Methodology
Zero Day 2028 employs rigorous analytical frameworks to produce cybersecurity threat intelligence that is accurate, timely, and actionable. This page details our research methodology, data sourcing, and editorial standards.
Data Sources
Our analysis draws on the following primary sources: the National Vulnerability Database (NVD) and MITRE CVE program; government advisories from CISA, NSA, FBI, NCSC, and allied intelligence agencies; vendor security advisories and patch disclosures; open-source threat intelligence feeds and malware repositories; academic research from leading cybersecurity institutions; and proprietary monitoring of dark web forums and ransomware leak sites.
Attribution Framework
We follow the Diamond Model of Intrusion Analysis and MITRE ATT&CK framework for threat actor attribution. We distinguish between confirmed attribution (supported by government indictments, court filings, or multiple independent vendor assessments), assessed attribution (supported by technical indicators and tradecraft analysis), and suspected attribution (based on circumstantial evidence and pattern analysis). All attribution assessments include confidence levels.
Analytical Standards
All published analysis undergoes editorial review for accuracy, sourcing, and analytical rigor. We clearly distinguish between established facts, assessments, and speculation. When uncertainty exists, we state it explicitly rather than presenting assessments as certainties.
Corrections Policy
If we identify errors in our published analysis, we issue corrections promptly and transparently. Corrected articles are clearly marked with the nature of the correction and the date it was made.