Sourcing Standards

Effective October 11, 2026

Primary documents come first: company notifications, regulator filings, government catalogs, vendor advisories, and standards bodies.

Fast monitoring, slower confirmation

The alert desk monitors rapid sources including CISA KEV, BleepingComputer, The Hacker News, The Record, Krebs on Security, DataBreaches.net, NVD, FIRST EPSS, GreyNoise, Vulners, SecurityWeek, and CyberScoop. These sources surface leads; they do not all carry the same evidentiary weight. See the ranked How we verify for each source's role and caveats.

A threat-actor post, aggregator entry, risk score, or prediction is never treated as proof of a breach or active exploitation. Claims are checked against the victim's notice, a regulator filing, a vendor advisory, CISA KEV, or another primary record before publication.

Breach sources

Company notices, SEC cyber-incident filings, health-sector breach records, and state attorney-general notices can establish what an organization has disclosed. News reports are used when they reproduce or link to that evidence and explain what remains unknown.

Vulnerability sources

CISA's Known Exploited Vulnerabilities catalog establishes that exploitation has been observed. Vendor advisories establish affected versions and fixes. Risk scores and probability models provide context; they are not treated as proof of active exploitation.

Revenue boundary

Advertising is kept separate from editorial decisions. If Red Flag Cyber later uses affiliate links, they are limited to password managers and VPN services and are labeled next to the link. A commercial relationship never changes a confidence label or source requirement.