Policy

Editorial & Independence Policy

How we keep what we publish separate from who pays us, and the rules our editorial work follows.

Version 1.3 · Last updated 25 October 2026

1. Why this policy exists

Part of CSA's income will come from cybersecurity providers — through membership fees, referral fees and, if we offer it, sponsorship — and some of those providers will appear in what we publish. The membership fee buys verification, a listing and the member mark; it buys no enquiry, no coverage and no conclusion. Every member pays the same membership fee and the same referral rate, so there is no larger-paying member for us to favour and nothing for a member to negotiate. Readers are entitled to know that money does not buy our conclusions, and to be able to check that for themselves. This policy sets out how.

2. Our position

CSA is a privately operated, independent industry platform, operated by bodhi.style s.r.o., a company registered in the Czech Republic. We are not part of, endorsed by or affiliated with the South African Government, a regulator, a law-enforcement agency or any public authority, unless a specific collaboration is expressly stated. We are not an association or professional body. We do not sell security products, and we do not carry out security work ourselves.

3. Where our money comes from

• Provider membership. Cybersecurity firms pay a fee to be admitted and reviewed under our Provider Membership Standard.
• Referral fees. When we pass a business's enquiry to a member firm and work goes ahead, the member firm pays us a percentage. The business pays us nothing.
• Sponsorship. We do not currently offer sponsorship. If we do in future, this policy will say so and the rules in section 12 will apply.
• Reader subscriptions, in the future, for editorial content. At launch, all of our content is free.

4. What money cannot buy

No payment, membership or relationship buys: coverage, or the absence of it; a favourable or unfavourable framing, headline or assessment; the priority of a Radar item, or its removal; a place among the firms that receive an enquiry — the selection rules are in the Membership Standard; an interview, or the questions asked in it.

When a member firm is itself affected by a security event, we report it in the same way as we would for any other organisation.

5. How we disclose relationships

• Whenever we pass a business's enquiry to member firms, we tell the business that the firm pays us and it does not.
• Where an interview or article features a person or organisation with which we have a membership, sponsorship or other commercial relationship, a disclosure appears at the start of the piece.
• We publish the list of current member firms.
• Member logos appear only in the member section and in the footer — never next to the Radar, an interview or an article.

6. Editorial accountability

• Every article, interview and briefing names the person accountable for it — our Editorial Owner, or the editor who signed that piece off. The name appears on the piece itself, so that it is always current.
• The Fortnightly Intelligence Brief names its editorial owner in every issue. An issue is not sent until a named person has reviewed it and signed it off; where an issue contains AI-generated text, that text is labelled.
• A draft produced by our systems carries the label "Unreviewed draft" and is not a CSA position until a named person has reviewed it and signed it off.

7. Fact, assessment and legal context

We keep three things apart and label each one: the reported fact, as it appears in the source; our assessment, marked as model inference where it was generated automatically; and the legal and compliance context under POPIA or the Cybercrimes Act, which is general information and not legal advice. Where a report concerns alleged wrongdoing, we present it as an allegation, not as an established fact, and our assessment never attributes fault to a named organisation or person beyond what the source reports.

8. Automation and AI

The Radar uses an AI system built on a large language model to summarise, classify and prioritise public reports. We say so on every item: every item is labelled Automated — generated by the AI system from the linked report — and each carries a confidence band describing how well the reported fact is sourced. We do not read the Radar item by item before publication, and the label says so for all of them. Radar items are published as automated summaries with a link to the source, under CSA's responsibility as publisher; they are not presented as human analysis. We provide this transparency under Article 50 of the EU Artificial Intelligence Act.

Content that needs particular care. Some items carry more risk than others: an item that would name a natural person in connection with alleged unlawful, negligent or otherwise harmful conduct; identify a private individual as the victim of a crime or breach; contain special categories of personal data or data about criminal offences relating to an identifiable person; concern a CSA Member Company, a sponsor or any organisation with which we have a declared interest; or make a claim which, if wrong, could seriously harm an identified person or organisation. At present such items are published automatically, like every other item, with the Automated label. They are checked by our Editorial Owner after publication, and anyone named in an item can ask us to correct, anonymise or withdraw it — we assess such requests within five business days (Complaints & Corrections Policy). We are building a step that holds these items back until a person has reviewed them; this policy will say so when it is in place.

Two rules are built into our systems rather than left to judgement. An item whose content would have had to be guessed from its headline alone is never published. And when the Radar cannot load live data, the site says so — it never fills the gap with invented examples.

The detail is in our Radar Methodology; the rules our team follows are in our internal AI & Editorial Governance document, which we summarise on request.

9. Sources

• We name and link to the original source of every Radar item and of every fact we cite.
• We prefer primary sources: advisories, regulators, and statements by the organisations affected.
• We respect publishers' rights and access controls. We fetch full text only where the publisher's terms and technical signals permit it; we do not get round paywalls or bot protection; and we publish our own summaries, not the publishers' text.
• Vendor marketing and general business news are kept off the Radar.

10. Naming organisations and people

• Radar items name organisations and people only as the underlying report does, and always link to it.
• We ordinarily name people only in a public or professional role — a spokesperson, researcher, executive or author. Private victims and suspects are not named merely because a source names them; section 8 applies.
• We do not publish scores, ratings or rankings of named organisations or people. Publicly, we show sector-level figures only.
• Our internal research tools are for our own use. They are not published, and we will not make them available to subscribers or anyone else.
• An organisation or person named in what we publish can dispute its accuracy, object to being named and ask for a response to be considered — see our Complaints & Corrections Policy. We assess such requests within five business days.

11. Interviews and contributed expertise

• We name the interviewee, their role and organisation, and disclose any relationship we have with them.
• Interviewees may check their quotes for factual accuracy. They do not approve headlines, framing or our assessment.
• We do not accept payment for interviews, and we do not pay for them. Interviews and contributions are given under our Interview & Contributor Terms.
• Member firms may contribute expertise. Their contributions meet the same editorial standards and carry a disclosure.

12. Sponsored content

If we ever publish material that someone has paid for, it is labelled "Sponsored" at the top, is never presented as Radar intelligence, as an interview or as our editorial analysis, and the sponsor has no influence over any other content. Sponsorship is governed by a written agreement that says so.

13. Conflicts of interest

People who write for, edit or make membership decisions at CSA declare any financial interest in, or other relationship with, a provider or organisation they cover or decide on, and step aside from decisions where that interest could matter. We keep a register of declared interests, maintained by a Reviewing Director (a member of our management not involved in the decision concerned) and reviewed annually; a summary of relevant interests is disclosed on the piece concerned.

14. Corrections

When we get something wrong, we correct it visibly and with a date. We do not silently change the substance of what we have published. How to report an error, and how corrections appear, is set out in our Complaints & Corrections Policy.

We subscribe to the Press Code of Ethics and Conduct of the Press Council of South Africa and apply it to our editorial work.

15. What stays free

When a paid subscription is introduced, the following will stay free to read: safety guidance; corrections; disclosures of member and commercial relationships; this policy and our other policies; and anything we have promised as free in an e-mail or campaign.

16. Review of this policy

This policy is reviewed at least once a year by a Reviewing Director, and after any material change to our funding, membership, sponsorship, editorial workflow or use of AI. Changes are published here with a new date; earlier versions are available on request.