Private, independent industry initiative. Not a government body.

How we stay transparent
Cybersecurity Association South Africa Find credible expertise

Methodology

Radar Methodology

Where the Radar's information comes from, how each item is triaged and labelled, what is published and what is not — and the limits you should know about.

Version 1.2 · Last updated 25 October 2026

1. What the Radar is

The Radar continuously reads public cybersecurity reporting and turns each report into a short briefing for South African business leaders. It is not a detection system: it knows only what has been reported publicly, and it does not predict attacks. Every item names its source and links to the original report.

Almost all of the work is done by an AI system: at present no published item has been checked by a person before publication, and every item says so. If we introduce human review, this methodology will say so.

2. Sources

The Radar reads eight feeds and checks them every hour: BleepingComputer; Dark Reading; The Hacker News; CISA cybersecurity advisories; MyBroadband (South Africa); ITWeb (South Africa); TechCentral (South Africa); GoLegal (South Africa).

For each report we fetch the full text only where the publisher makes it available and its terms and technical signals permit it. We respect publishers' rights and access controls and do not get round paywalls or bot protection. When only the feed's summary is available, the item is triaged from that summary and marked accordingly. We publish our own summaries, never the publisher's text beyond a short attributed quotation. Changes to the list of sources are recorded in the change log.

3. How an item is made

  1. Collection. New reports are collected from the feeds; reports we have already seen are skipped.
  2. Full text. The text of the report is fetched, where available (see Sources).
  3. Triage by an AI system. A large language model (Google Gemini, via its API) reads the report and drafts: what the report says; an assessment of why it matters for South African leadership; a recommended next step; the legal and compliance context under POPIA or the Cybercrimes Act; the sectors concerned; the link to South Africa, if there is one; the topic of the report; its priority; and how well its facts are sourced. This text is AI-generated; every item is labelled "Automated".
  4. Publication check. Rules in our database decide whether the item may appear on the public Radar (see What is published).

4. Priority: reading order, not severity

Priority tells a South African leader what to read first. It does not measure how serious an event is.

The website and the brief do not describe these bands with severity words such as "Critical" or "High risk".

5. What is published

An item appears on the public Radar only if all of the following are true: it is about security — a breach, intrusion, data leak, vulnerability or data-protection matter — or about operational resilience, in which case it must describe an actual disruption and state why it belongs on a cyber radar; it has Priority 1 or 2; and its content comes from the report itself. If the system would have had to guess what happened from the headline alone, the item stays in our archive and is never published.

General business news (results, tariffs, appointments, politics) and vendor marketing (product announcements, webinars, events) are left out, even when they concern critical infrastructure.

Items that need particular care. Items that name a person in connection with alleged wrongdoing, identify a private victim or concern a CSA Member Company are at present published automatically, like any other item. How we handle them, and how to ask for a correction, is set out in our Editorial & Independence Policy, section 8.

6. What the labels on an item mean

Three layers, kept apart. Reported fact — what the source report says happened. Assessment — our reading of what it means, marked "model inference" when it was generated automatically. Legal & compliance context — the possible implication under POPIA or the Cybercrimes Act; general and often conditional; not legal advice.

Confidence: how well the fact is sourced. Confidence describes the sourcing of the reported fact. It measures neither severity nor how sure we are of our assessment.

Band Value What it means
High 0.80–1.00 A primary or official source — a vendor advisory, a regulator, a statement by the affected organisation, a CVE record — with specific names, figures and dates.
Medium 0.50–0.79 Credible reporting with named sources that is not primary; details are incomplete or taken from elsewhere.
Low below 0.50 A single unconfirmed report, anonymous sources, attackers' claims, speculation, or an overview without findings of its own.

How it was checked. Automated means the text was generated by the AI system from the linked report. Every published item carries this label, because it is true of every item: we do not read the Radar item by item before publication.

Link to South Africa. Each item says whether and how it connects to South Africa. There is no South Africa-only switch: threats reported abroad reach South African organisations too.

7. Reports, not unique events

The Radar counts reports. One event covered by several outlets can appear several times. The headline strip at the top of the homepage suppresses near-duplicate headlines, but the full list and all counts do not merge them. That is why we speak of "reports", never "incidents".

8. Where the figures on our homepage come from

The sector view counts reports from the last 90 days that describe an actual security event and name at least one organisation we track in that sector. A report naming three banks counts once for Finance & Insurance, not three times. Each organisation is assigned to one of 13 sectors; organisations we have not classified are left out. The figures describe the organisations we track, not the South African market as a whole, and sectors with few tracked organisations move sharply on a single report.

These figures come from our internal research tools. Those tools are for our own use: they are not published, and we will not make them available to subscribers or anyone else. The website shows only overall counts; we never publish a score or rating of a named organisation or person.

9. Known limitations

10. If you are named in an item, or you publish a source we use

An organisation or person named in an item can dispute its accuracy, object to being named, or ask for a response to be considered — see our Complaints & Corrections Policy and, for personal data, our Privacy Policy. A publisher who has concerns about how we summarise and link to its reporting can write to info@cybersecurity-association.org; we respond within five business days.

11. Change log