Methodology

How we compile this brief

An honest look at where the signal comes from, how we filter it, and what we mean by the words we use.

What you're reading

Risk Letters is a daily editorial brief — not an aggregator, not a feed. Each cycle, an automated pipeline ingests roughly six upstream sources, correlates them against open-source intelligence, and produces a structured read. A language model then writes the prose layer in a single voice — the one you're reading now — and an editorial critic scores the output across ten axes before it ships.

The brief is addressed to a single CISO reader. Everything you see is filtered against your stack, sector, region, and compliance frameworks. If nothing in today's signal intersects your profile, the brief tells you so plainly — quiet days are good days.

Pipeline

Collect — at 05:00 CET we ingest NVD, CISA KEV, EPSS, AlienVault OTX, abuse.ch (Feodo + ThreatFox), and MITRE ATT&CK. A handful of OSINT feeds enrich the picture.
Correlate — items that match across feeds (a CVE rising on EPSS + appearing in a KEV update + mentioned in an OTX pulse) get promoted. Solo signals are demoted.
Compose — the structured brief is generated section-by-section with explicit voice and tier-framing rules.
Personalise — your profile (stack / sector / region / frameworks) scopes the appendix and tunes the advisor recommendations.

The advisor's stance

We write as a personal CISO mentor, not as a vendor. Recommendations carry an explicit confidence tag:

high — directional certainty ≥ 75%. Act on it.
moderate — 50 to 75%. Plan for it; verify before acting irreversibly.
watch — under 50%, but emerging. Track, don't yet escalate.

Source citations appear inline as superscript markers and resolve to a per-recommendation source list. Every material claim ships with a link to its origin.

What we use about you (and what we don't)

Personalisation reads four fields from your member profile: stack keywords, sector, region, compliance frameworks. Nothing else. We do not access your email content, your inbox, or any system outside Risk Letters itself.

Your profile is editable any time from your dashboard preferences.

Editorial integrity

On a normal cycle, the voice is lightly intellectual — an analogy or a dry observation has a place when it earns one. On a crisis cycle — three or more KEV additions, multiple CVSS 10.0 vulnerabilities, or a confirmed attribution with sector overlap — the voice dials down automatically. No wit; only signal.

The brief is signed The Editor. There is no single person behind the name; it is an editorial position, applied consistently.