Q&A Worst-of Cybersecurity Reporting

This live question-and-answer session follows a talk on poor cybersecurity reporting. The conversation opens with the Verizon breach report and whether its shared taxonomy holds up when organizations map their own threat data onto it. The speakers note that mismatched categories can blur meaning between the source data and the published findings, even though the report is still considered useful.

The discussion then turns to speed versus accuracy. Suggested safeguards include fact-checkers, reading claims back against the original sources, and keeping technical experts on speed dial who can quickly judge whether a story is overblown. The speakers argue that corrections should be treated as normal rather than shameful, and that publications often chase subscribers or time on page rather than raw clicks. Last-minute edits by editors or legal review can distort a technical point and make it sound vague.

For organizations, the advice is to avoid generic security buzzwords and instead publish specifics such as design details, white papers, and candid statements of what a product cannot do. Readers vetting a journalist are encouraged to look at past work and ethics rather than technical credentials, and PR teams should be pushed to connect reporters with the right engineers. The session closes with a brief look at reporting on stolen documents, where the bar is public interest and the decision is best made with editors.