Transparency

How we work

CISO Tribune is an agentic publication: software agents do the research, monitoring, and drafting, a second agent verifies every record against its source, and a human editor handles anything sensitive. We think you should know exactly how the sausage is made — especially at a publication whose entire product is being right about people.

Every record verified against its source. A move is confirmed unless it is labelled reported. Contested exits, interviews and corrections: a human decides.

Agents sense

Automated monitors watch press wires, trade publications, and industry roundups every day for CISO appointments and departures.

Agents draft

Extraction agents read each source and draft a record: person, role, company, date with honest precision, and the primary source link. Drafts that fail the sourcing bar are rejected and logged.

The gate checks

Every draft passes an automated fact-check gate that enforces our editorial rules: a source URL on every record, no deputy or subordinate titles presented as the top seat, no fabricated date precision.

A second agent verifies

A separate verification agent reads each draft's source and confirms the person, organization, title, date and every factual sentence. It must quote the passage that supports the record, and that quote must appear on the source page. Anything it cannot confirm stays held.

Routine records publish; sensitive ones go to a person

A verified record publishes automatically only when it is recent, comes from an official announcement, a regulatory filing or established trade or business press, and has cooled for at least 3 hours (24 hours for the newsletter). The one exception is a reported move, below, which is always labelled as not yet confirmed. Departures need an official source. Anything that suggests a contested exit, every interview and every correction is held for a human editor.

Reported moves: one outlet, labelled until confirmed

Some appointments are covered by a single smaller news outlet before the company or the trade press says anything. We publish those as reported moves, never as fact: each carries the label “Reported by [publisher]; not yet confirmed by [company] or an established publication” wherever it appears. It must still pass every other check: the outlet's own headline or opening names the person, the organization and the top security title; it is a news report about this appointment, not a list or a feature; it is no more than 21 days old; the verification agent confirms it against that page; nothing in it suggests a contested exit; and the outlet is not a social network, LinkedIn, a job board, a people-data site or a blog platform. Every day we look for confirmation. When the company or an established publication confirms it, the record switches to that source and becomes a regular move. If a source contradicts it, the report disappears, or nothing confirms it within 30 days, we withdraw it and log the withdrawal on the corrections page. Departures never publish this way: they need the organization itself.

CISO Voices: our take is opinion, and says so

On CISO Voices, a short note marked “Our take” (three to six sentences from a search excerpt, four to eight where we have the published description or the piece itself) is the editors' view: where the author sits on our record, what the post, article, podcast or talk raises in our words, and what we think it means for security leaders. Never a judgement of the person. We write it only from the text we can see. For a LinkedIn or X post that is the public search excerpt for that exact post, never the post itself; for other pieces, the published text or description. If we can see too little, there is no take. An agent drafts it and a second check compares it with that text, dropping it if it goes beyond what the text shows, quotes it, or talks about the person instead of the idea. Person pages may carry a short “What we've noticed” note on the pattern of someone's posts, built only from our own entries and record. Anyone can ask for a correction or removal through the corrections page.

Town Square: what the community argues about, checked, with our take

Each day Town Square reads the security stories drawing the most discussion on Hacker News, Reddit, Mastodon and Lobsters, and what search shows of the conversation on X (we never fetch X itself). For each story we look for the primary source (the affected organization, the vendor, a regulator, a court record, a CVE record) and give a verdict: confirmed only when a primary source or two independent outlets with their own reporting state the claim; partly confirmed when the core event holds but the details spreading do not; not confirmed yet when only the claimant says so; disputed or false when a primary source contradicts it. A thread proves what was said in it, not what is true. Every fact rests on a passage found word for word on its source page or in the thread, or it is cut before publication. The threads are digested, never quoted at length, and the people in them are never named. The verdict and the advice are our opinion, marked as ours. A story whose news is an allegation of wrongdoing against a named person stays out. Each edition is written on our own pipeline and counted against the site's limit of six editorial articles a day.

Vendor pages: 'Who it fits' is our view, and says so

On a vendor's page, the box marked “Who it fits” is the editors' reading of who the company says it sells to: the segments, industries and deployment models its own pages and named customers show. It is labelled opinion, never a recommendation, never a ranking, and never a comparison with a named competitor. The competitors box beside it is a list from our own record (the other companies filed under the same categories), alphabetical within those that share the most categories. What review platforms show is the headline rating and count they displayed in public search results on the day we looked, with the link; we never read or reproduce the reviews.

CISO Voices: the speaking circuit and podcast index come from the venues themselves

Besides searching for each person, an agent reads a fixed list of places security leaders speak: conference agenda and speaker pages on the events' own sites, and podcast shows' own public feeds (the list is in the repository as ops/voices-circuit-sources.json; never an aggregator or a social network). A session or episode is recorded only when that page or feed item names a person our record shows as the current holder of a top security seat together with their company, beside a session or as a guest; a name alone is never enough. The session or episode title, date, link and venue are the page's own, and nothing else of the page is stored. An upcoming session is listed from the event's own agenda as “Speaking on” its date, the one place Voices carries a future date; we record the listing, not that the session took place.

The record corrects itself in public

Errors are fixed on the entry, noted on the entry, and logged on the public corrections page. Roster entries are re-verified on a schedule so 'verified as of' dates stay honest.

What agents never do: invent quotes, publish an interview a person did not give, present an unverified tip as fact, or post to external platforms without human approval. Interviews on this site are conducted with real people who see and confirm their words before publication.

Alerts are the record, filtered: the weekly new-CISO alerts from New in seat list the confirmed appointments of the past seven days for the sectors a subscriber chose, as plain links to the records. No editorial, no reported moves, nothing a reader could not see on the site. The sector choice is stored as tags at our newsletter provider, Buttondown (see the privacy policy).

Something wrong in the record? See corrections, or send a tip via the tip line.

Sell to CISOs? For vendors explains what the site offers companies, including how to claim a directory entry by proving control of its domain; claiming changes no text.

Sponsorship is limited to a labelled newsletter slot and never touches the Wire, the directory, Voices or analysis: see the sponsorship policy, published and dated.