Advisory Wording Diffs: The OSINT Signal Hidden in Security Prose

Advisory text analysis reveals hidden OSINT signals. Lawyers and engineers write security advisories, making the text a valuable source of information. By tracking changes over time, one can uncover insights that are not explicitly stated in any single advisory. A notable pattern involves the expansion of scope sentences from "network-based attacker" to "adjacent-network attacker" without any change in the CVSS vector.

This indicates that someone in coordination argued about exploitability but lost the argument. Adjacent-network refers to a scenario where an attacker requires physical proximity, such as Bluetooth range or the same Wi-Fi network. This difference in risk level can significantly impact fleet managers. To mine this information affordably, it is sufficient to snapshot the canonical advisory text daily, storing plain text along with a hash for each entry.

Three dimensions can be analyzed through diffs: scope words, impact verbs, and affected-version phrasing. Correlating these diffs with the calendar shows that changes in wording often cluster 24-72 hours before a CVE publication date, which typically corresponds with coordinated-disclosure deadlines. Conversely, changes after publication without new CVSS scores usually mean the vendor has conceded a scope argument in community discussion.

This correlation provides leads on what is truly happening in the ecosystem. Paid digests can be valuable, as they provide alerts based on the analysis of advisory prose diffs using a dictionary of scope verbs and impact-escalation chains. The OSINT Bundle offers a weekly digest of ten prose movements that changed real exposure, available for $5.

The method is source-agnostic, applying to advisories, regulatory text, Terms of Service pages, and more. The free sample brief demonstrates the output format, and the pipeline can be run on GitHub Actions without any server or paid APIs.