Security Trust Center

OpenTrojan is an open cybersecurity intelligence platform. This page documents how we source, verify, and present security intelligence — and the principles that bound our defense-only posture.

Data Sources

  • NVD (CVE) — Official CVE vulnerability data (Daily)
  • CISA KEV — Known Exploited Vulnerabilities catalog (Daily)
  • MITRE AT&TA&C — Adversary tactics/techniques STIX data (Daily)
  • Editorial Content — Human-reviewed security knowledge (On publish)

Methodology

  • Evidence ranked by authoritative source (CISA > MITRE > NVD > vendor advisories).
  • Confidence labels communicate verification level (high/medium/low/unverified).
  • Vulnerability risk scoring merges CVSS, KEV status and asset context.

Update Process

  • CVE / KEV / ATT&CK synchronized daily via an automated pipeline.
  • Editorial content runs draft → review → published and stores provenance metadata.
  • Changes are versioned and the refresh window is disclosed on each record.

Editorial Policy

YMYL (Your Money or Your Life) safety domain: content is defense-oriented, educational, and cites sources. Offensive/weaponization content is excluded.

AI Usage Policy

AI assists research and drafting. AI-generated content is tagged (origin=ai_generated / ai_reviewed) and REQUIRES human review before publication. AI answers are citation-based and never present ungrounded claims as fact.

Security Principles

Defense over offense

All content and tools are defensive and educational; weaponization material is excluded.

YMYL care

Security is a high-stakes domain; claims cite sources and clearly separate verified fact from inference.

Privacy by default

Analytics and identity are aggregate-only; no personal tracking data is exposed.

No automatic modification

The platform never scans, exploits, or modifies systems automatically.