TRANSPARENCY

Sources and methodology

Here is what the information on Cyber Pinger represents, where it comes from and what its labels can tell you.

Cybersecurity news

Our news feed collects headlines, publication dates, links and short excerpts from publisher RSS feeds:

The main feed includes up to 20 recent entries per source, sorted by publication date. Duplicate article URLs are removed after tracking parameters and fragments are stripped. Entries without a valid publication date, or dated more than five minutes into the future, are omitted. The homepage selects up to 25 entries with a target maximum of six per source, then fills remaining spaces if alternatives are limited. Selection is then ordered by publication date. This balances sources without treating article volume as importance. News data is configured to refresh on a 15-minute cache interval; a displayed page may contain an older snapshot, and source outages can delay updates. Excerpts can be truncated. Open the original article for its full context and any publisher corrections.

Reporting and official notices

Publisher entries are labelled News. CISA entries are labelled Official advisory and can be selected using the news filter. These labels identify the source type; a publisher feed may include analysis or commentary as well as reporting. CISA notices remain distinct from the separate CISA exploited vulnerability catalogue. An unavailable source is omitted while the others continue to load.

What “gaining coverage” means

This section groups related headlines published within the preceding 72 hours of the page snapshot. Only News entries are considered; official notices are excluded. A group must contain at least two different publishers. Grouping compares headline words, ignoring common words: at least three meaningful words must overlap and the overlap must cover at least half of the smaller headline word set.

Only one headline per publisher is included in each group. Groups with more publishers come first; publication date breaks ties. This is a rough measure of coverage breadth. It does not measure clicks, social shares or growth in attention over time. Automated grouping can miss related stories or join stories that are only loosely related.

Exploited vulnerabilities and CVSS

Vulnerability entries come from CISA's Known Exploited Vulnerabilities catalogue. Entries are ordered by date added. Catalogue inclusion indicates known exploitation; it is different from the severity of a vulnerability or the risk to a particular organisation. The searchable feed is capped at 2,500 entries.

“Check CVSS” requests scoring information from the National Vulnerability Database. Scores may be unavailable. Confirm affected products, versions and recommended action with official advisories.

Watchlists and priority labels

Watchlist matching uses text keywords. Your watchlist is saved in this browser and is not automatically synchronised across devices.

P1: a watchlist match where CISA reports known ransomware campaign use.
P2: a watchlist match, or known ransomware campaign use, without both conditions for P1.
P3: other catalogue entries.

These are review priorities, not CVSS scores or validated assessments of your environment. “No match” does not mean your technology is safe.

UK advisories

The Alert Centre also collects UK National Cyber Security Centre reports and advisories. These are separate from CISA's exploited vulnerability entries. The feed is configured for a 30-minute cache interval and can be unavailable.

Corrections and feedback

If a headline, excerpt or automated group is wrong, send us the page address and details. For an error in the original reporting, contact the original publisher as well.