Sources and method

SecurityStudies.info follows cyber threats, physical security and the European Union's exposure in 21 countries of Asia-Pacific. It is built for analysts and security officers who cover the region and need to see, in one place, what the regional press reports and how it connects to known threat actors, exploited vulnerabilities and EU interests.

The site is organised as a coordination centre, by the questions a security officer asks. The situation room shows the state of every country and what changed this week. Cyber threats come first: the overview, threat actors, the incident register, exploited vulnerabilities and techniques. Countries have a board that compares them, one file each (cyber, physical security, European Union) and a regional physical-security page. The European Union section separates the threats that reach the EU from the region from the EU's relations with it and its cooperation portfolio. The news monitor holds every article, and the search box at the top finds countries, actors, vulnerabilities, incidents and headlines.

Everything comes from open sources. The pages are computed from data by fixed rules, described below. Text written by a language model is always labelled: the machine-generated country reports, the machine translations of headlines and the archived briefs. Nothing here has been reviewed by an analyst. Use it to find and connect sources, then read the sources.

Cyber articles. An article is tagged as cyber when its headline matches a list of precise patterns (ransomware, data breach, phishing, a CVE, a named intrusion technique and similar), or when its text matches several of them. The patterns cover English, Chinese, Japanese, Korean, Vietnamese, Thai, Khmer, Indonesian and Malay, and the basic Mongolian terms; every rule on this page also reads the English translation of a headline in another language, so a headline counts when the original or its translation matches. Scam centres, online fraud and cryptocurrency theft count as cyber; disinformation and propaganda do not. Articles from the specialised cyber outlets are always cyber.

Which country an article is about. An article counts for the countries it names. When it names none, it counts for the country of its outlet. A country named as the origin of an attack, or as the sponsor of the actor, is not counted as affected. A story about a place or a platform outside the region is not assigned to the outlet's country.

National CERT advisories. The bulletins of national computer emergency response teams (JPCERT/CC, JVN, KrCERT/CC, HKCERT, ThaiCERT) are shown apart: on the cyber overview, in each country file, on the page of each CVE they name and in the news monitor. They are never counted as news, so a CERT that publishes many bulletins does not make its country look more targeted.

Incident register. After every news fetch, cyber headlines about the region that report something that happened to a victim (a breach, a leak, a ransomware attack, an intrusion, a theft, a campaign against named targets) are grouped into stories: headlines of the same days that share an uncommon name (an organisation, a product, a quoted name), a CVE, or most of their words. Policy, plans and prevention, statistics, advice and explainers, products, court cases and arrests are left out; a translation can add an incident the patterns for its language miss (with an unmistakable phrase, or a word that says something happened to a victim: hacked, stolen, leaked, suspended after an attack), but not when the original headline has one of those words. Two leaks told with the same wording and different figures (two companies, "about 4.3 million records" and "about 7 million") stay two incidents. The title of an incident is an English headline of its story, or the translation of one, which the incident's summary says. Each story becomes an incident labelled Detected, with its articles as sources. Its type comes from keywords; its severity (1–5) is a base per type (ransomware, cryptocurrency theft, campaigns and exploitation 3; breaches, intrusions and DDoS 2; defacement 1) plus one point each for a critical sector (government, defence, finance, health, telecoms, energy, transport), a million records or 100 million dollars in the headlines, an exploited vulnerability from the CISA catalogue, and four outlets or more, up to 5. Countries are the victims the headlines name (or the outlet's country for a domestic story); a country presented as the attacker is not a victim. The actor is the one most named in the coverage, which is the press's attribution, not this site's. Staff can confirm an incident or dismiss it; a dismissed one disappears and is not detected again. When these rules are tightened, the unreviewed incidents that no longer meet them are removed at the next run.

Alerts. After every fetch, four rules raise alerts, each event once: an incident of the register of severity 4 or more, or of high EU relevance; an exploited vulnerability of the CISA catalogue named in the news of the region, or in a national CERT advisory, for the first time in 30 days; a threat actor that targets the region, or of high EU relevance, named in three articles or more in a week after none in the 30 days before; a country whose physical-security level (machine-generated country reports) rose to High or Critical. The alerts page has an Atom feed that follows its filters (a country, a kind, EU relevance, a level), for a feed reader or a chat or e-mail tool that follows feeds. The site sends no e-mail itself.

Exports. The incident register exports what it shows, with its filters, as a STIX 2.1 bundle (incidents, the intrusion sets named, vulnerabilities and countries, linked by relationships), as MISP events and as CSV; each incident page exports itself in STIX and MISP. Identifiers are stable, so importing again updates instead of duplicating. Everything is TLP:CLEAR. Detected incidents carry a STIX confidence of 15 and the status "detected-unreviewed" (MISP analysis "initial"); reviewed ones 60.

Physical-security headlines. The security headlines of the Physical security page and of the news monitor are articles whose headline is unmistakably about armed conflict, political violence and unrest, organised crime, nuclear weapons or a natural hazard (airstrike, bombing, protesters, trafficking, typhoon and similar words, in English: in the headline or in its translation). Regional outlets also run world news, so an article is kept only when its headline or text names a country of the region, or names no country at all (a domestic story) and no place outside the region. Espionage is not counted as physical security.

