Independence and Conflict-of-Interest Policy
Public document · Version 1.0 · Adopted 2026/07/06 · Reviewed annually Published at pwnshow.com/ethics/conflict-of-interest · All versions remain permanently accessible at /ethics/conflict-of-interest/versions.
Preamble
Pwnshow is an adversarial research agency whose work informs regulation, standards, and public understanding. Its Founding Director also founded and directs Zeronomicon, a commercial vulnerability-acquisition platform. We regard this adjacency as a fact to be governed, not concealed: the operational knowledge it provides is the foundation of our credibility, and the conflicts it could create are the foundation of this policy.
This document states the rules under which Pwnshow accepts work, discloses interests, and maintains the separation that makes its findings trustworthy. It continues a commitment begun in 2015, when our principal authored the first private-sector code of ethics for the acquisition of vulnerability information — before any client, regulator, or critic required it.
1. Purpose and scope
1.1 This policy governs all activities conducted under the Pwnshow name, including the Vulnerability Studies Programme (VSP), the Studio, and all publications, consultations, standards contributions, and expert roles held by Pwnshow personnel in their Pwnshow capacity.
1.2 It binds the Founding Director and all affiliates, fellows, and subcontractors engaged on Pwnshow investigations.
1.3 It does not govern Zeronomicon, which operates under its own policies. Section 4 of this document nonetheless imposes obligations on Pwnshow regarding its relationship with Zeronomi, and §4.6 records a reciprocal written commitment obtained from Zeronomi.
2. Definitions
Related Entity. Any organisation in which a member of Pwnshow personnel holds equity, a directorship, or a compensated role. As of adoption, the material Related Entity is Zeronomicon [Zeronomicon di De Gregorio Alfonso, Italy]. No other Related Entities exist at the date of adoption.
Capability-Market Activity. The acquisition, brokerage, development, or sale of vulnerability information, exploits, or offensive cybersecurity capabilities.
Policy-Facing Work. Any Pwnshow activity intended to inform regulation, standardisation, or public policy — consultations, standards contributions, evaluations, expert testimony, and publications addressed to policymakers.
Engagement. Any commissioned, funded, or formally invited Pwnshow activity.
3. Principles
3.1 Evidence over advocacy. Pwnshow’s positions follow from its findings; findings are published to the standard of peer review wherever possible, so that they can be checked rather than trusted.
3.2 Disclosure before discovery. Every material interest is disclosed proactively, in the venue where it is relevant, before anyone has to ask.
3.3 Separation by structure. Independence is enforced by rules, records, and third parties — not by good intentions.
3.4 Recusal without drama. Where a conflict cannot be managed by disclosure, Pwnshow declines or recuses, and says so.
4. The Pwnshow–Zeronomicon separation
4.1 Legal and financial. Pwnshow and Zeronomicon are separate legal entities with separate accounts. No revenue is shared; neither entity funds the other’s activities.
4.2 Operational. No shared client lists, infrastructure, domains, email systems, document repositories, or social-media accounts.
4.3 Informational. Non-public information obtained in Zeronomicon’s commercial activity is not used in Pwnshow investigations or Policy-Facing Work. Where Pwnshow’s analysis draws on capability-market experience, it relies on the principal’s general expertise and on public or published sources, and says so in the relevant output (see §6.3).
4.4 No commercial leverage, in either direction. Pwnshow does not market, recommend, or facilitate Zeronomicon’s services in any Engagement. Pwnshow’s policy roles, standards seats, and consultation work are not cited, referenced, or implied in any Zeronomi commercial or marketing material.
4.5 Policy positions affecting capability markets. Where Pwnshow’s Policy-Facing Work addresses the regulation of Capability-Market Activity — the domain where the structural conflict is most direct — Pwnshow will: (a) disclose the Zeronomicon relationship in the output itself, not merely on this page; (b) state expressly whether and how the recommended position would affect Zeronomi’s commercial interests; and (c) submit the output to independent review under §8 before release.
4.6 The reciprocal commitment. Pwnshow has obtained from Zeronomicon a written undertaking, signed by its directors, implementing the second sentence of §4.4 on Zeronomi’s side, including notification to Pwnshow of any breach within seven days. The undertaking is published in full below (Annex C).
5. Engagement acceptance
5.1 Prohibited. Pwnshow declines Engagements that would: (a) require evaluating, auditing, or advising on Zeronomicon or any direct competitor of a Related Entity; (b) involve Policy-Facing Work commissioned by a party whose principal interest is the commercial position of a Related Entity; (c) require concealment of the Engagement’s existence where that existence is material to the credibility of related public work — confidential engagements are acceptable, secret influence is not; or (d) conflict with the 2015 Code of Ethics for the acquisition of vulnerability information, which remains binding on all Pwnshow vulnerability handling (Annex D).
5.2 Conditional. The following are accepted only with disclosure and, where indicated, review under §8: (a) Engagements funded by parties with declared positions in debates that Pwnshow’s findings may affect; (b) Engagements in capability-market policy, per §4.5; (c) Engagements where a prior Pwnshow output is material to the funder’s interests.
