Methodology
- Overview
- Sources and collection
- Automated verification
- Confidence standards
- How scores are computed
- Automated calibration
- Limitations
- Independence
- Feedback and corrections
Overview
This page explains how CyberInsight Asia collects material, verifies content and computes its assessments. Content is generated by software and verified automatically; the method changes with new evidence and an annual method review.
Sources and collection
We use public sources only: national legislation and regulator sites, national cyber emergency response teams (CERTs), the US National Vulnerability Database (NVD), CISA's Known Exploited Vulnerabilities catalogue (KEV), major vendors' security advisory pages, and MITRE ATT&CK group data. Every item keeps its source link and collection time (UTC). We follow each site's robots.txt and rate limits; sources we cannot read are shown honestly in each country page's coverage note.
Automated verification
Every generated claim must match an excerpt in the stored source text, or it is dropped. Identifiers, dates, numbers, law names and law status are checked by code against the sources and the law register, not by the model. Three automated checks with different instructions then return supported, partly supported or unsupported; a claim passes only if at least two say supported and the fact check does not veto it. A separate red-team check looks for overreach, omissions and neutrality problems. The checks run on one model family, so their independence is lower than with different models; the rule-based checks are the main safeguard. Verification is done by software, not by human analysts or external experts.
Confidence standards
High: at least three independent sources, or an official or vendor first-hand source. Medium: one or two sources, or a commercial vendor. Low: a single or unverified source, labelled low confidence and placed in a secondary position. Independence is judged by domain, publisher and text overlap; copies of the same original report do not count.
How scores are computed
The composite risk index is the risk score divided by the maturity score. The risk score combines five dimensions: threat activity, geopolitical and great-power risk, critical-infrastructure exposure, regulatory enforcement capability (inverse) and historical incident severity; their weights are normalised to total 100%. Maturity combines laws and regulations, regulatory capability, strategy, enterprise practice and international cooperation; the laws input is read from our law register. Scores start from a seeded assessment and move as evidence is recorded; a dimension with no new evidence keeps its last valid contribution and is listed on the page.
Automated calibration
Some scores include an automated calibration: three independent scoring passes with different instructions, grounded in retrieved evidence, take the median after dropping the extremes. It is not an expert review. When it has not run, the page says so.
Limitations
Public ransomware data covers only what attackers publish; the real number of victims cannot be determined. Attribution of threat groups is uncertain, and technical and strategic attribution are shown separately. Automated calibration is not an expert review, and no content is reviewed by human analysts or external experts. Official sources in some countries cannot currently be read automatically, and those pages say that coverage is limited. Non-primary-language versions are AI-assisted translations; the primary-language version and the official-language text prevail.
Independence
This site is a personal project of its operator, who is employed by Huawei. It is self-funded and built and run in the operator's own time, from public sources only. It uses no Huawei confidential information, is independent of Huawei, and is not endorsed by Huawei. The views are the operator's own.
Feedback and corrections
If you find an error or wish to respond to a statement about you, write to contact@cyberinsight.info. We aim to reply within 10 working days and record corrections in the corrections log.