Severity Daily covers security incidents and the IT and AI developments around them, written for people who run technology inside organizations. Four checks a day. Every story that clears the bar gets its own page. A recap goes up each night.
What gets published
A story runs if it meets any one of these:
- A named organization confirms a breach or incident. There is no requirement that you be able to act on it and no geographic filter.
- A government agency confirms an incident. The story is written from the confirmation, not from whatever a ransomware group has posted about it.
- High severity in widely deployed software, whether or not anyone is exploiting it yet. Getting ahead of it is the point.
- A CISA KEV addition or a federal remediation deadline.
- Vendor-confirmed active exploitation.
- Novel research with inspectable artifacts, including research from a single firm, published with that limitation stated.
- A significant AI platform, model, or agent security event.
What does not
An attacker’s leak-site listing with no samples, no data volume, and no confirmation from the named victim. A claim is not an incident.
How stories are sourced
Every story is checked against a primary source before it runs: a vendor security advisory, a CISA KEV entry, the organization’s own statement, an SEC filing, a court record, a state Attorney General breach notification. Another publication’s article is a lead, not a source.
Where the coverage and the primary source disagree, we say so on the page and show which is which. This happens more often than it should.
Four rules govern how uncertainty is written, and they are the whole point of the publication:
- Attacker claims are labeled as claims.
- Attribution is never stated as fact. “Researchers at X attribute this to Y,” never “Y did this.”
- Conflicting numbers are shown as conflicting rather than resolved by picking the one that reads best.
- Single-vendor research says so, along with the real scale of what was found.
Uncertainty is not a reason to withhold a story. It is a reason to write the story accurately.
Written with AI, reviewed by a human
Severity Daily is produced with AI assistance under human review. Research, primary-source verification, and drafting are performed by an AI system on a schedule. A person sets the editorial standards, reviews what it produces, and is accountable for everything that publishes.
This is stated here rather than left for someone to discover, and it is why the sourcing rules above are as specific as they are. An automated publication that cannot show its work is not worth reading.
Corrections
Errors are corrected in public with a timestamp, and logged. See the corrections page.