5.3 Screening. Every prospective Engagement is screened against §5.1–5.2 using a standing one-page checklist before acceptance. Completed screening records are dated, signed, numbered (ENG-YYYY-NN), and retained for the duration of the Engagement plus five years. The blank checklist is available on request.
6. Disclosure apparatus
6.1 Standing Disclosure Register. Published on this page and updated within thirty days of any material change, the Register lists: all Related Entities; all compensated advisory, expert, and standards roles held by Pwnshow personnel; all funding sources for Pwnshow investigations above €10,000 per year; and the sponsorship arrangement for Pwnshow’s ETSI TC SAI participation, naming the sponsor.
| Related Entities | Date from | Role | Notes |
|---|---|---|---|
| Zeronomicon | 2015/12 | Director | |
| European Commission | 2005/04 | External Expert |
6.2 Per-venue disclosure. In every Policy-Facing role — European Commission expert work, ETSI, programme committees — Pwnshow files the venue’s own declaration-of-interest instrument completely and, where the venue has none, volunteers the Standing Disclosure Register.
6.3 Per-output provenance note. Every Policy-Facing publication carries a short, fixed-format statement answering three questions: who funded the work, what Related-Entity interest exists, and where any capability-market knowledge relied upon comes from. The templates are published at Annex A. Provenance notes are being added retroactively to the Investigations case pages, each dated and marked “added [date] under Policy v1.0.”
7. Specific roles
7.1 European Commission expert work is governed by the Commission’s own conflict-of-interest rules, which prevail where stricter. Pwnshow additionally applies §4.5 to any task touching capability markets or AI-capability regulation, and recuses from evaluating any proposal involving a Related Entity, a current client, or a current co-author.
7.2 ETSI TC SAI. Standards contributions are made in the name of the Vulnerability Studies Programme, Pwnshow, with sponsorship disclosed per §6.1. Where a work item’s outcome would foreseeably affect Zeronomicon’s commercial position, Pwnshow discloses within the committee under its procedures.
7.3 Expert-witness work is accepted only where no Related Entity has an interest in the matter, and is subject to §5.3 screening.
7.4 Studio. Artistic works are not Engagements in the sense of §5 and are exempt from screening, but remain subject to: the informational rule (§4.3); consent and data-ethics norms for any work involving identifiable persons or personal data — a practice already reflected in the use of public-domain archives in Retained Reports; and disclosure where an artwork is commissioned by a party with interests in Pwnshow’s Policy-Facing domains.
8. Independent review
8.1 The Independence Panel. Pwnshow maintains a panel of two named external members with no financial relationship to Pwnshow or any Related Entity:
The Panel is being constituted; its members will be named here on appointment. Until the Panel is seated, Pwnshow will not release outputs falling under §4.5.
8.2 Mandate. The Panel: (a) reviews §4.5 outputs before release; (b) reviews the Standing Disclosure Register annually; (c) receives breach reports under §9; and (d) may publish a dissenting note, which Pwnshow commits to carrying alongside the affected output, unedited.
8.3 Clause 8.2(d) is deliberate. A reviewer who can only advise privately is decoration; a reviewer who can dissent publicly changes the author’s incentives before a word is written.
9. Breach, remedy, review
9.1 Suspected breaches — identified internally or reported by third parties to [ethics@pwnshow.com] — are referred to the Independence Panel. Findings and remedies are recorded; material breaches are disclosed on this page.
9.2 This policy is reviewed annually, and additionally upon any material change in the structure of Pwnshow, of Zeronomicon, or of the principal’s roles. All versions remain permanently accessible.
Annex A — Provenance-note templates (§6.3)
The note always answers three questions in three sentences, in fixed order: who paid; what Related-Entity interest exists; where the capability-market knowledge comes from. One of the following variants is selected; notes are never written freehand, because uniformity is what makes them comparable, and comparability is what makes them credible.
A.1 — Baseline (no external funding; no Related-Entity relevance). Provenance. This work was produced without external funding. No entity related to Pwnshow’s personnel has a material interest in its findings. Where this work draws on the author’s experience of vulnerability and capability markets, it relies on that general expertise and on the public and published sources cited, not on non-public commercial information.
A.2 — Externally funded output. Provenance. This work was funded by [funder], under [instrument]; the funder exercised no editorial control, and [had / did not have] the opportunity to review the text before publication. No entity related to Pwnshow’s personnel has a material interest in its findings [or state the interest, per A.3]. Where this work draws on the author’s experience of vulnerability and capability markets, it relies on that general expertise and on the public and published sources cited, not on non-public commercial information.
A.3 — Capability-market relevance (§4.5 engaged; Panel-reviewed). Provenance. This work was produced [without external funding / funded by [funder], as above]. Its subject matter touches the regulation of vulnerability and capability markets, in which Zeronomicon — a company founded and directed by the author — commercially operates; the position recommended here would [state the expected effect on Zeronomi’s interests in one clause]. This work relies on the author’s general expertise and on public and published sources, not on non-public commercial information, and was reviewed prior to release by the Pwnshow Independence Panel, whose note [accompanies this publication / raised no objection].
