About
Grayfox helps IT managers, CISOs and other decision makers keep an overview: what the national cyber security agencies have published, and what security media and vendors' research teams report, short enough to read between two meetings, with the original one click away.
How a brief is written
A brief is written by a language model from the text of one publication, following the conventions of intelligence writing: the bottom line first, only what the source states, the source's own level of certainty, assessments attributed to whoever made them, plain words.
Before a brief is shown it is checked automatically. It is rejected if it is longer than 120 words (60 for a vulnerability), contains a link or markup, or names a CVE id, version, date or number that is not in the source. A rejected brief is not shown; the item is then listed by its title and link only.
A few publications are picked by hand from publishers whose feeds we do not read. Their briefs are written by a language model too, from the whole document, and are held to the same limits.
No person reviews the briefs. They can be wrong or leave out what matters to you. A brief is a pointer to the original, not a replacement for it.
Sources
| Source | What we read | Terms |
|---|---|---|
| CISA | Known Exploited Vulnerabilities catalogue | Creative Commons 0 1.0 (public domain dedication), as stated by CISA for the KEV catalogue |
| BSI (DE) | Warning feed (bulletins) | Bundesamt für Sicherheit in der Informationstechnik; terms not yet verified by us |
| CERT Polska | Warning feed (bulletins) | CERT Polska (NASK); terms not yet verified by us |
| CERT-EU | Advisory feed (bulletins) | Cybersecurity Service for the Union institutions, bodies, offices and agencies; terms not yet verified by us |
| CERT-SE | Advisory feed (bulletins) | CERT-SE, Sweden; terms not yet verified by us |
| CISA | Advisory feed (bulletins) | U.S. Government work; joint advisories are often co-authored by NSA, FBI and partner agencies |
| CISA | Alert feed (bulletins) | U.S. Government work |
| MAS (SG) | Guidelines we have picked by hand | Monetary Authority of Singapore; © Government of Singapore; our own words and a link only; terms not yet verified by us |
| NCSC (UK) | Guidance feed (bulletins) | Crown copyright; terms not yet verified by us |
| NCSC (UK) | News feed (bulletins) | Crown copyright; terms not yet verified by us |
| NSM (NO) | Warning feed (bulletins) | Nasjonal sikkerhetsmyndighet; terms not yet verified by us |
| SAMSIK (DK) | News feed (bulletins) | Styrelsen for Samfundssikkerhed (formerly CFCS); terms not yet verified by us |
| Cisco Talos | Research feed (news) | Security vendor; our own words and a link only; terms not yet verified by us |
| CrowdStrike | Blog feed (news) | Security vendor; headline and link only (the feed carries no text); terms not yet verified by us |
| Google Threat Intelligence | Research feed (news) | Vendor; our own words and a link only; terms not yet verified by us |
| Krebs on Security | News feed (news) | Independent journalist; our own words and a link only; terms not yet verified by us |
| Microsoft Security | Blog feed (news) | Vendor; our own words and a link only; terms not yet verified by us |
| The Hacker News | News feed (news) | Commercial publisher; our own words and a link only; terms not yet verified by us |
| Unit 42 (Palo Alto Networks) | Research feed (news) | Security vendor; headline and link only where the feed has no more; terms not yet verified by us |
| Zero Day Initiative | Research feed (news) | Trend Micro; our own words and a link only; terms not yet verified by us |
Bulletins come from public agencies. News comes from media and from security vendors, who are not authorities and may write about their own products; a news brief says who reports what, and is written only from the text the publisher puts in its feed. Where a feed has just a headline, the item is listed by headline and link.
Joint advisories by NSA, FBI and partner agencies reach the site through CISA's advisory feed. CFCS, the Danish Centre for Cyber Security, is now part of SAMSIK. Grayfox is not affiliated with, or endorsed by, any of the publishers.
Privacy
The site has no user accounts, sets no cookies, stores nothing in your browser, and loads nothing from third parties: no analytics, no fonts, no advertising. The pages are served through Cloudflare, which processes your IP address to deliver them and to limit abuse; we keep no log of our own of who reads what.
Contact
Corrections and questions: aesk@grayfox.uk