Methodology

How the Brief works

Every morning the Brief reads public security sources, keeps only what matters to people who run industrial sites, ranks it, and explains each story in plain words: what happened, who is affected, what to do, and how soon. Every story links to its original source.

The workflow

1. CollectPublic feeds from national CERTs, government agencies, equipment makers, OT specialists and the security press.Code
2. Check the factsRepeats removed. CVE numbers matched against CISA's list of flaws known to be exploited and their exploitation score looked up.Code
3. JudgeIs it about industrial systems, how serious is it and when should a site act, with the sentence from the source that shows it.AI, checked by code
4. Choose and rankUp to ten stories a day, most serious first.Code, by fixed rules
5. WriteEach story in three plain lines, using only what the source says, plus the editor's reading.AI, checked by code
6. PublishBy email every morning and on this site. On a quiet day, a short note says so.Code

The rule behind it all: AI judges, and must show its evidence; code checks it. The AI judges severity and when to act the way an experienced OT security lead would, and quotes the sentence from the source behind its call. Code checks that sentence is really there, holds fixed minimums the AI cannot argue down, and decides selection and ranking by fixed rules.

What the Brief covers

Security news about operational technology (OT) and industrial control systems: the computers that run physical processes in energy, water, manufacturing, oil and gas, chemicals, transport, buildings, food and other industries. That means vendor and government advisories, flaws being exploited, incidents at operators, threat groups and OT-capable malware, regulation, and research that changes how plants are defended. A flaw in a VPN or remote-access product counts too: it is often the path into a plant.

Sources

Public feeds only, from government agencies and CERTs, equipment makers, OT specialists, threat-intelligence teams and the security press. Nothing is scraped, and every story credits and links its source. The full list

Severity

How bad a story is, on four levels. Hard evidence always counts: a flaw CISA lists as exploited, or a CVSS score of 9.0 or more stated by the source, makes a product flaw critical.

Critical

Exploited against industrial systems, or an incident that disrupted a physical process.

High

A confirmed intrusion at an operator, new OT-capable malware, or an active campaign.

Medium

A lower-rated OT flaw, an incident with no stated impact, or significant guidance or regulation.

Low

Vendor news, opinion, events and minor updates.

When the source says too little to decide, the lower level is chosen: the Brief would rather understate than alarm.

Selection and ranking

Stories rated medium or above appear, up to ten a day, most serious first. A vulnerability advisory makes the main list only when it is serious: known to be exploited, highly scored, or likely to be exploited soon. Other advisories are listed briefly under Also today.

When to act

Severity says how bad a story is. When to act says what your site should do about it. In a plant the fix usually waits for a maintenance window, so the question is: does this need me before the next shutdown?

The three labels

Act today

Check today whether you are exposed. If you are, put a compensating control in place now and patch at the first safe opportunity, through your normal change process, never by stopping a running process.

Plan ahead

Put the fix into the next maintenance window. If you are exposed, apply the compensating control now.

For awareness

News, research and guidance worth knowing. Nothing to patch; handle it in your normal cycle.

The AI makes the call (since 10 November 2026), after answering what a plant manager would ask: is it being exploited, what does it touch (the process, the controllers, remote access or office IT), what happened, how widely, and how strong is the source. In short: a flaw being used in real attacks, or an attack that disrupted operations or reached control systems, is Act today; a serious flaw not yet exploited, a confirmed intrusion, a new OT-capable campaign or a reported attack on an essential service is Plan ahead, and so is every other flaw in a product, because it has a fix to plan; news, research and guidance are For awareness. Code checks every call:

• Act today needs proof. The AI must quote the sentence from the source that shows it, and code checks the sentence is really there. A story resting on a headline alone is Plan ahead at most, marked Early reports.
• Minimums the AI cannot lower. A flaw on CISA's list of known exploited vulnerabilities is always Act today. A story judged critical, and any flaw in a product, is never just "For awareness".
• Checked before it changes. Any change to how the AI judges is first run against a set of past stories with the labels an editor would give.

The labels are modelled on CISA's decision method for vulnerabilities (SSVC) and the Now, Next, Never approach to ICS patching (Act today, Plan ahead and For awareness are the Brief's plain words for them). They are a starting point: a "For awareness" story about the only controller on a safety-critical line may deserve Plan ahead at your site.

The editor's reading

Below the facts, each story has a grey block marked the editor's reading, inferred from the facts rather than stated by the source: who should pick it up first, where in the plant network it sits (the Purdue level), how to check whether you are exposed, what to do until you can patch, what to watch for, and the MITRE ATT&CK for ICS techniques. Check every line against the vendor's advisory before changing anything.

Reports and tools

Dashboard

How the news is moving over 7, 30 or 90 days: how much, how serious, where in the plant and how soon to act, counted by code from the published stories.

Executive report

A one-page report for leaders for any day, week or month, ready to save as a PDF. Its summary is written by AI from the published stories only, and code removes any line it cannot match to them. For subscribers.

Blog

A weekly analysis or guide on the theme that mattered most, and a monthly look at the patterns, written by AI from the Brief's stories and checked by code; every post says so.

My site

On the front page, list the vendors and products you run, and stories that name one of them are marked Your site. A match means the story names something you run, not that you are exposed. The list stays in your browser.

Watchlist

Check a whole asset list, with versions, against every story the Brief has published: each match is marked Affected, Not affected or Check. The list is matched in your browser and never uploaded. For subscribers.

Before-the-patch worksheet

One printable page per story to record exposure, the compensating control, detection and the patch plan.

Where AI is used

AI (Anthropic's Claude) reads each item to judge whether it is about industrial systems, how serious it is and when a site should act, and writes the stories and summaries. Code does everything else: collecting the feeds, the fact lookups, selection and ranking. Code also checks what the AI decides and writes: it checks the quoted evidence, raises severity and the when-to-act label on hard evidence and never lowers them, and drops any line with a number, CVE or story the sources do not support.

Standards and corrections

• Only what the source says. Stories never add facts, numbers, victims or CVE ids the source did not state.
• Scores are quoted, never estimated. A CVSS score comes from the source, or from the US National Vulnerability Database, marked (NVD).
• A person is responsible. The editor reads the briefings after they go out, and a mistake is corrected on the story itself, marked Correction. Report an error
• Independent. No sponsors, no advertising, no paid placement.
• Not advice. A starting point, not a substitute for vendor advisories or your own risk assessment. Disclaimer

Privacy

This site sets no cookies and runs no advertising. It counts visits with Cloudflare Web Analytics, which does not identify visitors. If you subscribe, your email address is held by the email delivery service only to send you the Brief, and you can leave with one click from any briefing. The full privacy statement