How Slugnet ranks the daily signal

Slugnet uses an ordered editorial rubric rather than a public numeric score. The central question is: why does this development matter more than the other cybersecurity stories published today?

Collection and deduplication

The system collects public RSS or Atom entries from the ten publications listed on the sources page. URLs are normalized, tracking parameters are removed, and repeated URLs or substantially identical titles are discarded before ranking.

Priority order

1. Confirmed active exploitation, urgent remediation directives, and incidents with immediate enterprise exposure.
2. Critical or high-impact vulnerabilities in widely used enterprise, identity, cloud, developer, API, application, and AI infrastructure.
3. Material breaches, ransomware, malware campaigns, supply-chain compromises, and threat-actor operations.
4. Defensive research, policy changes, and novel techniques with a clear operational consequence.

Within a tier, Slugnet favors broader impact, stronger evidence, actionable defensive value, and freshness. Marketing announcements, generic surveys, awards, and unsupported vendor claims are normally excluded.

AI assistance and human review

Slugnet currently uses a locally hosted Gemma model to select and synthesize the briefing. The model receives feed titles, source names, publication times, URLs, and feed summaries. It is instructed not to invent severity, exploitation, affected products, or recommended actions.

Daily publication is automated and is not routinely reviewed by a person before publication. Longer incident pages and original analytical reports remain drafts until human approval.

Confidence and corrections

Confidence describes support in the supplied source material, not certainty about every claim in an evolving incident. Readers should use the original source and applicable primary advisory before taking action. Corrections can be requested at contact@slugnet.com.