Security tools we build and use, picked for your role

Ten AIBOMs and cards that pass schema validation and still hide gaps. Find them before an auditor does.

An advisory drops: use AIBOMs to find which AI systems are affected, what they can reach, and what to do first.

Verify model signatures and SLSA provenance, and catch the tampered release before it ships.

12 realistic denial-of-service examples: read the traffic, name the attack.

Spot machine-speed attacks in the logs. Free game.

Six trade-secret cases. What would you do?

Find injected instructions in CLAUDE.md, .mcp.json, hooks, memory and skill files, then preserve evidence first.

Five Claude incidents to scope

Five rounds as the CISO: scope, threats, controls under budget, evidence, the auditor.

Face a certification auditor over 3 audit days

Configure a gateway, replay 40–60 seeded requests, stop the attacks without breaking real users.

Review API pull requests: flag over-returned and over-writable fields, pick the fix, see it fixed.

Hunt undocumented APIs across five evidence sources, classify shadow vs zombie, choose the action.

Classify, approve and roll back three OT changes

Classify, approve and roll back three cloud changes

Classify, approve and roll back three DevSecOps changes

Classify, approve and roll back three server changes

EDR block mode, a browser update wave and a rushed encryption change

Firewall cleanup, a VPN to ZTNA cutover and an emergency DNS block

Admin MFA, break-glass rotation and an SSO certificate that is not an emergency

Run changes across three regions with different freeze calendars, time zones and data-residency limits.

Plan changes at an air-gapped site where nothing can be done remotely and the ferry sets the clock.

Chair a CAB: decide the route, the evidence, the conditions and the calendar for mixed requests.

Keep breach forensics privileged without hiding the facts

Practise defending a data breach class action.

Practise advising on hacking and researcher cases.

Practise legal holds, log retention and security-data discovery

Practise which regime is triggered, who is told and what the notice says

Triage hypervisor incidents — name the layer and the right containment.

Harden a KVM/QEMU host control by control — scored against best practice.

Make the isolation calls a hostile multi-tenant host forces on you.

Strip a VM's emulated device list to the minimum without breaking it.

Close L1TF, MDS and Spectre between VMs without killing performance.

Firecracker vs gVisor vs Kata vs VM vs container, per threat model.

Move a running VM without streaming its memory in the clear.

Decide when a VM-in-a-VM is worth the added escape surface.

Walk the real Stuxnet chain and catch each stage.

Defend a substation against the real 2016 grid attack.

Read the version, not just the protocol name.

Triage real HMI products by their real CVE classes.

Defend a Schneider Triconex SIS against the real 2017 TRITON kill chain.

Triage the modular ICS attack toolkit: asset, protocol, mitigation per module.

Place segmentation controls on a plant map and stop real OT kill chains — without breaking the plant.

Triage a fleet of controllers by vulnerability class, exposure and the right fix.

Map each AI-specific threat to the CIA triad and the mitigation that fits.

Run an internal AI-management-system audit: control area, verdict, corrective action.

Map each of an AI agent’s 8 harness components to its threat and control.

Govern a self-editing agent: which harness edits auto-adopt, which need a human gate.

Trace injection from tool output, RAG, memory or subagents — and contain it.

Grant an agent the least privilege its task needs — and no more.

Decide allow/deny for an AI executor’s outbound requests — stop exfil, SSRF and eval cheating.

Set the trust boundary when an agent spawns subagents.

Decide what an agent should persist across tasks — and how.

Keep agent evaluation honest — no rubric leakage, no reward hacking.

Vet third-party plugins, skills, MCP servers and scripts before an agent runs them.

Audit a deployed self-improving agent: prove what it does and roll it back.

Work a queue of meeting invites and call genuine vs phishing — and the exact tell.

Read Claude-agent OpenTelemetry spans and call it: benign, injection, tool abuse, exfiltration or a runaway loop.

Call direct vs indirect injection and pick the harness patch that closes the channel.

Trace LLM output into its sink and close the vulnerability.

Call the RAG leak or poisoning and the control that closes it.

Name the MCP server attack and the detection that catches it.

Triage AI data leaks — memorization, PII, membership inference, model inversion — and pick the DLP control.

Triage adversarial ML — evasion, poisoning, trojan triggers, extraction, inversion — and name the detection.

Play the runtime policy gateway in front of an AI agent — allow, block or escalate each action, and name the check that catches it.

A jailbreak suite runs in CI — pass, fail or hold the build on attack-success-rate, and name the reason.

Sequence the incident response to a hijacked autonomous AI agent — contain before you touch the evidence.

Correlate leak-forum post metadata: recycled breach, duplicate, same actor, or campaign.

Spot the Stuxnet-style setpoint/logic tamper on the HMI before it trips.

Drive a simulated Modbus network, see it has no auth, then defend it.

Keep the safety system trustworthy against a TRITON-style attack.

Find the real process upset hidden in an alarm flood, under the clock.

Flag the broken certs in a queue of 20 — expired, SHA-1, short key, SAN mismatch.

Assemble a valid cert chain from a jumble; catch the missing intermediate.

Design a CA hierarchy; a validator scores it against best practice.

Decide valid / revoked / unknown from OCSP & CRL evidence — and the right action.

Work a cert fleet’s renewal queue and prevent expiry outages under limited capacity.

Rotate a pinned certificate with zero client breakage — learn backup pins.

Diagnose and fix mutual-TLS handshake failures from the cert & trust facts.

Harden a server’s TLS config to A+ without breaking a required client.

