Most advice on vetting a cybersecurity reporter comes down to “check where they publish and whether they sound technical.” Neither tells you much. A reporter at a famous outlet can still turn a vendor’s guess into a headline. A freelancer with no security background can be the most careful person covering a breach.
There is no official industry scorecard for this, so this page offers a practical one. It has eight criteria and a description of strong and weak work for each. It also covers where to check a story against primary sources and how to adjust the weights depending on whether you’re hiring, building a media list, or deciding whether to trust something you just read. The cybersecurity journalist profile evaluation criteria below are meant to be used, not just read. A quick first-pass check is designed to take about five minutes.
The short version: a cybersecurity journalist’s profile holds up when their work shows accurate technical understanding, claims traced to primary evidence, honest handling of uncertainty and attribution, visible independence, sound judgment about harm, real corrections, a consistent record on the beat, and care with sources.
Who Actually Needs to Evaluate a Cybersecurity Journalist
Three situations, three different bars
An editor hiring or assigning wants to know whether someone can be trusted with a breaking story, a leaked dataset, or a confidential source. A PR or communications team is deciding who covers its topic fairly and whether a pitch is worth sending. This isn’t about finding someone who’ll go easy on you. A reader or researcher just wants to know how much weight a story deserves.
The criteria are the same for all three. What changes is which ones matter most, which is why the scoring section includes presets.
Journalist, researcher, or vendor blogger?
“Cybersecurity news” comes from several kinds of writers. Reporters do independent journalism and answer to readers and editors. Security researchers publish findings. Vendors publish threat reports. Newsletter writers can be any of the above.
A vendor threat report is a valuable primary source, but it isn’t independent reporting. A researcher can be excellent without being a journalist, and that’s fine. Just don’t score a company blog as if it were independent reporting, and don’t dismiss a researcher for not behaving like a newsroom.
There’s No Official Standard, So Here’s How This Scorecard Was Built
No professional body publishes a scoring system for cybersecurity reporters. What exists are two bodies of practice that rarely meet: journalism ethics and security-community norms.
On the journalism side, the Society of Professional Journalists’ Code of Ethics asks reporters to verify information and use original sources where possible. It also asks them to give subjects of serious allegations a chance to respond, to minimize harm, to act independently, and to be accountable. The SPJ describes the code as guiding principles, not enforceable rules. On the security side, the criteria draw on how practitioners separate vulnerability severity from real-world exploitation, and how they treat attribution as a judgment with varying confidence.
This scorecard combines the two. The weights are editorial judgment, not an industry standard, so adjust them to your purpose.
The Criteria at a Glance
| # | Criterion | The question it answers | Where to look | Default weight |
| 1 | Technical accuracy and term discipline | Do the technical distinctions survive in print? | Advisories, vendor notices, the story itself | 15 |
| 2 | Sourcing and evidence quality | Can the central claims be traced to original evidence? | Links, filings, named sources | 20 |
| 3 | Attribution and uncertainty | Is the confidence level honest? | Wording around “who did it” | 15 |
| 4 | Independence and disclosure | Are commercial ties visible? | Sponsored labels, disclosures, source patterns | 15 |
| 5 | Judgment on vulnerabilities, leaks, and victim data | Does publication show restraint where it matters? | Level of technical detail, treatment of personal data | 10 |
| 6 | Corrections and updates | Is the record fixed in the open? | Update notes, correction policy | 10 |
| 7 | Track record and beat fit | Is the work consistent over time? | 10 to 15 recent pieces | 10 |
| 8 | Source protection and tip handling | Are sources treated carefully? | Contact options, handling of leaked material | 5 |
| Total | 100 |
The Eight Criteria in Detail
1. Technical accuracy and term discipline
This is about whether distinctions survive a deadline, not jargon. A reporter doesn’t need to reverse-engineer malware. They need to read technical research, question it, and translate it without changing its meaning.
