Editorial policy

Brexa publishes guides and a glossary for people buying and running security testing. They are meant to be useful whether or not you ever work with us. This page explains how they are made.

Who writes them

Guides are written and reviewed by the Brexa team and published under the Brexa name. We do not invent author bylines or credentials. When a named author writes a piece, their name and background will appear on it.

How facts are checked

• Claims about standards (PCI DSS, SOC 2, ISO/IEC 27001, OWASP, CVSS, NIST) are checked against the primary source and linked in each guide's sources.
• Industry figures appear only when attributed to a named, public source. If we cannot source a number, we explain what drives it instead.
• We do not publish statistics about Brexa's own results, customers or testimonials on these pages.

What the guides are not

They are educational, not legal, audit or compliance advice. Your auditor or counsel decides what a framework requires of you. They never contain exploit code or step-by-step attack instructions.

Comparisons and fairness

We compare categories of testing, not named competitors, and we say when an alternative, such as a scanner or a bug bounty program, is the better choice.

Updates and corrections

Every guide shows when it was published and last updated. Standards change, and we revise guides when they do. If you spot an error, email us from the contact page and we will correct it and update the date.