A primary source is the original technical evidence behind a claim: a vendor advisory, incident report, exploit write-up, log extract, packet capture, code sample, or official notice from the affected organization. In cyber security, primary sources matter because they let analysts verify what actually happened instead of relying on summaries, commentary, or secondhand reporting.
Defenders use primary sources to confirm indicators of compromise, affected versions, attack methods, and recommended mitigations. During investigations, they compare claims against raw telemetry and official guidance to avoid false assumptions. Attackers also rely on primary sources in a different way: they study original proofs of concept, patches, and advisories to understand how defenses work and where exposure may remain. Treating primary sources as the baseline helps teams make decisions on evidence, not repetition.