Look for the pairs that get blurred most often:
| Often confused | The difference |
| Vulnerability vs. exploit | A flaw vs. the code or technique that takes advantage of it |
| CVE vs. “being exploited” | A CVE ID only identifies a publicly known flaw. CISA’s Known Exploited Vulnerabilities catalog lists those with evidence of active exploitation. |
| High severity vs. likely to be attacked | CVSS rates technical severity from 0 to 10. EPSS, from FIRST, estimates the probability of exploitation in the next 30 days. They answer different questions. |
| Incident vs. breach | An incident is anything that threatens or disrupts systems. A breach usually means unauthorized access to data. Legal definitions vary, so check whether the reporter established the facts or borrowed the company’s word. |
| Claimed vs. confirmed | An attacker’s boast or leak-site post vs. confirmation from the victim or an independent analysis |
| Deep web vs. dark web | Content search engines don’t index (logins, paywalls) vs. hidden services reached through networks like Tor |
Strong coverage also tells you which products and versions are affected, whether a patch exists, what an attacker needs (authentication, internet exposure), and whether the harm is demonstrated or theoretical.
Degrees, certifications, and past IT jobs are supporting evidence. They don’t replace published work that gets the details right. GRC in South Africa: Governance, Risk & Compliance
2. Sourcing and evidence quality
Count independent sources, not names. Three outlets quoting one vendor blog is one source repeated three times.
Most sources in this field have a stake, so the useful question is what each can credibly prove:
| Source | Can credibly tell you | Watch for |
| Affected company | What it has confirmed, what customers were told, remediation steps | Minimized scope, carefully lawyered wording |
| Attacker or leak-site post | What the group says it holds | Exaggeration, pressure tactics, samples presented as proof of everything |
| Security vendor | Technical detail, telemetry from its own customers | Publicity for its own product, limited visibility |
| Independent researcher | The mechanics of a finding | A wish for credit, little view of real-world impact |
| Government agency | Advisories, indictments, formal attribution | Strategic timing, a classified basis that can’t be shown |
| Anonymous source | Depends on direct access | Motive, lack of corroboration |
None of these should be dismissed outright. Good reporting names what each source can and can’t establish. Anonymous sourcing isn’t automatically weak either. The question is whether the story explains the source’s position and access without exposing them, and whether the key claims were corroborated elsewhere.
3. Attribution and uncertainty
Naming who is behind an attack is one of the easiest places to spot a careless reporter. Different security companies use different data and methods, so they give overlapping activities different names, and they don’t always agree on where one group ends and another begins. Overlapping techniques alone don’t prove two incidents share an author.
A simple ladder helps you read attribution language:
| Wording | What it usually means |
| “Claimed by…” | A group says it did it |
| “Linked to…” / “overlaps with…” | Researchers see shared infrastructure, code, or behavior, but don’t conclude |
| “Assessed with moderate or high confidence…” | Analysts or an agency give a judgment and state how sure they are |
| “Officially attributed…” | A government formally names an actor, which is still that government’s finding |
Check whether the headline climbs higher than the evidence. Also check whether the story says who is making the attribution and whether other assessments exist.
4. Independence and disclosure
Cybersecurity journalism sits close to a commercial ecosystem. Vendors sponsor events, fund research, employ many of the best-known experts, and pitch reporters constantly. None of that is disqualifying. Quoting vendor experts is often unavoidable, since much of the expertise sits there.
What you’re checking is distance. Are sponsored pieces labeled? Are affiliate or financial relationships disclosed? Does one company get favorable treatment without explanation? Does the coverage read as reporting, or as a vendor announcement with a byline? Concealed paid coverage and undisclosed material conflicts should cost a lot. Ordinary reliance on industry sources shouldn’t.
5. Judgment on vulnerabilities, leaks, and victim data
Cyber reporters regularly handle information that is both newsworthy and dangerous. There’s no clean rule here, so you’re evaluating judgment.
