In security news, trust a primary source first: the vendor advisory, the regulator filing, the researcher write-up, or the record in a vulnerability database. A news article or social post is a secondary source and is fine for finding the story, not for deciding what to do. Trace every claim you plan to act on back to its origin.
What counts as primary
A primary source is written by the party that holds the facts. That includes a company's own incident notice, a filing with a regulator, a patch note, a vendor advisory, a CVE record, a catalog entry such as CISA's Known Exploited Vulnerabilities list, and the original research post.
A primary source can still be incomplete or self serving. A company notice is accurate about what the company chooses to say. That is why you read it with the six questions in mind: source, data, dates, unknowns, impact on you, and customer guidance.
What counts as secondary
News articles, newsletters, social threads, video summaries, and AI generated summaries. They are useful because they are fast and they collect context. They are risky because each retelling drops a qualifier. "Some customers" turns into "customers". "May have been" turns into "was".
How to trace a claim
- Find the sentence in the article that makes the claim you care about.
- Look for a link or a named document next to it.
- Open that document and find the same sentence or the number.
- If there is no link, search for the company name plus the exact claim, and look for the company's own page.
- If you cannot find it, label the claim unconfirmed in your notes.
Dates deserve a second look
Check when the page was published and when it was last changed. Advisories and notices are updated, and an old copy shared widely can contradict the current one. A stale screenshot is a common source of confusion.
When a retelling is good enough
For deciding whether to read more, a good article is fine. For deciding to rotate keys, take a service offline or tell customers something, use the primary source or, if none exists, say plainly that you are acting on an unconfirmed report.
A habit that helps
Keep a short list of primary pages for the vendors and projects you depend on: their security advisory page, their release notes and their status page. Visiting those is quicker than sorting through the noise.
Quick check
Is an AI summary of an advisory safe to rely on?
Use it to get oriented, then read the advisory text yourself for versions, preconditions and fix status before acting.
What if the primary source is silent?
Say so in your notes, act on what you can verify about your own systems, and check back on a set date.
Sources
Last reviewed: 19 October 2026.