Audit CSRs for mistakes, or build a correct one — CN, SANs, key strength.

Verify integrity with live SHA-256/512 — and learn why MD5/SHA-1 are retired.

Compute & verify real HMAC tags; catch tampering and the length-extension trap.

Encrypt with real AES-GCM; see the nonce-reuse catastrophe and tag tampering fail-closed.

Sign & verify with real RSA-PSS/ECDSA, tamper to break it, and catch the forgeries.

Pick safe PBKDF2 params + salt, crack an unsalted scheme, rank bcrypt/argon2.

Exploit alg:none, weak secrets and HS/RS key confusion — then harden.

Run keys through generate→rotate→retire→destroy and handle a compromise.

Decode real DER into a TLV tree and identify the X.509 structures.

Spot the mis-issued / rogue certs for your domain in a CT feed.

Measure real Shannon entropy and spot the predictable keys (Debian 2008).

Order the TLS 1.2 vs 1.3 handshake and find where downgrade/MITM hits.

Build & read DNS CAA records — restrict which CAs may issue for your domain.

OCSP vs CRL, stapling, must-staple — and the soft-fail revocation gap.

Score your code-signing: HSM keys, timestamping, ephemeral CI signing, revocation plan.

Pick a voice agent’s capabilities, surface its threats and mitigations.

Assign oversight to 10 realistic agent actions; graded on both failure modes.

Build a provenance chain, inject a break, and watch verification fail at the weak link.

A defender’s look at low-bandwidth covert channels and the controls that detect them.

Live a simulated fake-recruiter interview and make 10-12 scored calls

Seven decisions when monitoring and workflow providers join the subprocessor list: sample the data, mask at the source, pass IDs, set retention, handle erasure

Seven decisions when a vendor adds AI subprocessors: data classes, defaults, retention, regulated data, injection and a standing rule

Seven decisions on a vendor notice that says no action required: data map, defaults, deadline, objection and record

Make 12 parent decisions on talking, settings, strangers, scams and what to do if it goes wrong.

Work through passwords, freezes, SIM swaps, phishing and recovery for a fictional person.

Set up banking security, handle a fake fraud call and respond to a bad transfer.

Set up a new Android phone and choose what to lock, share and hide, with the cost of each choice.

Walk a Google Privacy Checkup: activity, location, ads, profile, Gemini and data download.

Walk through a fictional TikTok account and weigh what each privacy setting costs you.

Follow a fictional match from dating app to chat app and decide what to do at every turn.

Walk a Google Account Security Checkup: devices, sign-in, recovery, apps and Gmail settings.

Set up a new iPhone and choose what to share, lock and encrypt, with the cost of each choice.

Walk through a fictional Instagram account and choose who sees, messages and tags you.

Set up a wallet, spot fake apps and approvals, and decide what to do if a phrase leaks.

Face a cloned-voice call, a deepfake boss and a fake trading bot, and choose what to do.

Walk through a fictional Facebook profile and choose who sees, finds and tracks what.

Handle a week of fake Amazon texts, calls, refunds and packages, one decision at a time.

Walk through a new phone's WhatsApp settings and choose what to share, lock and back up.

Walk through a chatbot's privacy settings and decide what to type, share and turn off.

Live the first hour after your email is taken over, and protect every account it unlocks.

Read a week of suspicious WhatsApp messages and decide what to do at every turn.

Sort real warning signs from ordinary phone trouble, then decide what to do first.

Set up a new smart home, router to old devices, and weigh the trade-offs in each setting.

Live the first hour after a code scam locks you out of WhatsApp, and make the calls.

Your Facebook account is taken over. Make the calls in the first hour and see how you score.

Your Instagram was just taken over. Make 11 calls in the first hour and see what you saved.

Delegation, revocation and monitoring, explained

Respond to stolen EC2 role credentials with 11 scored decisions

10 scored AWS hardening decisions from root user to log archive

Triage a fictional Google Cloud incident in 12 scored calls

Harden a fictional Google Cloud estate in 12 scored calls

Secure a fictional Oracle Cloud tenancy in 12 scored calls

Secure a fictional IBM Cloud account in 12 scored calls

Triage a fictional Entra ID takeover and make 11 scored calls

Harden a fictional Azure estate in 10 scored decisions

Run a CASB programme for a fictional SaaS-sprawl company in 11 scored decisions

Work a fictional AWS, Azure and GCP findings queue in 11 scored decisions

Inventory and fix the AI estate of a fictional company in 11 scored decisions

Secure a fictional Cloudflare account in 12 scored calls

Secure a fictional DigitalOcean team in 12 scored calls

Secure a fictional Alibaba Cloud account in 12 scored calls

Decide where an AI agent's credentials live in 12 scored calls

Which agent actions need independent approval, in 12 scored calls

Stop an agent without its help and revoke what it granted

Weigh attribution evidence and word it without over-claiming

Map attack paths to your crown jewels and test the boundaries

Read exposed directory listings and handle them safely

Triage a round-the-clock alert surge as shift lead

Fund the controls that stop an autonomous AI intruder

Find the covert channel hiding in DNS logs

Spot C2 beacons and reverse tunnels in proxy and flow logs

Tell an AI agent intrusion from a human one in the logs

Scope, test and report an AI red-team engagement

Spot jailbreak attempts in chat logs and decide what to block

Respond to a tampered AI coding extension in 12 scored calls

Respond to npm packages that use your AI CLIs in 11 scored calls

Catch slow multi-turn escalation in 12 scored calls

What a bus between two agents should strip, quarantine or pass

Write the policy for a gateway between an AI agent and MCP servers

Let an AI agent act for a user without a password or master key

Cage what an agent can emit, and see what a grammar cannot stop

Spot a model being copied through its API without blocking your best customer

Judge 12 fictional screens a GUI agent might see

Review a fictional AI pull request and MCP manifest in 12 scored calls

Choose the right auth method per scenario — and learn why the wrong pick fails.

