Before citing a security survey, find the method. Who was asked, how they were chosen, how many answered and what exactly the question said. If the report does not state these, you cannot know what the headline number measures, and your own report should say so or leave it out.
Start with the sample
Surveys describe the people who answered, not necessarily the industry. Check whether respondents were customers of the sponsor, newsletter readers, conference attendees or a panel recruited for the purpose. Each group skews differently.
Look for the number of responses, the roles of respondents, company sizes and regions. A claim about large banks from a sample of small software firms is not a claim about large banks.
Read the question, not the chart title
Chart titles compress. The underlying question might have been "have you ever" or "in the last twelve months", and the answer options might have been leading. A percentage of respondents who say they do something is a self report, which tends to overstate good practice.
Distinguish perception from measurement
Some surveys ask people what they believe. Others count something, such as scan results or incidents in telemetry. Both are valid, and they are not interchangeable. "Sixty percent are worried about X" is not "X happened to sixty percent." Do not write one as the other.
Check the date and the sponsor
State when the fieldwork ran, because published dates lag it. Note who paid. A sponsor that sells a solution to the problem has a reason to find the problem large. That does not invalidate the data, but you should not hide it.
How to cite responsibly
- Name the publisher, the date and the sample in the sentence.
- Quote the number as stated. Do not round up or merge categories.
- Say what it measures, for example "respondents reported", not "organisations have."
- Link to the original rather than a summary.
When you run your own survey
Write down the method before sending it: target group, channel, number invited, number completed and how you handled incomplete answers. Publish those with the results. Never fill gaps with estimates presented as findings. If your response count is small, say it is small and describe the results as indicative.
A note on probability figures
Be careful mixing survey data with model scores. FIRST states that EPSS output is a probability for exploitation in a 30 day window and that it should not be multiplied by CVSS or treated as a risk score. Different kinds of numbers need different handling.
Safeguard covers the inventory and prioritisation parts of this with SBOM and dependency scanning and reachability analysis, and you can try a free scan at gold.safeguard.sh/scan. Autonomous remediation with fix PRs is off by default, and every category starts on Manual, so a person approves changes.
Quick check
What is the quickest way to check a survey?
Find the methodology page and read the sample size, who was asked and the exact question wording.
Can I cite a survey with no method?
You can, but say the method is not stated. Better, find a source that publishes one.
Sources
Last reviewed: 19 October 2026.
