PlayCISO Guides
Pillar hubs, citable datasets and step-by-step how-to walkthroughs for security leaders and engineers. Every how-to ends in a free, browser-based PlayCISO tool or lab you can use immediately — no signup, nothing uploaded.
In plain words
PlayCISO Guides is a free library of 42 resources: 4 topic hubs, 4 citable datasets, 4 tool directories and 30 step-by-step how-to guides covering cryptography and PKI, AI and LLM security, SOC and incident response, supply chain, and GRC frameworks.
Each how-to is a concrete, numbered walkthrough that ends in a matching PlayCISO tool or lab you run in your browser — so you can read the method and then do it, in one place, for free.
Topic hubs
Start here for a whole domain.
The canonical hub: 20 free labs across X.509, TLS, hashing, encryption, signatures, JWTs and key management.
Operational-technology and industrial-control-system security — Purdue model, protocols, IEC 62443, ICS ATT&CK.
Threat-modeling LLM apps, AI bills of materials, MCP server risk, prompt injection and model-file auditing.
Scoping, SAQs, gap analysis and the assessment path for PCI DSS and adjacent compliance programs.
Citable datasets
Reference figures and structured data you can cite.
A citable reference of 30 concrete AI/LLM security risks with impact and mitigation notes.
A structured dataset of industrial-control-system advisories and the exposures they describe.
Benchmark figures for estimating the cost of a data breach by records, sector and cost category.
How cybersecurity spend compares as a share of IT and revenue, by size and sector.
Tool directories
Curated lists of the free tools and labs by purpose.
90+ free, browser-based security tools, grouped by what they do — nothing to install.
30+ free, hands-on security labs you work in your browser, from certificates to detection.
Free threat-modeling tools for applications, LLMs, agents and architectures.
The free AI/LLM security tools on PlayCISO — and an honest note on which capabilities are Pro.
How-to guides
30 step-by-step walkthroughs, grouped by theme. Each ends in a free PlayCISO tool or lab.
Cryptography & PKI
Certificates, TLS, and the cryptographic primitives underneath them.
Inventory, stagger renewals, overlap windows and automate so certs never expire on you.
Order leaf → intermediate → root, catch the missing intermediate, and verify to a trusted anchor.
Pick a strong key, set CN and SANs correctly, and avoid the mistakes that get a CSR rejected.
CRL vs OCSP vs stapling, soft-fail vs hard-fail, and what to do on revoked or unknown.
Pin the public key, keep backup pins, and rotate without bricking clients — and when not to pin.
Client and server certificates, two-way trust, and the handshake failures to expect.
Drop legacy protocols, choose AEAD/forward-secrecy ciphers, add HSTS and stapling — without breaking clients.
Use a memory-hard KDF (Argon2id/bcrypt), salt per user, tune work factors and migrate legacy hashes.
Authenticated encryption done right: unique nonces, AAD, fail-closed tag checks and key rotation.
Shared-secret authentication, canonical payloads, constant-time comparison and key rotation.
Verify the signature, reject alg:none, pin the algorithm, check claims and rotate via JWKS.
Generate → rotate → retire → destroy, separate keys by purpose, and respond to compromise.
AI & LLM Security
Securing LLM applications, agents, models and their supply chain.
Map the system, walk the OWASP LLM Top 10, find trust boundaries and rate residual risk.
Capture models, datasets, dependencies and licenses in SPDX/CycloneDX and keep it current.
Audit exposed tools and permissions, catch tool-description injection, and apply least privilege.
Separate instructions from data, gate tool calls, and test with adversarial inputs.
Inventory use cases, score bias/hallucination/data/security risks and assign owners and controls.
Spot unsafe pickle deserialization, check provenance and license, and prefer safetensors.
SOC, IR & Supply Chain
Detection, response and third-party / dependency risk.
Lockfiles, known-vuln scans, typosquats, install scripts, provenance and continuous monitoring.
Weigh permissions against need, watch for obfuscated code and ownership changes.
Validate true/false positive, scope the blast radius, enrich, and escalate or close with a record.
Map the IR phases, define roles and decision points, and prove it with a tabletop.
Start from an ATT&CK technique, find the telemetry, write precise logic and tune out false positives.
Decide if a breach is reportable, map jurisdictions and the 72-hour clock — a planning aid, not legal advice.
GRC & Frameworks
Programs, benchmarks and the frameworks boards ask about.
Scope, build current and target profiles across the six functions, and produce a gap roadmap.
Add up direct, indirect and regulatory costs with benchmarks — and the levers that reduce them.
Benchmark against peers, map spend to risk, and justify it to the board.
Identity-first, phishing-resistant auth, device posture, microsegmentation and phased maturity.
Work the eight mitigation strategies up through the maturity levels, in priority order.
Rate human, service and AI identities on privilege, credential posture and blast radius.