Tools we build and use ourselves

Score a human, service or AI identity 0–100.

Scores any identity — human user, service account or AI agent — across blast radius, authentication strength, exposure, governance and monitoring, and bands it Low to Critical.

Practice spotting the bad logs in a stream of 1,000.

An inbox of 1,000 synthetic logs from across the stack — identity, EDR, firewall, email, DNS, cloud.

Friend-request scam simulator — accept the real, reject the fakes.

A simulation game: incoming friend / follow / connection requests pop up one at a time — accept the genuine people, reject the fakes and say why.

Scam-call simulator — answer or decline five incoming calls.

Five calls come in over a Microsoft Teams-style screen — family, colleagues and scammers.

Maturity wheel, roadmap, crosswalk, audio flashcards & tabletop.

Score your NIST CSF 2.0 maturity as a visual wheel and heat-map, build a tier roadmap, cross-walk to CIS / ISO 27001 / SOC 2 / PCI, and drill the framework with browser-audio flashcards and a spoken ransomware tabletop.

Daily scanning of npm packages — download the same tool for your own repos.

PlayCISO scans the top npm packages daily against 50 risk policies (install scripts, ownership changes, typosquats, obfuscation).

Catches "ignore prior instructions" before your agent does.

Enforces the one rule that actually stops prompt injection: forwarded content is data to read, never instructions to obey.

200+ examples across every technique — study them, then score your own.

100+ defanged real-world prompt-injection and jailbreak attacks across every technique (DAN, ignore-previous, system-prompt extraction, indirect injection, exfiltration) plus 100 healthy prompts to contrast — filterable, highlighted, and paired with a 25-rule browser-side scorer for your own prompts.

A static audit of your MCP server config.

Paste your MCP config; it flags plaintext secrets, unpinned installs, shell pipes, and over-broad filesystem roots.

Browse the public leaderboard free; scan your own server with Pro.

One standard MCP handshake (no exploitation, ever) scored against 27 deterministic rules — auth, dangerous capability exposure, prompt injection, input validation, transport hygiene, and description-change detection across scans.

Red-team a model endpoint you control — part of PlayCISO Pro.

Runs an adversarial suite — jailbreak, injection, secret-leak — against your own model endpoint and hands you the replies.

Score a Chrome extension by what it can actually do — part of PlayCISO Pro.

Give it an extension ID; it pulls the live Web Store manifest and scores the permission combinations nobody reads.

A bill of materials for your AI stack — part of PlayCISO Pro.

Turns a package.json or models/datasets manifest into a CycloneDX-style inventory with a license-risk read per component.

A resume critique tuned to security roles and your market.

Grades your resume for a specific role and market, rewrites the flat bullets, and finds the ATS keywords you’re missing.

A verification standard for AI systems — in development.

An ASVS-style verification standard for AI systems, still being written — the one thing here you can't run yet.

Gamified practice for CSA, IAPP, ISACA, and ISO/IEC 42001.

600+ questions across four AI security/governance certifications — CSA AI Security, IAPP AIGP, ISACA AAIA, and ISO/IEC 42001 Lead Auditor.

Survive a 10% budget cut, get a CISO Score, challenge a colleague.

One shared board per week, a server-graded CISO Score out of 1000, a live leaderboard, and challenge links that make a colleague play your exact scenario.

Six-phase acquisition scenario with ransomware incident, dual roles, and NPC advisors.

6 phases · 2 roles · ~3h · cyber incident · 7 NPC advisors

Upload your resume, get a 60-second cinematic video with AI voiceover.

Extracts your career story, writes a narrative script, records motion graphics with professional AI voiceover, and delivers a shareable MP4.

Estimate your AI spend and get a ranked list of ways to cut it.

Upload a usage CSV, scan a website for the AI it runs, or paste your provider usage.

Should this MCP server be allowed in your environment, and under what controls?