Vulnerabilities. Coordinated disclosure means an affected vendor gets time to prepare a fix before technical details go public. A reporter isn’t bound by a vendor’s schedule, and publishing before a patch isn’t automatically wrong. Looking for evidence the reporter weighed whether a fix or mitigation exists, how exploitable the flaw is, how much technical detail readers need, and the public interest. [Internal link: responsible disclosure explained]
Leaked and hacked data. Raw hacked datasets can carry personal information that would be inappropriate or dangerous to publish, along with legal, privacy, and accuracy risks. Strong reporters verify the material, assess its public-interest value, and redact. Weaker ones reproduce names, credentials, or identity documents because they were in the dump.
Ransomware coverage. Naming a victim and reproducing stolen records are different acts. Watch for whether the reporter treats a leak-site post as a claim and keeps employee and customer data out of the story.
Don’t penalize a reporter just because a company wanted something held back. The SPJ code asks for a balance between the public’s need for information and potential harm, which takes judgment in each case.
6. Corrections and updates
Cybersecurity stories change after publication. A company denies a breach and later confirms it. A record count turns out to include duplicates. A researcher revises an attribution.
So the useful signal isn’t whether a correction exists, but how it’s handled. Look for dated updates, clear correction notes, and plain statements of what’s still unknown. Quiet edits with no note are a worse sign than a visible correction. Check the outlet’s corrections policy as well as the individual’s habits.
7. Track record and beat fit
Judge the body of work, not the masthead. A respected outlet still publishes weak stories, and a small one can do excellent work.
Sample different story types, because each tests something different: a breaking incident, a vulnerability, a ransomware story, a threat-actor investigation, and a data leak. Then look at what happens after the headline. Does the reporter follow up as facts change? Do they explain why a vulnerability matters to actual users rather than just repeating a severity number? Do they separate what’s known from what’s disputed?
Also notice whether security is their regular beat or whether they appear only during big events. Both can be fine, but the second needs more checking.
8. Source protection and tip handling
Cyber reporters can be targets themselves, because their communications may hold unpublished research and the identities of people who’d face retaliation. Most of this practice is invisible from outside, so it carries the lowest default weight.
You can still look for public signals: a secure way to send tips, careful handling of leaked material, and no source-identifying detail in published pieces. Don’t treat any one tool as proof. Listing an encrypted messaging app in a bio shows nothing about practice. And don’t penalize a freelancer for lacking something like SecureDrop. It’s an open-source system from the Freedom of the Press Foundation, and the foundation’s own digital security director has said it isn’t trivial to run. If you’re hiring, ask directly how the candidate thinks about threat modeling: what they’re protecting, from whom, and what happens if it fails.
Verify It Yourself: Where to Check a Story
You don’t need special access to test most claims. This table maps what a story asserts to where you can check it.
| The story says… | Check against |
| A new vulnerability exists | The vendor’s advisory and the CVE record |
| It’s being actively exploited | CISA’s Known Exploited Vulnerabilities catalog, plus vendor or researcher statements. Absence from the catalog doesn’t prove it isn’t being exploited, only that CISA hasn’t listed it. |
| It’s likely to be exploited | EPSS probability from FIRST, which is separate from severity |
| A company was breached | The company’s own statement, SEC filings for public companies, state attorney general breach lists, and the HHS portal for health data |
| A ransomware group hit a victim | The leak-site claim vs. whether the company confirmed it |
| A specific group or country did it | Who is attributing it (agency advisory, indictment, vendor report) and how confident they say they are |
| Millions of records were stolen | Who supplied the number, how it was verified, and whether samples or duplicates were checked |
US Context Worth Knowing
These are useful primary sources, and a few explain why some stories look the way they do. This isn’t legal advice.
SEC filings. Public companies must report a material cybersecurity incident on Form 8-K, Item 1.05, within four business days of determining it’s material. The clock starts at that determination, not at discovery, so a company can know about an intrusion for some time before a filing appears. Incidents not yet assessed or judged immaterial may be disclosed under a different item. The rule also allows a delay if the U.S. Attorney General determines disclosure would pose a substantial risk to national security or public safety. A filing is the company’s own account, useful for what it said and when. The absence of one doesn’t prove nothing happened.