Actors, vulnerabilities and countries. CVE identifiers, threat-actor names and aliases, and country names are found by exact matching in the article text and in the English translation of its headline. Aliases that are ordinary words (Bronze, Typhoon, Lotus) are ignored unless they come with the rest of the name. Actor names written in other scripts are not matched.

Stories. The news monitor shows one row per story: the newest article, with the other articles about the same event, from any outlet and in any language, under "Same story". Headlines are compared in English (the translation, for the other languages) as sets of words weighted by how rare they are in the news: an article joins an earlier article of the previous 48 hours when they share at least two words, one of them uncommon, and a large part of their weighted words (or nearly all the words of the shorter headline). A story takes new articles for four days. Headlines with different numbers on each side (a weather report of 9 and of 10 November), regular series (editorials, press reviews) and CERT advisories are never grouped. Grouping is automatic: it can join two stories or split one; "List every article" shows the articles one by one. Elsewhere, when several outlets run the same or nearly the same headline, the lists show it once with an "also in" line.

What changed this week on the first page is a set of statements computed from the data: vulnerabilities added to the exploited-vulnerability catalogue, actors named in more articles than the week before, the CVEs most named in the week's articles, changes in the report threat levels and the country where EU digital projects meet the most cyber news. No one selects or words those lines by hand.

Ownership tags. Outlets owned by a state or a ruling party are tagged state media and government bodies official next to their headlines. The tag says who owns or funds the outlet; it is not a judgement on any single article.

Article dates are the ones each outlet gives, shown in UTC. A few outlets date their articles in local time or by edition day; when that date is later than the moment the article was fetched, the fetch time is shown instead.

Translated headlines. Headlines that are not in English (Chinese, Japanese, Korean, Thai, Vietnamese, Indonesian, Malay, Khmer, Mongolian, Portuguese, Tetum) are shown in an English machine translation, followed by a mark with the language (TH); the original headline is in the mark's tooltip, and under the translation in the news monitor and on incident pages. The language comes from the script of the headline, or from the outlet's language for headlines in Latin script, with a test for Malay and Vietnamese headlines in English-language outlets. Translations are made by Google Gemini (gemini-3.5-flash-lite), asked to translate faithfully, add nothing, and romanise names it does not know rather than replace them. When Gemini is unavailable, NLLB-200 (Meta's open model, run on this server) translates the newest headlines; its translations are rougher, above all for names in Chinese, Japanese and Vietnamese, and carry an amber mark (TH) until Gemini redoes them. Searches look in the original and in the translation. The classification rules above read both: a headline counts as cyber, physical security or EU when the original or the translation matches.

The country reports, and the physical-security threat level and map hotspots taken from them, are written by a language model: Google Gemini, which runs a web search on the country's recent security news and writes the report from the results. Each report lists the pages the model was given. No analyst reviews them, and a language model can state things its sources do not support. Check a claim against the listed sources before relying on it.

Cadence. The generator runs once a day with a quota of about 20 reports for 21 countries and starts with the countries whose report is oldest, so each country gets a new report every one to two days. Pages that use a report show its date.

Failed runs. When the model returns an error or a refusal, nothing is published and the previous report stays in place.

Threat level. The level in each report (Low, Moderate, Elevated, High, Critical) is the model's own judgement. In practice most reports are rated Elevated, so the level separates countries poorly. Read it as context for the report, not as an assessment.

The EU projects and agreements are a hand-compiled list drawn from European Commission and EEAS publications; each project links to its source. It is not a complete record of EU spending in the region.

Totals count only EU allocations: amounts the EU budget has committed to the country or the regional body shown. Three other kinds of figure appear in the sources and are shown with a label, never added to totals: the envelope of a whole programme that also covers other parts of the world, an investment target to be mobilised with partners (loans, guarantees, private money), and funding from a single member state.

Coverage is uneven. A single outlet published in the last 30 days in Laos. A low article count for a country can mean little happened or that this site does not read the outlets that reported it. National CERT advisories and vendor research are mostly not included yet.

More sources, higher counts. A country with more outlets, or with outlets in its own language, shows more articles than a country covered by one English-language outlet. South Korea and Indonesia gained Korean- and Indonesian-language sources on November 10, 2026, so their counts rise from that date because of the sources, not because more happened.

It reports what the press reports. Counts measure media attention, not the number of incidents. An attack that no listed outlet covered does not appear, and a widely covered one appears many times.

Rules make mistakes. Some cyber articles are missed and some unrelated articles are tagged; an article can be assigned to a country it only mentions in passing. There is no human review of the tagging.

Attribution is the sources' own. Sponsors and targets of threat actors come from MISP Galaxy and MITRE ATT&CK, which record public attributions by vendors and governments. This site does not make attributions.

Machine translation can be wrong. A translated headline can misread a name, a figure or a negation. Before relying on one, open the article or read the original headline.

Detected incidents are not verified. An incident detected in the news is what the press reported, grouped by rules: two stories can be merged by mistake, one story can appear twice (above all across languages), and severity is a rule, not an assessment. Read the sources. Staff mark reviewed entries.

Until September 2026 the site published daily briefs written with an AI assistant from web research. They are no longer produced. The old pages are kept for reference and are not updated:

• Daily briefs
• CTI briefs
• Conflict analysis
• Europe and Asia-Pacific analysis