Match the correct OAuth 2.0 grant to each app type; retire implicit and password grant.

Choose OIDC vs SAML, then flag the bad assertions in a queue.

Harden session cookies and name the fix for each finding.

Spot the real MFA bypass in each scenario and pick the mitigation.

Pick passkey vs OTP vs password, and spot the WebAuthn misconfig.

Catch over-privileged grants and toxic combinations; know when ABAC beats RBAC.

Find the privilege-escalation chain hidden in a set of cloud IAM grants.

Get access/refresh token lifetimes, rotation, storage and revocation right.

Allow or block each third-party app consent request — spot the over-scoped attacker.

Allow, step-up or block each sign-in from its risk signals — and pick the follow-up.

Keep or kill each rule to build a NIST 800-63B-aligned password policy.

Match the right defenses to each credential-stuffing / spray attack.

Flag the broken SSO config and pick the fix.

Choose the right machine auth, and spot the leaked credential.

Name the AD attack and pick the detection signal + mitigation.

Provision, re-scope and deprovision identities across the JML lifecycle.

Spot the identity attack in an auth-log feed and pick the response.

Decide when an action needs a re-challenge vs a silent allow.

Flag the directory-auth defect — anonymous bind, LDAP injection, cleartext — and fix it.

Decide if a cyber incident is material and when the SEC 8-K clock starts.

Navigate personal accountability after SolarWinds and Uber — what you sign and disclose.

Face a post-breach regulator Q&A without conceding "unreasonable security".

Answer the audit committee on control gaps and remediation without losing trust.

Draft the 10-K Item 106 cyber-governance disclosure without a roadmap for attackers.

Turn technical findings into board-ready dollars — loss ranges, not false precision.

Defend a security investment to a skeptical CFO — risk-reduction and ROSI, not fear.

Set a board-approved cyber risk appetite — thresholds, tolerances, escalation.

Answer the underwriter honestly, close the gaps that move premium, survive the claim.

Pick the board-grade metrics and cut the vanity ones.

Pay or not under duress — OFAC screen first, and who actually decides.

Draft the holding statement and sequence the notifications in a live breach.

Set the paging threshold — when an incident reaches the CEO and board.

The FBI says an APT is in your network — brief the board on partial intelligence.

Facilitate a board-level cyber tabletop — injects, roles, after-action.

A critical SaaS vendor is breached — decide notification, contract levers, blast radius.

Pick a breach scenario — get the exact clauses to add, with a before/after risk read.

Rehearse each security clause: hold, settle or concede — and see what it costs.

Walk a breach through your policy part by part — what pays, what is reduced, what is excluded.

The early moves that make or break a claim — notify, preserve, engage the panel.

After a vendor-caused breach, will your insurer recover from the vendor? Your contract decides.

Pixel & BIPA class actions are exploding — and cyber policies increasingly exclude them.

Rehearse the renewal before the real call — see which moves actually move an underwriter.

Learn the terms that decide claims as quick exercises — not definitions you forget.

Just closed an acquisition — what to connect vs isolate on day one.

Map DORA, NIS2, SEC rules and privacy law to board obligations and deadlines.

Govern AI adoption at board level — risk-tier use cases, tame shadow AI.

Answer "how long could we survive X down?" — critical services, RTO/RPO, SPOFs.

A Global admin phished via adversary-in-the-middle: revoke-first, break-glass, persistence and the federation check.

A supplier bank-detail change, a payment made, and the fraud found 30 hours later.

A resigning engineer uploads designs to personal cloud: confront or preserve, monitor how far, remove access when.

Your customer database is for sale on a forum: verify, scope, start the clocks, handle extortion, notify.

A support agent leaks other customers' orders via a poisoned ticket. Kill switch or prompt patch?

An exploited SSL-VPN, a credential-harvesting webshell and a path to the domain controller. Patch first or image first?

A hijacked npm package steals CI secrets through a postinstall script. Scope the builds, rotate in order, rebuild and tell downstream.

Post-close, the acquirer finds an intruder that pre-dates closing. Branching decisions on command, evidence for the indemnity claim, integration freeze and notification as the new owner.

An access key in a public repo, miners in unused regions and a customer bucket: branching decisions on keys, sessions, persistence, data and the bill.

Ransomware reaches the plant historian and an engineering workstation: shut down or run manually, cut the IT/OT link, check controllers safely, restore.

Classroom capstone: a phished login cascades into cloud keys, a customer data export, extortion and notification clocks. Up to 12 decisions across four playbooks.

Friend-request scam simulator — accept the real, reject the fakes.

Scam-call simulator — answer or decline five incoming calls.

Survive a 10% budget cut, get a CISO Score, challenge a colleague.

Six-phase acquisition scenario with ransomware incident, dual roles, and NPC advisors.

Upload your resume, get a 60-second cinematic video with AI voiceover.

Model the token, cost and latency blow-up of a self-improving (Harness²-style) agent before you build it.

Run the harness you designed as a bounded ReAct loop against your own API key — in your browser.

A supermarket refrigeration ransomware sim — save the cold chain, scored.

