Editorial methodology
Inaccurate security information can lead someone to lower their guard at the wrong moment. This page describes how our content is produced, and exactly what our verification notes mean — including what they don't.
A page is not published while it is incomplete
We maintain a database of attack techniques that is larger than what is published. A technique can be listed there without a public page: as long as the items below are missing, the page stays in preparation and does not go online.
- Definition
- What the technique is, in one sentence anyone can understand without a technical background.
- How it works
- The concrete course of the attack, from first contact to the attacker's goal.
- Warning signs
- At least one clue the targeted person can observe — not a trait that only becomes visible afterwards.
- Psychological lever or indicator
- At least one identified manipulation mechanism (urgency, authority, fear…) or one attached technical indicator.
This rule is enforced by the software, not just by editorial discipline: publishing an incomplete page is technically refused. It is a deliberate choice — a small, reliable encyclopedia is better than a large catalog of empty pages.
How we handle sources
- Figures we quote come from public bodies or recognized institutions, with a link to the original publication.
- We never cite a source that does not actually support the statement it accompanies.
- We don't copy the text of our sources: we explain the mechanism in our own words, for a non-specialist audience.
- A figure without an identifiable source is not published, however widely it circulates.
The bodies we rely on are listed on the sources and references page.
How the simulations are written
Each simulation is original content, written to illustrate a specific mechanism. We never use a message actually received by an identifiable person, and the organizations being imitated are generic (“your bank”) or fictional, never used to harm a real brand.
After each answer, the explanation shows the technique used and the right reflex. A mistake in a simulation is never presented as a failure: it is exactly the moment when learning happens.
Limits we acknowledge
- Our content is not reviewed by a certified external expert. It is written from the public publications of competent bodies, but we don't display any “expert-validated” label, because no such validation has taken place. If that changes, this page will say so.
- Our coverage is not exhaustive. We don't claim to list “every cyberattack”: we cover the techniques aimed at the general public and small organizations, and that coverage grows over time.
- Scam techniques evolve. A page that is accurate today can become partly outdated; when in doubt, information from an official body takes precedence over ours.
- This site replaces neither professional advice nor a report to the competent authorities.
- Our help lines and reporting services are French: the English pages translate content written for France, and say so where it matters.
Report an error
If a piece of information seems inaccurate or out of date to you, we would rather know. A factual correction takes priority over any other change to the site.