State breach lists. Several states, including California, Maine, Texas, and Washington, publish breach notices filed with their attorneys general. Thresholds differ, so a missing entry means little on its own.
Health data. The Department of Health and Human Services runs a public portal of breaches of health information affecting 500 or more people.
Reporter protections. There’s no federal shield law protecting reporters from being compelled to reveal sources, and state protections vary. That’s another reason source handling matters: a promise of confidentiality is only as strong as the reporter’s practices.
How to Run the Evaluation
The five-minute check
- Read the byline and bio. Is this a real person with a visible history, and what do they actually cover?
- Pick one recent breach or vulnerability story and trace its central claim to a primary source.
- Compare the headline with the body. Does the headline claim more than the evidence supports?
- Look for update notes, corrections, and disclosures.
- If the story names a culprit, read the attribution wording against the ladder above.
Result: keep reading, look closer, or stop.
The full review
- Define the purpose. Hiring, media list, or reading? This sets the weighting preset.
- Sample about 10 to 15 recent pieces across story types. This is a working habit, not an industry rule. A senior hire or a major partnership deserves more.
- Map the source pattern. Note whether stories lean on vendors, officials, researchers, documents, anonymous sources, or other outlets.
- Verify several key claims yourself using the table above.
- Read the update history for corrections and silent changes.
- Score every candidate with the same rubric and record evidence for each rating.
An evidence log keeps you honest:
| Story | Claim checked | Primary source | Result | Notes |
| [title, date] | [central claim] | [advisory, filing, statement] | [matches / partial / contradicts] | [attribution wording, correction, disclosure] |
Scoring: Anchors, Weights, and Presets
What each rating means
Rate each criterion from 0 to 4: 0 is a serious problem, 1 is weak, 2 is acceptable with gaps, 3 is strong, and 4 is excellent. Then multiply: rating ÷ 4 × weight. A 3 on sourcing (weight 20) earns 15 points.
Anchors keep two evaluators from scoring the same work differently. Here they are for sourcing:
| Rating | What it looks like |
| 0 | Relies on one promotional or unnamed source and makes no attempt to verify |
| 1 | Mostly repeats one vendor or press release, with little independent confirmation |
| 2 | Several sources, but many trace back to the same origin, and few primary documents |
| 3 | Key claims tied to primary documents or direct sources, with source incentives noted |
| 4 | Consistently traces claims to original evidence, shows where sources disagree, and seeks a response from affected parties |
Write similar one-line anchors for the other seven criteria before you start, so your scoring stays consistent.
Weighting presets
| Criterion | Default | Hiring editor | PR / media list | Reader / researcher |
| Technical accuracy | 15 | 15 | 15 | 15 |
| Sourcing and evidence | 20 | 20 | 15 | 25 |
| Attribution and uncertainty | 15 | 10 | 10 | 20 |
| Independence and disclosure | 15 | 10 | 20 | 15 |
| Vulnerability, leak, and victim-data judgment | 10 | 15 | 5 | 5 |
| Corrections and updates | 10 | 10 | 10 | 10 |
| Track record and beat fit | 10 | 10 | 20 | 10 |
| Source protection | 5 | 10 | 5 | 0 |
| Total | 100 | 100 | 100 | 100 |
The shifts reflect what each person needs. Someone who’ll handle your newsroom’s sources and leaked data should be judged more heavily on harm and source handling. A communications team mostly needs to know who genuinely covers its topic and whether coverage will be independent. A reader can see sourcing and attribution directly, but can’t see how a reporter protects sources, so that criterion drops out.
Gate checks come first
Before scoring anything, check for fabrication, plagiarism, concealed paid coverage, or knowingly false attribution. Any of these ends the evaluation. A strong score elsewhere doesn’t offset them.
Reading the result
As rough bands: 85 to 100 is very strong, 70 to 84 is solid with identifiable gaps, 55 to 69 is mixed and needs oversight or independent checking, and below 55 is high risk. A score summarizes your evidence log. It doesn’t replace it.
