Editorial policy

This policy explains the standards every guide on CyberThreats.au is held to.

Purpose

We publish general cybersecurity education. Each guide should answer a clear question, in plain English, with practical value beyond a generic summary.

We explain; official services advise

CyberThreats.au doesn’t give advice. Our guides explain how scams, threats and security settings work, and describe what official sources say about them, attributed to those sources (for example, “Scamwatch advises…” or “Microsoft’s documentation describes…”).

• Every guide includes a Where to get official advice box that links to the official services, such as Scamwatch, the Australian Cyber Security Centre, IDCARE or Microsoft’s documentation, that can advise on your own situation.
• Steps or checklists in our guides describe what those sources say. They aren’t instructions from us, and they don’t take your circumstances into account.
• We can’t take reports, investigate incidents, recover money or assess individual situations.

Sources

• We prefer current primary sources: official government guidance, vendor documentation and relevant standards. In Australia, that includes the Australian Signals Directorate’s cyber.gov.au, Scamwatch, the Office of the Australian Information Commissioner and other official resources.
• For product-specific guidance, such as Microsoft 365, we check the vendor’s current documentation and note licensing dependencies.
• We link to the sources that support each guide, and record the date we checked them.
• We don’t invent statistics, quotes, test results, product details or expert endorsements. If a claim can’t be verified, we remove it or say clearly that it’s uncertain.

No allegations about people or businesses

We don’t publish content that names or identifies a person or business in connection with alleged cyberattacks, data breaches, fraud, scams, security weaknesses or other wrongdoing, even if it has been reported elsewhere. We use generic and fictional examples instead. Product and vendor names appear only where needed for legitimate education or product comparisons, and never to make unsupported claims.

No attack instructions

We explain threats so people can recognise and defend against them. We don’t publish instructions that would help someone gain unauthorised access, deploy malware, steal credentials or evade security controls.

No guarantees

No product, setting or checklist makes anyone completely secure. We avoid absolute claims and explain the limits of each guide. Every guide includes a “limits of this guide” section.

Who writes our guides

Guides are written and maintained by the CyberThreats.au editorial team. We don’t use invented author personas.

Review and approval

Every guide moves through a documented workflow: research, drafting, fact-checking and editorial review. No guide is published, and no substantive factual change is made to a published guide, without explicit approval.

Keeping guides current

Each guide shows when it was last reviewed. Guides about fast-changing subjects, such as Microsoft 365 features and licensing, Australian reporting services and AI tools, are scheduled for more frequent review. When a review is due, we check the guide against current sources and update it after approval.

Guides to choosing security tools

These guides explain the criteria that official guidance and product documentation discuss, and the basis of any comparison. We label comparisons based on published specifications as such, and we don’t claim hands-on testing unless a product has actually been tested using a documented process. We don’t tell readers what to buy, and advertising, affiliate commissions and other commercial relationships don’t decide which products are included or what we say about them. See our advertising and affiliate disclosure.

Corrections

See our corrections policy.