Applies the OWASP MCP Governance & Risk framework: four non-negotiable gates (owner, logging, scope, review), a Tier 0-4 classification, and an eight-factor risk score, returning an approve / conditional / block verdict with the controls to add.

Score a refusal-removed ("uncensored") LLM before it enters your environment.

Nine questions about a refusal-removed model — type, provenance, custom code, deployment, data access, users, agent tools, governance, authorisation — return a banded 0–100 risk score and the controls that bring it down.

Check a host for IOCs from the March 2026 LiteLLM supply chain attack.

A free, local, single-file Python script — no network calls, no telemetry.

Check VirusTotal’s existing scan results — no API key, no signup.

Look up an existing malware/reputation verdict for a file hash, URL, domain or IP, powered by VirusTotal’s free VTAI API.

Interactive reference architecture — identity, guardrails, observability.

Click through all 9 components of a production agent-governance architecture — zero standing privilege, policy enforcement, quarantine, audit trail — and self-score your own environment’s maturity live on the diagram.

Real, cited market data — no invented premium formula.

Average incident cost by revenue band (NetDiligence), U.S. market-wide premium trends and loss ratios (Aon/NAIC/Marsh), and the top 10 carriers by market share — every figure sourced and linked, with no fabricated per-control discount.

Curated threat research, filterable 10+ ways.

Real APT, ransomware, malware and supply-chain research from major vendors, filterable by category, source, threat actor, origin, target sector, target region, confidence and date.

Interactive graph of actors, origins, and targets.

The same curated threat-intel dataset visualized as a force-directed graph — threat actors connected to suspected origins, target sectors and target regions, sourced entirely from vendor research.

Translate threat actor names across Microsoft, CrowdStrike, Mandiant & more.

172 threat actors from Microsoft’s official naming taxonomy, cross-referenced with aliases from CrowdStrike, Mandiant, ESET, Kaspersky and community names.

Toggle components, get a STRIDE register mapped to 6 frameworks, explore it as a knowledge graph, export a PDF.

Pick one of 10 industry profiles, switch 13 architectural assets on or off, and get a threat register for every resulting trust boundary — 62 threats mapped to the OWASP Agentic AI, LLM, MCP and AppSec Top 10s, MITRE ATLAS and the NIST AI RMF, with controls, likelihood × impact scoring, a heatmap, a knowledge-graph view and a real-world incident overlay.

Shrink a PDF by recompressing its images — text stays sharp.

Recompresses the embedded images inside a PDF, which is almost always what makes a scanned or exported PDF huge.

Re-encode a video down to something you can actually send.

Re-encodes an MP4 with H.264 at a lower bitrate and resolution.

Photograph a document, get a perspective-corrected scanned PDF.

Drag the four corners onto a photographed document’s edges and it’s perspective-corrected, enhanced (color, grayscale or high-contrast black & white) and assembled into a high-resolution multi-page PDF.

Pick a persona for an instant benchmark, or build your own.

A condensed, SOC-CMM-inspired maturity model across Business, People, Process, Technology and Services.

Rank 15 enterprise vendors by CVSS 10.0 vulnerability count.

Free interactive tool ranking 15 enterprise vendors by CVSS 10.0 vulnerability count, confirmed exploitation rate, and computed fragility score.

Share text via a link the server can’t read — encrypted before it leaves your browser.

AES-256-GCM encryption happens client-side; the decryption key lives only in the share link, never on PlayCISO’s servers.

30 incident-grounded AI risks with severity scoring — free CSV download.

30 AI-specific risks grounded in documented incidents (Samsung data leak, $25M deepfake fraud, prompt injection, EU AI Act deadlines), each with likelihood × impact scoring, recommended controls and links to PlayCISO tools. Download the full register as CSV.

Adopt, migrate, or offload AI — checklists, readiness scores, project plans.

Interactive checklists for adopting Claude, ChatGPT, Gemini, or DeepSeek across your engineering org. Migration planner between platforms. Offloading guide for going back to manual. Readiness assessment, 20-week project plan, CSV exports.