Starter capture the flag challenges you solve in your browser, with hints.

Sort real-world scenarios into confidentiality, integrity or availability.

Tamper-evident log of what an agent did

See what the model gets, and what still leaks

Watch a breach move through your enterprise, live.

Will an underwriter decline, surcharge or quote you? See it before you apply.

Split an incident across coverage parts — see what the policy absorbs vs what you retain.

Plan an authorised audit of your own public systems.

Rank the vendors that hold your keys by exposure.

What port 445, 139, 3389 or any of 120+ ports does, its internet risk and a block rule.

Will your backups survive ransomware? Every system checked against 3-2-1-1-0.

Who can switch your model's safety off per request?

Build a CTI aggregator on a 45-minute daily reading budget.

Answer an AI security assessor's questions; scored on evidence, owner, specificity and overclaiming.

Clause 9.2: a risk-based 12-month audit programme with independent auditors

Find the security gaps in an OpenAPI or Swagger spec, mapped to the OWASP API Top 10 2023.

Practice spotting the bad logs in a stream of 1,000.

Six more log triage tracks with Bronze, Silver and Gold certificates.

Spot the attack in MDM, logcat and iOS logs.

Find the bad event in audit, admission and runtime logs.

Airline and airport cyber logs: EFB, data loaders, cabin Wi-Fi.

Ship and port logs: ECDIS, AIS, GNSS, satcom.

EHR, PACS, HL7 and medical device logs.

Telematics, OTA, app API and charger logs.

Daily scanning of npm packages — download the same tool for your own repos.

Can you catch the poisoned package before npm install runs it?

Catches "ignore prior instructions" before your agent does.

Browse the public leaderboard free; scan your own server with Pro.

Red-team a model endpoint you control — part of PlayCISO Pro.

Score a Chrome extension by what it can actually do — part of PlayCISO Pro.

Check VirusTotal’s existing scan results — part of PlayCISO Pro.

Find internet-exposed AI agents on your own hosts.

Vet an Agent Skill before you install it — never runs it, so scanning can’t infect you.

Curated threat research, filterable 10+ ways.

Interactive graph of actors, origins, and targets.

Translate threat actor names across Microsoft, CrowdStrike, Mandiant & more.

Generate injection test cases and scan your system prompt for weaknesses.

Paste response headers, get a graded report and copy-ready fixes.

Scan code, config or .env for leaked API keys & secrets — 100% in your browser.

Paste an AWS IAM policy; flag wildcards & privilege-escalation risks. In-browser.

Paste an S3 bucket policy; find public exposure & misconfig — in your browser.

Paste security-group rules; flag 0.0.0.0/0 on sensitive ports — in-browser.

Paste an IAM trust policy; find over-broad AssumeRole & confused-deputy risk.

Compare AI agent benchmarks by domain, grading method and size — and find the one that fits your use case.

Paste a meeting invite or .ics file; flag the phishing signals before you click.

Paste a ransom note; get heuristic family signals, IOCs to preserve and the first-response checklist.

Build an ISO 19011 AI audit programme and an EU AI Act Art.73 incident register.

Paste an MCP config/manifest, get a static security review — no SSRF.

See how text clusters — live similarity heatmap + 2-D map, in your browser.

Paste OT firewall rules; flag IT→OT any-any, RDP into cells, DMZ-skipping.

Paste a BMS/refrigeration controller config, get the exposure findings.

Filterable reference of 20+ OT protocols — ports, auth, weaknesses, detection.

Defensive lookup of ICS device credential posture & CVE themes by vendor.

Paste an ICS traffic log; flag unauth writes, scanning, floods.

Paste a Shodan/Censys export of your hosts; find exposed OT.

Paste a workflow YAML; flag pull_request_target, unpinned actions, write-all & leaked secrets.

Blast radius of any GitHub token type & scope — and why 2FA will not save a stolen one.

What to alarm on in the GitHub audit log — with copyable detection notes.

Turn CVSS severity into risk-based priority with real-world context.

Collapse the same flaw reported by SAST, DAST and SCA into one.

Paste a link and see the warning signs in how it is written: look-alike names, @ tricks, shorteners.

Is this CVE in CISA KEV? Check up to 500 at once.

Your application is a warranty — an inaccurate answer can void the claim. Check it.

Paste your policy; flag the risky clauses, each with the question to ask your broker.

Is your wire-fraud loss actually covered? Check the endorsement, gap and controls.

Will your policy let you use your own IR firm — or deny the cost?

Is port 445 putting you at risk? A rating and a block-or-harden plan, without scanning anything.

Would your logs prove who did what, and when? Score them against NIST AU-9 and AU-10.

Would your policy actually pay in this scenario? Walk the real gaps, not a checklist.

An honest recall-likelihood band, who to call in order, and a mailbox triage checklist.

Tick the logs you have enabled and see which incident questions you could not answer, the retention gap and the fixes in priority order.

Paste your breach response plan: 31 elements found, partly or missing, common traps, a score and the five fixes to make first. Runs in your browser.

Grade your logs on the questions an incident will ask.

The same AIBOM field in CycloneDX, SPDX 3.0, Croissant, Annex IV, the GPAI form and HF cards.

Paste a model card and see which sections are present, weak or missing, with the fix for each.

Score your AI supply-chain transparency across six domains and get a one-page board summary.

Annualized loss expectancy worked step by step, with a ranked risk table and a control check.

Rate all 19 NIST SSDF practices across PO, PS, PW and RV, scored.

Which certification next, in what order, for your role, budget and time.

