every story is scored 0–10 from explicit factors, and the story page shows the breakdown (open "Why this score"):

Severity (0–5, the dominant axis): the real CVSS base score of the CVE(s) involved, plus KEV/active-exploitation status, content signals (zero-day, ransomware, OT/ICS, APT, breach scale), and the EPSS exploitation probability from FIRST's daily model (a CVE the model expects to be exploited any day now outranks its CVSS alone). Breadth (0–2): how many distinct outlets cover the story — deliberately capped low, because repetition is weak evidence of significance. Authority (0–2): the weight of the best outlet covering it. Velocity (0–2): updates in the last 48 hours. Pickup speed (0–0.6): how quickly the second source arrived after the first. Recency: a temporal multiplier that decays with a 36-hour half-life. Community (+0–1.5): reddit presence.

The formula: score = (breadth + authority + severity + velocity + pickup) × recency + community, capped at 10.0. Bands: 0–3.2 new, 3.3–4.9 warm, 5.0–7.4 hot, 7.5+ hottest. The hot ranking re-computes every hour, so a story cools off naturally as it ages — and a story is hot because it is significant, not just because it is new and covered by several outlets.

Three feeds. Every article (the raw event stream), hot stories (score ≥ 5.0), and the daily brief (one item per digest page).

The daily brief at 07:15 EDT: an emoji headline, a one-to-two-sentence executive summary, the analyst's landscape analysis, and the stories it covers — each linking to its full timeline.

Corrections and limits. Story clustering is deterministic and can over- or under-merge at the edges; scores are a ranking signal, not a verdict. When we change methodology, this page changes; the archive never does.