Ethics
Ethics & independence
Pwnshow operates in domains where trust must be structural, not rhetorical.
We published our rules before anyone required them.
In 2015, our principal authored the first private-sector code of ethics for the acquisition of vulnerability information and cybersecurity capabilities, presented at NATO CyCon U.S., to the European Commission's JRC, and at the Australian Signals Directorate's Australian Cyber Security Centre Conference, among other venues. It remains the foundation of our practice.
Separation of activities.
Pwnshow is structurally and commercially separate from Zeronomicon, the vulnerability-acquisition platform founded by our principal. Pwnshow's policy and evaluation work is governed by a conflict-of-interest policy, and engagements that could compromise independence are declined or disclosed.
Evidence over advocacy.
Our policy positions follow from our findings, and our findings are published to the standard of peer review wherever possible.