Score a human, service or AI identity 0–100.

A $1M budget, 10 cyber risks, one year. Free game.

Are you ready for machine-speed intrusions?

How ready are you for a DDoS attack?

Rate a SaaS vendor on the controls you rely on.

Could you investigate Claude misuse today?

Five maturity levels with indicative months between them. Guidance only.

People-days per phase, a cost range and annual effort for 27090 adoption

Score your API security 0–100 with OWASP API Top 10 2023 gaps

Ten answers to a phased API security program mapped to the OWASP API Top 10 2023

Estimate your AI spend and get a ranked list of ways to cut it.

Should this MCP server be allowed in your environment, and under what controls?

Score a refusal-removed ("uncensored") LLM before it enters your environment.

Pick a persona for an instant benchmark, or build your own.

Rank 15 enterprise vendors by CVSS 10.0 vulnerability count — part of PlayCISO Pro.

Score a vulnerability in CVSS v4.0, v3.1, v3.0 or v2.0 and get the vector string, or decode one from a CVE advisory.

Map your AI stack to the OWASP LLM Top 10 and MITRE ATLAS.

Score your cloud security posture across 8 domains — in your browser.

Score your AWS hardening against CIS benchmark sections — in your browser.

Score a vendor’s security and generate a questionnaire — in-browser.

Score your SOC 2 readiness across the Trust Services Criteria — in-browser.

Score your ISO 27001 readiness across Annex A 2022 & the ISMS — in-browser.

Compare KVM, Xen, ESXi, Hyper-V, Firecracker & more — in your browser.

Compare the per-run and monthly cost of an agent across models — using your own prices.

Seven incident questions return a reasoned, OFAC-aware recommendation — payment only ever as a gated last resort.

Score seven readiness dimensions and get a band, a radar and the gaps to close first.

Score your release pipeline + developer-account controls against the supply-chain gaps that ship malware under your own name.

Walk your role and use case to the EU AI Act risk tier, obligations and phased timeline.

Build a rated harm register and an exportable AI impact-assessment report.

Score bias and explainability readiness and export a draft model card.

Score your AI SDLC against the CISA/NCSC Secure AI Development guidelines.

Can you actually audit your AI agents from their traces? Score it.

A trusted CA just had its keys stolen. How fast can your fleet stop trusting it?

Compare any two carriers or quotes on what actually matters — neutral, no invented premiums.

Self-gauge readiness for the first AI-security-threats standard — in-browser.

30 incident-grounded AI risks with severity scoring and a CSV download.

Put a number on a cooling outage or plant-down event.

Score a zone’s achieved vs target Security Level across the 7 FRs.

Crosswalk OT controls across IEC 62443, NERC CIP and NIS2 with a gap heatmap.

Filterable ICS-CERT-style advisories with exploited-first prioritisation.

Score how likely a breach could push your business toward insolvency.

Score crypto-agility & PQC readiness — inventory, agility, shorter certs, ML-KEM/ML-DSA.

Full-duplex / speech-to-speech models compared on security, hosting & openness.

Rate readiness to deploy a speech-to-speech model securely across 5 areas.

Score your vuln-management program crawl / walk / run across six areas.

Describe an AI action; get the right oversight level — and a warning if you are over-gating.

Score AI provenance 0–100 across input, output, audit trail, supply chain & verification.

Official BLS pay by security role and experience, with your own pay placed in the range.

Find your CMMC level, then score all 110 NIST SP 800-171 requirements for an SPRS score.

HIPAA violation fines by tier: per-violation range and annual cap from 45 CFR 102.3.

Build an nmap command and see what every flag does. Writes text only; it never scans.

Answer yes/no questions and get a personalised cleanup plan. Nothing leaves your browser.

Two interactive checklists for fake job interview lures, by stage

Score 38 signing-service and hot-wallet controls

Five answers, one CISA decision: Track, Track*, Attend or Act, with the matching row of all 36 highlighted.

Score an agentic AI vulnerability with OWASP AIVSS: the v0.8 AARS formula and the 1.0 Effect Class lookup, working shown.

EPSS score, percentile and 30-day trend for any CVE.

Your patch deadline from CISA BOD 26-04 Table 1.

Weighted AWS self-assessment across eight domains with per-domain gaps

Weighted score and gaps across six Google Cloud security domains

Weighted score and gaps across six Oracle Cloud security domains

Weighted score and gaps across six IBM Cloud security domains

35 weighted Azure controls with per-domain gaps

Weighted score and gaps across six Cloudflare security domains

Weighted score and gaps across six DigitalOcean security domains

Weighted score and gaps across six Alibaba Cloud security domains

Score what an AI agent on your workstation could reach

Score the environment your AI agents run in

A printable test plan for any managed agent product

Your agent controls beside two published surveys

Every risk from all three studios, board-ready.

Headline limit vs what a ransomware claim actually pays — after sublimit, coinsurance, waiting period.

Is your claim excluded as "state-backed"? Walk the LMA war-exclusion tests.

When does BI cover actually start? Model the waiting period and the hours you absorb.

The controls that cut breach risk AND insurance cost — find your double-impact gaps.

The rebuild your policy won’t fully pay — model the betterment + depreciation shortfall.

Which regulatory fines can cyber insurance actually pay? It depends on the law.

Not a made-up number — a defensible read on whether your tower is thin for your exposure.

Walk every Security Rule safeguard and get a prioritised gap report.

How exposed is your crown-jewel IP to insiders and corporate espionage?

