The small print, in plain words

Terms, privacy and disclaimer

Industrial Cyber Brief is an independent, personal publication, provided without charge. This page says what you can expect from it and what it asks of you. Last updated 20 October 2026.

Terms of use

Who publishes it. Industrial Cyber Brief is published under the name Girder as a personal, non-commercial project, run in personal time. It carries no advertising, sponsorship or paid placement; nothing is sold through it and no services are offered through it. It is not connected to, reviewed by, or speaking for any employer, and it uses only the public sources listed on the Sources page. It is not affiliated with, sponsored by, reviewed by or speaking for any employer, vendor, agency or other organisation, including those whose products or advisories it reports on.

What you may do. Read it, share links to it, quote it with attribution ("Industrial Cyber Brief" and a link), and forward the email. You may not republish whole briefings or the site's content as your own, sell it, or use it to train or evaluate automated systems without written permission.

What it is. Each story is a short summary, in the Brief's own words, of a report published elsewhere. The summary describes only what that report says; the source is named and linked on every story. The Brief does not reproduce the sources' text.

Changes. The Brief may change, pause or stop at any time. These terms may change; the date at the top shows the current version.

Disclaimer: no warranty, not advice

The Brief is provided as is, for general information, without warranty of any kind: no promise that it is complete, accurate, current or fit for a particular purpose. It can miss stories, and a summary can be wrong; when one is, it is corrected (see below).

It is not security, engineering, legal or professional advice. Severity ratings, the what to do line and the editor's reading (Purdue level, compensating controls, what to watch for, ATT&CK for ICS techniques) are generalisations about a product or a kind of attack. They are produced with the help of a language model, under rules set and reviewed by the editor, and they cannot know your site, your configuration, your safety case or your regulatory obligations. Check every item against the vendor's own advisory and your own risk assessment before changing anything, and never alter a running process, a safety system or a controller on the strength of a Brief line alone.

To the fullest extent the law allows, the editor is not liable for any loss, damage or disruption arising from reading, relying on or acting on the Brief, or from being unable to access it.

Links. Linked sites belong to their owners; the Brief has no control over them and does not endorse them.

Privacy

The website sets no cookies and shows no advertising. It counts visits with Cloudflare Web Analytics, which loads one script from Cloudflare. Cloudflare states that this uses no cookies or local storage and does not fingerprint visitors by IP address, browser or any other data; the editor sees totals only (pages viewed, referring sites, countries), never individual visitors. Nothing else is loaded from outside this site: no fonts, images or other scripts. The site is served by Cloudflare Pages, which, like any host, processes the technical details of each request (such as your IP address) to deliver the page and to protect the service.

The email is sent through an email delivery service that holds the subscriber list on the editor's behalf. Your address is used only to send the Brief: you confirm by email when you sign up (double opt-in), every briefing has a one-click unsubscribe, and open and click tracking are turned off. The editor can see the list, and no one else is given it. Unsubscribing removes your address.

Downloads and the watchlist. Using the watchlist, saving the executive report or a worksheet as PDF, and the watchlist's CSV, are for subscribers: the site first asks for your email address and, only if you choose to give them, your role and sector, which go to the same list to help the Brief understand its readers. Once you have signed up, this browser keeps a note that you have (in its local storage, not a cookie, and never sent anywhere), so the watchlist and downloads open straight away.

Sharing. The share buttons are plain links to the networks' own share pages; nothing is loaded from those networks until you choose one, and what happens after that is governed by that network's own policy.

Your rights. To see, correct or delete what the Brief holds about you (which is at most your email address, the date you subscribed, and the role and sector if you gave them), unsubscribe with the link in any briefing, which removes your address from the list.

Trademarks and attribution

Product, company and agency names appearing in the Brief (for example Siemens, Rockwell Automation, Schneider Electric, CISA, Microsoft) are the trademarks of their respective owners. They are used only to identify the products and organisations the reported stories concern, which is nominative use; it implies no affiliation, sponsorship or endorsement.

MITRE ATT&CK^® and ATT&CK^® are registered trademarks of The MITRE Corporation. The technique ids and names shown in the editor's reading are reproduced from ATT&CK for ICS under MITRE's terms of use: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. The Brief is not affiliated with or endorsed by MITRE.

Severity uses the CVSS scores the sources state (CVSS is maintained by FIRST.org) and CISA's Known Exploited Vulnerabilities catalogue, which is public-domain US government data. The Purdue reference model is a widely used description of industrial network architecture, named after Purdue University.

The Brief's own name, logo and design, the summaries and the editor's reading are © Girder. The site's typefaces are open-source fonts bundled under their own licences (Inter, JetBrains Mono, SIL Open Font License).

Corrections, takedowns and contact

Corrections are made the same day and shown on the story itself, marked Correction, with the archive copy updated.

To report an error, ask for a takedown or get in touch, email contact@girder.in. Name the story (its link is best) and what is wrong; a source that shows it helps. Messages are read every day.