30-Day Security Sprint Planner
Five areas, each action tagged Immediately or Within 30 days. Give every action an owner and a date, tick it off, and watch the score per area move. Then copy a one-page summary for leadership. It saves in your browser and sends nothing anywhere.
Ticks, owners and dates are saved only in this browser (local storage). Nothing is sent to a server.
Corporate environment
- Immediately
- Immediately
- Within 30 days
Development environments
- Within 30 days
Code
- Immediately
- Within 30 days
- Within 30 days
Third-party dependencies
- Within 30 days
Monitoring
One-page leadership summary
# 30-day security sprint: leadership summary Progress: 0 of 28 actions done (0%). Checklist adapted from Jack Cable, "A Practical Guide to Security in November 2026", 4 Nov 2026 (X/@jackhcable). The recommendations are the author's. ## By area - Corporate environment: 0 of 8 (0%) - Development environments: 0 of 8 (0%) - Code: 0 of 4 (0%) - Third-party dependencies: 0 of 4 (0%) - Monitoring: 0 of 4 (0%) ## Still open: Immediately - [ ] Require phishing-resistant MFA with device-bound sign-in. (Owner: unassigned; Due: no date) - [ ] Audit the public-facing attack surface: point a coding agent at your public domains, and assume public systems are already targeted. (Owner: unassigned; Due: no date) - [ ] Give everyone a password manager. (Owner: unassigned; Due: no date) - [ ] Deploy an ad blocker for all employees. (Owner: unassigned; Due: no date) - [ ] Scan developer machines for secrets (for example with TruffleHog). (Owner: unassigned; Due: no date) - [ ] Audit installed extensions, plugins and MCP servers. (Owner: unassigned; Due: no date) - [ ] Review MCP servers against a security checklist. (Owner: unassigned; Due: no date) - [ ] Run a frontier model over your codebases and critical open source dependencies. (Owner: unassigned; Due: no date) - [ ] Scan source, container images and build artifacts for secrets. (Owner: unassigned; Due: no date) - [ ] Set a minimum package age of at least 7 days for npm, PyPI and other package managers. (Owner: unassigned; Due: no date) - [ ] Pin versions, commit lockfiles, and install from the lockfile in CI. (Owner: unassigned; Due: no date) - [ ] Check the software you run against known exploited vulnerabilities. (Owner: unassigned; Due: no date) - [ ] Make sure the needed logs exist: identity provider sign-ins, cloud audit logs, source control and CI, and production data access. (Owner: unassigned; Due: no date) - [ ] Store logs where an attacker with production access cannot delete them. (Owner: unassigned; Due: no date) - [ ] Alert on new admin accounts, MFA changes, new devices or locations, large exports, and secrets read from unusual places. (Owner: unassigned; Due: no date) ## Still open: Within 30 days - [ ] Put MDM and EDR on every device. (Owner: unassigned; Due: no date) - [ ] Set extension allow-lists (Chrome Enterprise) with an auto-update delay. (Owner: unassigned; Due: no date) - [ ] Audit the entire corporate attack surface including chained paths, so one compromised engineer device has no path to production. (Owner: unassigned; Due: no date) - [ ] Brief engineers on fake-recruiter interviews and tampered installers. (Owner: unassigned; Due: no date) - [ ] Set VS Code extension allow-lists with an auto-update delay. (Owner: unassigned; Due: no date) - [ ] Move secrets off developer machines into a secrets manager, and rotate what the scan found. (Owner: unassigned; Due: no date) - [ ] Move to cloud coding agents or remote development environments. (Owner: unassigned; Due: no date) - [ ] Replace standing deployment tokens with short-lived workload identity. (Owner: unassigned; Due: no date) - [ ] Restrict credentials to networks you trust where the platform allows it. (Owner: unassigned; Due: no date) - [ ] Plan refactors away from memory-unsafe languages, and to parameterised queries. (Owner: unassigned; Due: no date) - [ ] Give the scanner your threat model. (Owner: unassigned; Due: no date) - [ ] Audit and trim dependencies. (Owner: unassigned; Due: no date) - [ ] Rehearse the response to a malicious extension or stolen token. (Owner: unassigned; Due: no date) ## Decisions needed - 28 open action(s) have no owner. Assign them. - 28 open action(s) have no due date. ## Done Nothing completed yet.
TL;DRWhat this tool is
5 points
- A checklist across five areas: corporate environment, development environments, code, third-party dependencies and monitoring.
- Each item is tagged "Immediately" or "Within 30 days", with an owner, a due date and a tick that is saved in your browser.
- You get a progress score per area and a one-page leadership summary you can copy or download as Markdown.
- Each item links to the PlayCISO tool or lab that helps with it, where one exists.
- The items follow the recommendations in Jack Cable's November 2026 guide. They are his recommendations, not a standard or a guarantee.
A short list you can finish
In “A Practical Guide to Security in November 2026”, Jack Cable lays out what to do immediately and what to do within 30 days, grouped into the corporate environment, development environments, code, third-party dependencies and monitoring. This planner turns his list into something with owners and dates. The recommendations are the author's.
Per the article, the context is recent incidents. Binance has reported that engineers' laptops were compromised through a fake job interview and a tampered installer, and that a deployment token reached the wallet signing service. Cursor disclosed on 29 October a malicious Claude Code extension version for Cursor, with fewer than 5,000 installs per Cursor.
Sources
- Jack Cable, “A Practical Guide to Security in November 2026”, 4 Nov 2026 (X/@jackhcable). Recommendations are attributed to the author; incident facts are as described in the article.
Frequently asked questions
Where do the checklist items come from?
They are adapted from Jack Cable, "A Practical Guide to Security in November 2026" (4 Nov 2026, X/@jackhcable), which splits its recommendations into what to do immediately and what to do within 30 days. They are the author's recommendations.
Why was the guide written?
Per the article, it responds to recent incidents. Binance has reported that engineers' laptops were compromised through a fake job interview and a tampered installer, and that a deployment token reached the wallet signing service. Cursor disclosed on 29 October a malicious Claude Code extension version for Cursor, with fewer than 5,000 installs per Cursor.
Is my progress saved?
Yes, in your browser's local storage only. Nothing is sent to a server. Clearing site data or using Reset removes it, and a private window may not keep it.
Is the score a measure of how secure we are?
No. It is the share of this checklist you have ticked, per area. It says nothing about how well each item was done.
Can I share the plan with leadership?
Yes. Copy the generated one-page summary, or download it as a Markdown file. It lists progress by area, what is still open with owners and dates, and the decisions needed.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.