Walkthrough: One Hypothetical Story
This is a made-up illustration, not a real story, outlet, or person.
Suppose a reporter publishes a story headlined “Ransomware group breaches regional hospital network, exposing 2 million patients” a few hours after the group lists the hospital on its leak site. The figure comes from the group’s post. Here’s how the review might go.
| Criterion | What the check finds | Rating |
| Sourcing | The story relies on the leak-site post and a vendor blog that repeats it. There’s no hospital statement and no note of an attempt to reach the hospital. | 1 |
| Attribution | The headline says the group did it. The body is more careful and says “claimed.” | 2 |
| Corrections | Two days later the hospital confirms a smaller number. The story is updated with a dated note explaining the change. | 3 |
One story isn’t a profile. The point is the habit of tracing a claim and reading the wording, which you’d repeat across 10 to 15 pieces. This particular mix, a headline that outran the evidence paired with a transparent fix, is what a “mixed but coachable” reporter looks like in practice.
Signals That Impress but Prove Little, and Signals That Get Unfairly Punished
Impressive, but weak evidence on their own: follower counts, conference appearances, a famous masthead, security certifications, a dense vocabulary of acronyms, and awards (check what the award was actually for). Certifications and credentials are supporting evidence at most.
Unfairly penalized: issuing corrections, publishing facts a company or vendor disliked, well-explained and corroborated anonymous sourcing, not being a former practitioner, quoting labeled vendor research, and not running a heavyweight tip system.
Special Cases
Freelancers and independent newsletters
With no editor in the loop, you’re the second pair of eyes. Give extra attention to sourcing, corrections, and sponsorship disclosure. Check how the writer is funded and whether that shows up in the coverage.
The AI era
First, confirm the person is real. Look for a byline history over time, linked profiles, and a reporting record that predates any recent burst of output. Second, don’t try to guess whether text was machine-written. Test whether its claims can be traced to sources. If they can’t, who or what wrote it doesn’t matter. Third, check whether a reporter authenticated leaked material, since forged documents are a growing problem for newsrooms.
If a story about your company gets it wrong
Contact the reporter and editor in writing, with specific errors and primary evidence. Separate factual mistakes from unfavorable framing, because only the first usually qualifies for correction. Follow the outlet’s corrections policy and keep a record. Demanding deletion tends to backfire, and a documented, specific request is more likely to get a fix.
FAQ
What are the 5 C’s of cyber security?
Change, compliance, cost, continuity, and coverage. In plain terms: adapt as threats evolve, follow the rules that apply to you, budget sensibly, keep operating during an attack, and protect everything that matters. It’s an informal business framework popularized by security vendors and consultants, not an official standard.
What are the 10 qualities of a good journalist?
No official list exists, so this is a practical one:
- Curiosity
- Accuracy
- Healthy skepticism
- Fairness
- Independence
- Clear writing
- Composure on deadline
- Ethical judgment
- Willingness to admit and fix mistakes
- Patience in building trustworthy sources
What qualities are needed to be a journalist?
Beyond writing well, the core is a habit of checking things before publishing and being straight with readers about what is and isn’t known. The SPJ Code of Ethics frames it as four commitments: seek truth, minimize harm, act independently, and be accountable.
What does a journalist need?
Reliable sources, time and editorial backing to verify claims, and a basic grasp of the subject they cover. Add legal and safety awareness and a way to protect sources. On a beat like cybersecurity, secure communication tools and enough technical literacy to question experts matter too.
What are the four C’s in journalism?
There’s no single official answer. One version names correctness, context, clarity, and communication. Another, from a former SPJ president, lists creativity, curiosity, commitment, and compassion. If you’re using this as a heading, say whose version it is.
Conclusion
The best cybersecurity journalist profile evaluation criteria test whether the work holds up, not whether a résumé looks impressive. A practical first step is to pick one journalist you already rely on, run the five-minute check on a recent story, and start an evidence log. Once you’ve traced a few claims yourself, the rest of the scorecard becomes much easier to use.
See More Informative Blogs On: Resovent.com
