Zero trust against the rise of the machines: the chief's workflow

Behind every piece of ours sits the same chain. There is no editorial calendar and no quota: an article gets written when a topic is really worth it. The chain, though, is always the same, and it has two points where a human, not a machine, decides.

A piece’s journey in nine steps

1. 1

   Red + Blue

   Morning news scan

   Red and Blue collect the day's security news from Hungarian and international sources. They throw out the ads and the repeats, merge whatever covers the same story, and score every topic against six criteria.

   • Local relevance, impact, actionability, storytelling potential, novelty, technical depth
   • Neighbour test: would you tell it over the garden fence, and would your neighbour do something differently afterwards?
2. 2

   Péter – White

   I pick

   I go through the list and decide on each topic: candidate, keep watching, or not interesting. I add a few words to the "no"s too, because that is where the crew learns the most. When I ask for deep research, I also say which direction it should start in.

3. 3

   Red + Péter – White + Blue

   Deep research

   We dig into the candidate topic: primary sources first (authorities, CERTs, vendors, researchers), then quality press, and we always search in Hungarian as well.

   • Every claim rests on two independent sources or one primary source
   • Anything that doesn't meet that bar can't go into an article
4. 4

   Péter – White

   First gate

   On a short decision sheet I decide whether the topic goes ahead, from what angle, for whom, and what I don't want to see in it. This is also where I write my own opinion. Without it, no writing starts.

5. 5

   Red + Blue

   Writing

   The crew writes the article in layers: the story, Red's attacker's view, Blue's to-do list, a technical block, and my note at the end. The English version and the background report for professionals are made too.

6. 6

   Péter – White + Red + Blue

   Index image

   The crew suggests an image idea, I add to it or ask for something else, and only then is the image made.

7. 7

   Blue

   Automated check

   Before a piece reaches me, a checklist runs through it. If it finds a blocking error, the article can't move on.

8. 8

   Péter – White

   Second gate

   I read the finished piece in preview. If it's right, I publish it; if not, I send it back or drop it.

9. 9

   Red + Blue

   Afterlife

   We keep following the topic after publication. If there is a real development, the article gets an update in place, marked with what changed.

Three rules we don’t bend

1. The human is not decoration. There are two gates in the process, and I pass through both. At the first I decide whether we write about the topic at all; at the second, whether the finished piece can go out. So the “reviewed by Péter” at the end of our articles stands for a real decision. The block with my opinion always starts from my own note. The crew may expand it and tie it to the facts of the article, but it can’t invent an experience or a position for me. It also always lists what it added, so I can see at a glance what is mine and what is the expansion.

2. Facts only with sources. The research splits into two parts. One part is publishable: every claim rests on two independent sources or one primary source, and it’s marked what is confirmed, what is reported and what is only an assumption. The other part is for my eyes only. That’s where things go that are interesting but come from a single source, are unconfirmed, or simply don’t belong in a public article. Nothing from this part may leak into any output, and the check watches for that too.

3. Explanation yes, weapons no. Red tells you how the attacker thinks and why a trick works. But he never hands over code, command lines or a step-by-step recipe. An equally strict line separates this workshop from my day job: nothing here points there, and nothing from there comes here.

What the automated check looks at

Before the second gate, a checklist runs through every piece. It doesn’t replace reading, but it won’t let through the errors a tired eye might miss. A few examples of what stops an article:

• Red’s, Blue’s or my block is missing, or my block isn’t based on my own note;
• a claim doesn’t have enough sources behind it;
• code or a command line ended up in the attacker’s block;
• a suspicious web address or domain was left “live” and clickable in the text;
• a forbidden name appears, my employer for example;
• the index image is missing.

Anything that isn’t blocking, just suspicious, comes to me as a warning, and I decide. A title that’s too long, a relative date like “yesterday”, or a technical term left without an explanation are typical.

The side tracks

Alongside the main line, a few shorter routes have grown up, all with the same rules:

• Quick alert: if something affects a lot of people right now and there’s a clear thing to do, a short warning goes out, with at least one authority, CERT or vendor source.
• Weekly roundup: our pieces published that week, in one place.
• News DDOS: the week’s news flood in one table: which topics we tracked, and why.
• Updates: if a topic we’ve already covered develops, the old article gets an update in place, marked with what changed.
• Behind the scenes: this piece. It isn’t triggered by the news, but by whether there’s something worth showing from the workshop.

Where I take the wheel

We promised to show the mistakes too, and where I step in. Three examples from our work together, at three different levels.

Professional direction. When I ask for deep research on a topic, I don’t just say “look into it”. On the ConnectWise case I added a single sentence to the request: this could be interesting from a third-party risk angle. The crew started researching in that direction, and so the news didn’t become yet another “company got hacked” story but a piece about how your key hangs on your provider’s key ring, and what to ask your IT partner. The facts come from the crew; the angle comes from me.

Learning loop. Once the clones put a topic at the top of the daily list that could be traced back to one of my employers. Professionally interesting, but against the rules of this playground. My answer was “no”, with the reason: anything tied to my workplaces is off-limits here. That explanation wasn’t lost. Since then this filter is the very first step of the selection, and such items never even make the list.

Aesthetic control. What sets the clones apart from me is the glow in their eye, and it always has to be on the same side. The image model could not be persuaded, through editing, to move the glow to the other eye: even after the request it stubbornly kept shining on the old side. The fix ended up being a detour: we mirrored the image and had it redrawn with the same person. A small thing, but a brand’s consistency depends on small things like this, and I sign those off too.

As for how much time all this saves us, I won’t give a number now. Estimating would be easy, but here we only publish measured data. If we ever measure it, we’ll show you that too.