Annex B — Engagement screening checklist (§5.3)
The checklist is a one-page working instrument used internally for every prospective Engagement. The blank template is available on request to [ethics@pwnshow.com].
Annex C — Reciprocal Undertaking (§4.6) on Independence, Non-Citation, and Separation
Annex C to the Pwnshow Independence and Conflict-of-Interest Policy, v1.0
Parties
Zeronomi — Zeronomicon di De Gregorio Alfonso, a company incorporated in Italy (“Zeronomi”); and
Pwnshow — Alfonso De Gregorio, trading as Pwnshow (“Pwnshow”),
together “the Parties.”
Recitals
(A) The founder and director of Zeronomi is also the Founding Director of Pwnshow.
(B) Pwnshow conducts research, policy, standards, and cultural work whose value depends on demonstrable independence from commercial interests in the acquisition, brokerage, development, or sale of vulnerability information, exploits, or offensive cybersecurity capabilities (“Capability-Market Activity”).
(C) Pwnshow has adopted a public Independence and Conflict-of-Interest Policy (“the Policy”), published at pwnshow.com/ethics, whose §4.6 records a reciprocal written commitment between the Parties.
(D) The Parties wish to record binding commitments preserving that independence, for publication in full alongside the Policy.
Operative provisions
1. Definitions. Terms defined in the Policy — in particular “Related Entity”, “Capability-Market Activity”, “Policy-Facing Work”, and “Engagement” — bear the same meaning in this Undertaking. “Commercial Material” means any commercial, marketing, sales, or investor-facing material, client communication, or public statement made by or on behalf of a Party in the course of its business.
2. Non-citation by Zeronomi. Zeronomi shall not, in any Commercial Material: (a) cite, reference, or reproduce Pwnshow’s policy roles, standards memberships, consultations, evaluations, publications, exhibitions, or other activities; (b) state or imply any endorsement of, or advantage to, Zeronomi’s services arising from them; or (c) use the Pwnshow name or marks.
Carve-out, for the avoidance of doubt. Factual biographical statements about shared personnel made outside Commercial Material — for example, a conference speaker biography or curriculum vitae that truthfully lists roles at both Parties — do not breach this Clause, provided they draw no link between Pwnshow’s roles and Zeronomi’s services and claim no endorsement.
3. Reciprocal obligations of Pwnshow. Pwnshow shall not, in any Engagement or Commercial Material: (a) market, recommend, or facilitate Zeronomi’s services; or (b) cite Zeronomi’s commercial activity as endorsement or validation of Pwnshow’s work — consistent with §4.4 of the Policy. Where Pwnshow’s Policy-Facing Work addresses the regulation of Capability-Market Activity, Pwnshow shall apply §4.5 of the Policy (disclosure in the output, statement of effect on Zeronomi’s interests, and independent review).
4. Information separation. Each Party confirms, and shall maintain, the arrangements recorded at §§4.1–4.3 of the Policy: separate legal and financial existence with no revenue sharing or cross-funding; no shared client lists, infrastructure, domains, email systems, document repositories, or social-media accounts; and no use by Pwnshow of non-public information obtained in Zeronomi’s commercial activity.
5. Breach notification. Each Party shall notify the other in writing of any breach or suspected breach of this Undertaking within seven (7) days of becoming aware of it. Breaches are reported to the Pwnshow Independence Panel under §9 of the Policy; material breaches are disclosable on Pwnshow’s ethics page.
6. Remedy. Upon breach, the breaching Party shall promptly withdraw or correct the offending material, notify any recipients where practicable, and take reasonable steps to prevent recurrence. The Parties acknowledge that the principal enforcement mechanism of this Undertaking is its publication and the disclosure rights under Clause 5 and §9 of the Policy.
7. Term, survival, and review. This Undertaking takes effect on the date of the last signature, continues until replaced by a successor instrument, and shall be reviewed upon any material change in either Party’s ownership, directorship, or legal form. Its obligations survive any change in either Party’s personnel for twelve (12) months. If Zeronomi admits independent directors, investors, or acquirers, Zeronomi shall bring this Undertaking to their attention in advance and procure their adherence to it.
8. Publication. The Parties consent to the publication of this Undertaking in full, once executed, at pwnshow.com/ethics as Annex C to the Policy, and to the permanent accessibility of all executed versions.
9. Governing law. This Undertaking is governed by the laws of Italy, and the courts of Rome have exclusive jurisdiction over any dispute arising from it.
Executed on 2026/07/06 by Alfonso De Gregorio, Managing Director for Zeronomi and by Alfonso De Gregorio, Founding Director, for Pwnshow.
Annex D — The 2015 Code of Ethics
The Code of Ethics for the Acquisition of Vulnerability Information and Cybersecurity Capabilities (2015), presented at NATO CyCon U.S. and to the European Commission’s Joint Research Centre, is incorporated by reference and remains binding on all Pwnshow vulnerability handling. https://www.zeronomi.com/ethics.html
Questions about this policy, disclosure requests, and breach reports: [ethics@pwnshow.com].