See which security layers are covered, thin or missing, and what to add next.

A higher deductible cuts premium but hands you more of every loss — see the real trade-off.

A critical vendor outage can stop your revenue — but is it actually covered?

As premiums rise, does retaining cyber risk beat buying it? The honest build-vs-buy math.

No made-up premium — an honest, cited, relative read of your sector’s cyber risk.

Score readiness across the master plan, all 12 domain playbooks and the supporting policies, and see your three weakest areas.

What a compromised account can reach, containment in priority order with time estimates, and a severity hint.

Every deadline from the moment you became aware — GDPR, SEC, NIS2, DORA, HIPAA, NDB, PIPEDA, PDPA, US states — sorted, with a countdown.

Tables and row counts to unique people, a sensitivity tier, the regimes likely to trigger and a rough cost range.

Per segment: isolate now, contain and monitor, or full disconnect — with reasons, the cost of each option and what to capture first.

Stop builds installing packages that are hours old.

An owned, dated checklist across five security areas.

Restrict leaked-key damage: plan network allow-lists per platform.

Know what every key is, who owns it and what to rotate first.

Replace long-lived cloud keys with short-lived workload identity.

Search, shuffle or pick by who is in the room; copy the prompt for your next exercise.

A timed tabletop runbook: roles, injects, questions, scoring and after-action.

A 30-day launch plan and a monthly 5-minute lesson calendar for your team.

33 cloud skills for SOC analysts across AWS, Azure and Google Cloud, scored.

One AI system as a CycloneDX ML-BOM, an SPDX 3.0 AI + Dataset file and a Croissant RAI file, every field explained.

Answer the Datasheets for Datasets questions once; get a scored card, a Hugging Face README and a Croissant RAI file.

Seven questions place you as CISO, SOC analyst, GRC or AppSec and show the six AIBOM fields that matter most to you, with a reading path through the AIBOM Library.

Draft Annex IV technical documentation or the GPAI Model Documentation Form item by item, with completeness per section.

The gate a model passes before production: provenance, integrity, documentation, testing, runtime and approvals.

Which attestations you need for an AI model, who can issue each, and the evidence behind them.

Which do you need first: SIEM, SOAR, XDR, MDR, or better logging?

Is this MCP server safe to use? 28 checks tailored to how you run it, scored.

Score every service account, API key and CI/CD token, then plan the move off static keys.

FIDO2 keys, passkeys or soft tokens? A mix per user group, mapped to NIS2, DORA and PCI DSS.

Pick a threat and environment; get MITRE ATT&CK test cards, a coverage score and an agenda.

Describe your AI agent; get a layered guardrail plan with examples and a risk level.

Your current cyber policy vs a new quote, side by side: switch, stay or negotiate first.

Where to plant honeytokens and decoys, and which log event to alert on.

One master plan, a playbook per incident type: checklists, tools and labs for 12 domains.

Spot the flaws before the hunt starts. Free lab.

Threat hunting on a budget. Free game.

Rate the intel, spot the weak claims. Free lab.

Buy controls, race the attacker's clock. Free game.

Lock down App Service publishing and the SCM site.

What did your purple team actually detect?

Build your ISO 27001 ISMS documents step by step.

Triage a timed threat intel feed: tactical, operational, strategic or noise.

Pivot from one domain to the campaign, the actor and a CISO brief.

Hunt an intruder in a streaming Claude Enterprise audit and telemetry feed: benign, suspicious or evasion?

Save the Claude evidence before it ages out

Seven phases, RACI owners, deliverables and a timeline for adopting ISO/IEC 27090.

Scope statement, AI threat register, risk treatment, policy, RACI, test log, review agenda.

No. What can certify or attest your AI security instead, and how to check a certificate.

Sixteen roles × 94 AI security activities, with a one-Accountable check.

Editable phases, tasks, owners, deliverables and indicative durations.

Ten roles against clauses 4–10 and Annex A areas A.2–A.10.

Scope to Stage 2 in twelve phases, with owners and indicative durations.

Six stages of AI-security labs grouped by ISO/IEC 27090 threat themes, with progress per lab.

Trace each AI threat to its controls, tests and evidence

Safe 27090 wording for trust pages and RFPs

Log findings, root causes and corrective actions (clause 10.2)

Who secures what: provider, customer or shared

One-page board brief and 5 slides with speaker notes

20 AI security KPIs and KRIs mapped to 27090 threat themes

Measurable AI objectives with owners, resources, dates and KPIs

Clause 4: context, interested parties and a draft AIMS scope

Clauses 7.2 and 7.3: AI roles, target levels, people, evidence and gaps

Clause 7.5: every AIMS document and record with owner, review and retention

Six 90-second modules on ISO/IEC 27090 with quizzes, a 10-question check and a learning badge.

12 months of AI security reviews with owners, as an .ics calendar

A.2 to A.10: what good looks like, audit evidence and common findings

Plan back from your certificate date: internal audit, Stage 1, Stage 2, decision

What an AIMS and an ISMS can share, merge or keep separate

Answer 8 questions, get a full API security policy

Why per-IP limits alone fail

Every PlayCISO API security lab and tool as a learning path

Maturity wheel, roadmap, crosswalk, audio flashcards & tabletop.

200+ examples across every technique — study them, then score your own.

A static audit of your MCP server config.

A bill of materials for your AI stack — part of PlayCISO Pro.

A resume critique tuned to security roles and your market.

Score your AI system against the OWASP AI Security Verification Standard — in-browser.

Gamified practice for CSA, IAPP, ISACA, and ISO/IEC 42001.

Check a host for IOCs from the March 2026 LiteLLM supply chain attack.

Interactive reference architecture — identity, guardrails, observability.

Real, cited market data — no invented premium formula.

Ontologies that reason — change one rule, see the blast radius, with a consistency verdict.

Toggle components, get a STRIDE register mapped to 6 frameworks, explore it as a knowledge graph, export a PDF.

Generate a CISO scope, RACI and 30/60/90 by org size and maturity.

A key leaked? Get a provider-specific incident runbook — in your browser.

Rotate keys without a lockout — a safe-order runbook, in your browser.

Generate an incident response plan from a short questionnaire — in-browser.

Scope a pentest and generate an RFP from a questionnaire — in your browser.

Build an RBAC matrix and spot over-permissioning — in your browser.

Assess your SSRF defenses and get a hardening report — in your browser.

Harden a KVM/QEMU host — 22 controls, track progress, export.

12 Pro templates: SoA, impact assessment, mock audit, crosswalk, test plan and more.

12 Pro templates for deals: due diligence, deal impact, 100-day plan, IC memo and more.

Compose an agent harness and get a diagram, a thesis, and a capability/cost/robustness/security score vs Harness².

Compare agent-harness architectures side by side — Harness², ReAct, Reflexion, DSPy, GEPA, ADAS.

Answer a few questions; get the agent-harness pattern that fits — with a transparent why.

See how an agent’s context window fills up — and exactly when it overflows.

Draw your agent/subagent topology and get a blast-radius and trust-boundary read.

Build a defensible agent-evaluation rubric — and see how much of the score is actually reproducible.

Instrument AI tracing without turning your observability stack into a new data-leak surface.

Can you trust a local LLM notetaker or on-device AI assistant? Score it.

Run REA and similar AI reverse-engineering tools safely — a defender checklist.

Adopt, migrate, or offload AI — checklists, readiness scores, project plans.

Answer 9 questions, get a threat model mapped to the OWASP LLM Top 10.

Build a small LLM pipeline, then attack it to see injection break it.

Run a small open-weights model locally — no key, no cost, nothing uploaded.

Place OT assets into Purdue levels, draw conduits, get scored on IEC 62443 segmentation.

Toggle OT components, get the MITRE ATT&CK® for ICS matrix + prioritised mitigations.

Rank PLCs/HMIs/RTUs by criticality × exposure; fix the worst first.

Score the branch & ruleset protections that stop a bypass — required reviews, no admin bypass, blocked force-push.

Score your supply-chain publishing — pinned source, OIDC trusted publishing, attestation, human gate.

Worksheet + checklist for owners, SSO, token hygiene & offboarding that limit an identity compromise.

The LiteLLM GitHub-identity compromise, step by step — and the control that breaks each link.

Stop a workflow leaking the secrets it can reach — least-privilege token, OIDC, environment gates.

GitHub, GitLab, Bitbucket, Gitea & Forgejo compared on security controls and hosting model.

Score your defenses against deepfake-voice / fake-CEO-call fraud.

Set SLA windows per severity and track due dates, days left and breaches.

Flag approval gates missing on high-stakes actions and wasted on trivial ones.

Score AI media provenance: C2PA, signing, durable watermarks, disclosure, chain-of-custody.

Translate, hear and see Morse — audio beeps, a blinking light and a reference chart.

A filterable timeline of Morse and signals-intel history, with a security lesson on each.

Click any of the 7 layers for protocols, devices, typical attacks and the control that stops each.

What SOX Section 404 requires of IT and a checklist across access, change and operations controls.

Build Wireshark display filters from dropdowns, with a cheat sheet checked against the Wireshark docs.

Make cyber security memes in your browser: two astronauts, reject/approve, expanding brain and more

Turn a notice date and an objection deadline into a dated plan, grounds to consider and a draft holding reply or objection

Paste last quarter's and today's subprocessor lists and see what was added, removed, renamed or moved, in your browser

Which agent actions run alone and which need a human

Minimum scopes for one agent task

Draw the system, let an AI copilot map the threats.

Blueprint a reference architecture with live compliance coverage.

Paste an RFC, triage the findings, sign it off.

Design the team before you hire it.

The ten projects every program runs — fully packed.

Security contract clauses — strong vs weak vs red-flag, plus the terms teams add after a breach.

Stack retention + primary + excess layers, add a year of losses, watch them erode.

Prepare the control evidence underwriters want — and that protects your claim.

Have the controls you attested at bind slipped into a rescission risk?

Before a ransom is even an option: is it lawful, and will insurance reimburse it?

Which intrusion detection layers fit your environment, and where they go.

Security key, OTP fob, smart card or passkey, ranked for your users and apps.

Which testing your app needs first, then a DAST scope you can hand to the scanner team.

Which cloud-native protection capabilities your estate needs first, and what to ask vendors.

Draft CAIQ answers by CCM domain, catch weak ones, export CSV.

Which levers actually move your cyber premium, ranked for your company.

Tick what you do, get the exact endorsements to ask your broker for — paste-ready.

Same limit, very different policy — compare your quotes apples-to-apples, not on premium.

Tick what you are seeing and get a SEV1–SEV4 level, the playbooks to open, who to wake up and the clocks that may apply.

Check the shared core of your IR plan: roles, severity, escalation, privilege, notification decisions, evidence, recovery and testing.

Who is responsible and accountable for each response activity, the on-call roster with deputies, and the external contacts you will need.

Scope, contain (sessions, tokens, MFA, OAuth grants, keys), remove persistence, recover, notify and harden.

Bank recall first, then mailbox rules and forwarding, scope, supplier call-back, reporting, insurer and payment controls.

HR and legal first, evidence, proportionate monitoring, access-removal timing, departing-employee data and subject privacy.

34 steps from awareness to close-out: preserve, contain the exfiltration path, scope, assess harm, decide each notification, communicate.

A vendor says it was breached: the questions email, your internal actions by integration, and whether your own clock has started.

31 steps: verify, cut or restrict vendor access, hunt in your logs, get facts in writing, meet your duties, re-assess the supplier.

Prompt injection, AI data leakage, agent tool misuse and poisoned MCP servers: kill switch, evidence, rollback, notification.

Edge device triage, evidence before reboot, segment isolation, AD eviction with the krbtgt double reset, C2 blocking, rebuild and monitoring.

Freeze pipelines, revoke CI tokens, deploy keys and OIDC trust, rebuild runners, verify artefacts and notify downstream consumers.

Many secrets leaked at once: an ordered rotation runbook by power, exposure and dependencies, verifying each new credential before revoking the old.

Thirty weighted questions that surface past and ongoing breaches at a target: incident register, notifications, insurance claims, dark-web exposure, compromise assessment and litigation.

Who leads an incident at the acquired company on Day 1: command, merged on-call, retainer and insurer notice, interim severity model, notification owner, log access and TSA terms.

Compare two companies' IR plans row by row and get gaps, conflicts, a Day-1 interim decision per row and a merged RACI to copy.

Systems table with RPO, RTO, immutable and offline copies and restore tests; flags RPO gaps and overdue tests, with policy text.

Records schedule with legal basis, archive tier, deletion method and legal-hold override, and security logs kept long enough to investigate.

Evidence register with SHA-256 hashes and UTC times, a transfer log with hash verification and a handling checklist.

Pre-approved statements for six incident types, for customers, staff, media and regulators, plus the rules that keep them safe.

Blameless review with timeline, root cause, contributing factors, a tracked actions list, time to detect and resolve, and sign-off.

Provider-neutral steps with AWS, Azure and Google Cloud examples: revoke keys and live sessions, snapshot before terminating, preserve logs, sweep every region.

Safety first: who can stop the process, engineering on the team, no scanning fragile devices, OT evidence, IT/OT isolation and restoring logic from known-good.

Sort OT assets into isolate now, isolate with an operator, monitor only, or shutdown decision, with the reasons and how to isolate each.

Shrink a PDF by recompressing its images — text stays sharp.

Re-encode a video down to something you can actually send.

Photograph a document, get a perspective-corrected scanned PDF.

IPv4 & IPv6 CIDR, mask and host-range calculator.

Compute MD5, SHA-1/256/384/512 and CRC32 of text or files — 100% in your browser.

Encode & decode Base64 — text, files & images, in your browser.

Percent-encode or decode URLs and text — component vs whole-URI, + vs %20, and a query-string breakdown.

Decode a JSON Web Token and verify its signature — 100% in your browser.

Convert Unix timestamps to dates and back — in your browser.

Generate v4/v1/v5/NIL UUIDs in bulk — 100% in your browser.

Generate strong random passwords & passphrases in your browser.

See your public IP and exactly what it reveals — instantly.

Translate text to Morse code and back — with audio playback.

Convert text to binary and binary to text — in your browser.

Test and debug regular expressions live — matches, groups, replace.

Encode, decode and brute-force a Caesar shift cipher.

Encode and decode a keyword-based Vigenère cipher.

ROT13 (and ROT5 / ROT47) text encoder and decoder.

Look up A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records.

Look up domain and IP registration via RDAP — in your browser.

Find the vendor behind any MAC address from the IEEE OUI registry.

Convert between hex, decimal, binary and octal — in your browser.

The full ASCII table — decimal, hex, binary, char and control codes.

Pretty-print, validate and minify XML in your browser.

Convert JSON to CSV and CSV to JSON — in your browser.

Generate secure random strings, tokens, hex and base64 — in your browser.

Identify a hash type by its format — MD5, SHA, bcrypt, NTLM and more.

Chain Base64, hex, XOR, gzip, URL and defang steps in your browser.

Compare two texts and see the differences — line and word level.

Format, beautify and minify SQL in your browser.

Explain a cron expression in plain English and get the next run times.

Validate, format and convert YAML ⇄ JSON — in your browser.

Encode and decode HTML entities (named, decimal, hex).

Generate a TOTP 2FA code from a secret — RFC 6238, in your browser.

Convert CIDR to an IP range and a range back to CIDR blocks — IPv4 & IPv6, in your browser.

Create and sign a JWT (HS256/384/512) from a header, payload and secret — 100% in your browser.

Convert Unicode domains to Punycode (xn--) and back, with homograph detection — in your browser.

Generate a keypair and a real CSR (RSA/ECDSA) in your browser — the private key never leaves your device.

Turn any text into a clean URL slug — accents transliterated, in your browser.

How secure is my password? Entropy, score & crack time — 100% in-browser.

Beautify, minify & validate JSON — in your browser.

Parse any user-agent into browser, engine, OS, device & CPU.

Decode an X.509 certificate or CSR — fields, SANs, expiry & fingerprints.

Generate and verify bcrypt password hashes — in your browser.

Convert Markdown to clean, sanitized HTML with live preview — in your browser.

Share text via a link the server can’t read — encrypted before it leaves your browser.