Identity & Access
Identity & Access Management (IAM)
Guide
Identity & Access Management (IAM)
Active Directory and Entra ID Hardening Guide
Prioritised AD and Entra ID hardening: tier zero, privileged groups, service accounts, delegation, certificate services and hybrid identity.
Guide
Identity & Access Management (IAM)
Defence Industrial Base Identity Security Guide: CMMC, Cyber Essentials and Supplier Access
Identity security for defence suppliers: CMMC scoping of identity systems, MFA and privileged access, DFARS flowdown, DEFSTAN 05-138 and Cyber Essentials.
Guide
Identity & Access Management (IAM)
Education Identity Security Guide
Identity security for schools and universities: high-churn user lifecycles, student and staff MFA, federated research access, EdTech integrations and SaaS.
Identity Governance (IGA)
Template
Identity Governance (IGA)
Access Review Checklist: Running User Access Reviews
User access review checklist and template: scope, reviewer assignment, evidence, SOX ITGC, frequency, privileged and NHI accounts, revocation and sign-off.
Guide
Identity Governance (IGA)
Access Reviews and Certification Guide
Design access reviews that remove access: cut volume, add usage context, include NHIs and AI agents, map PCI DSS, CIS and NIST, and verify revocations.
Guide
Identity Governance (IGA)
Contractor Identity Lifecycle Guide: Onboarding, Access Reviews and Offboarding
How to govern contractor identities: sponsorship, identity proofing, guest and B2B accounts, time-bound access, reviews and offboarding without an HR feed.
Privileged Access (PAM)
Guide
Privileged Access (PAM)
Active Directory Certificate Services (AD CS) Security Guide
Secure AD CS: find and fix ESC1, ESC8 and ESC15 certificate template flaws, harden the enterprise CA, enforce KB5014754 strong mapping and detect abuse.
Guide
Privileged Access (PAM)
Break-Glass and Emergency Access Account Guide
Design, protect, monitor and test break-glass emergency access accounts for Entra ID, AWS root, Google super admins, PAM and critical systems.
Guide
Privileged Access (PAM)
Cloud PAM and CIEM Guide
Reduce cloud privilege with CIEM and cloud PAM: effective permissions, escalation paths, safe right-sizing and JIT for cloud admins.
Authentication
Guide
Authentication
Account Lockout and Brute-Force Protection Guide: Stopping Password Attacks
Set account lockout, throttling and rate limits that stop password guessing without locking users out: NIST 800-63B-4, Windows, Entra and AD FS values.
Guide
Authentication
Account Recovery and Help Desk Security Guide
Secure account recovery and help desk resets against social engineering: recovery design, caller verification, MFA reset controls and monitoring.
Guide
Authentication
Authenticator Apps and OTP Guide: TOTP, HOTP and Push
How TOTP and HOTP work (RFC 6238, RFC 4226), seed storage, otpauth QR enrolment, backup codes, app migration, hardware OATH tokens and NIST 800-63B-4 limits.
Authorisation
Guide
Authorisation
Authorisation Models Guide: RBAC, ABAC, ReBAC and Policy Engines
Compare RBAC, ABAC, ReBAC and policy-based access control, externalised authorisation and AuthZEN, for people, workloads and AI agents.
Guide
Authorisation
Conditional Access Guide
How to design conditional access: signals, authentication strengths, device compliance, sign-in frequency, report-only testing, workload identities and gaps.
Buyer's Guide
Authorisation
Externalised Authorisation Buyer’s Guide: Choosing a Policy Engine
Vendor-neutral guide to choosing an externalised authorisation policy engine: AuthZEN, policy models, latency, fail-closed design, decision logs and a PoC.
Customer Identity
Guide
Customer Identity
Age Verification and Age Assurance Guide
Age verification and estimation methods, the UK Online Safety Act and other laws, ISO/IEC 27566-1, accuracy, privacy and circumvention risks.
Buyer's Guide
Customer Identity
CIAM Buyer’s Guide
Evaluate customer identity platforms: authentication, passkeys, fraud and bot defence, consent, scalability, B2B, agent access, vendor questions and PoC.
Guide
Customer Identity
Customer IAM (CIAM) Guide: Securing Customer Identity
CIAM essentials: stopping credential stuffing and account takeover, passkeys, secure recovery, delegated and agent access, and consent.
Zero Trust
Guide
Zero Trust
CISA Zero Trust Maturity Model Guide: Pillars, Stages and Practical Use
How to use CISA's Zero Trust Maturity Model v2.0: five pillars, four stages, self-assessment questions and a roadmap that covers non-human identities.
Guide
Zero Trust
NIST SP 800-207 Zero Trust Architecture Guide: Tenets, Components and Deployment Models
NIST SP 800-207 explained: the seven zero trust tenets, PE, PA and PEP, deployment models, SP 800-207A and SP 1800-35, with NHI controls and metrics.
Guide
Zero Trust
Remote Access Identity Guide: From VPN to ZTNA
Secure remote access with identity: VPN risks, MFA on every entry point, ZTNA, device posture, third-party access and retiring dormant VPN accounts.
Identity Visibility, Posture & Threat Detection
Guide
Identity Visibility, Posture & Threat Detection
AI-Driven Account Takeover Guide: How AI Scales Credential Attacks
How AI scales credential stuffing, phishing, MFA fatigue and help desk impersonation, and the defences, detections and metrics that stop account takeover.
Guide
Identity Visibility, Posture & Threat Detection
BloodHound and Active Directory Attack Path Guide: Finding and Closing Paths to Tier 0
How defenders use BloodHound and attack path graphs to find and remove risky AD edges into Tier 0, prioritise fixes, measure exposure and detect collection.
Guide
Identity Visibility, Posture & Threat Detection
Golden Ticket, Silver Ticket and DCSync Guide: Detecting and Preventing Kerberos Abuse
Detect and prevent Golden Ticket, Silver Ticket and DCSync abuse in Active Directory: replication rights, krbtgt double reset, AES-only Kerberos and event IDs
Non-Human Identity
Non-Human Identity (NHI)
Executive Briefing
Non-Human Identity (NHI)
Board Briefing: Non-Human Identity Risk for Directors and CISOs
NHI risk explained for boards: why stolen keys and tokens drive breaches, director duties under SEC, NIS2 and the UK Code, five questions, metrics and a plan.
Guide
Non-Human Identity (NHI)
Certificate Expiry Outages and 47-Day TLS Certificates Guide: Automating Renewal
The CA/Browser Forum schedule to 47-day TLS certificates, why certificates still expire, and how to automate renewal with ACME, ARI and expiry monitoring.
Buyer's Guide
Non-Human Identity (NHI)
Certificate Lifecycle Management Buyer’s Guide
Evaluate certificate lifecycle and machine identity platforms for 47-day TLS: discovery, ACME automation, private CA, key protection, PQC readiness and PoC.
Cloud & Workload Identity
Guide
Cloud & Workload Identity
AWS IAM Policies and Roles Guide: Policy Types and Trust Policies
AWS IAM policy types and evaluation logic, explicit deny, role trust policies, AssumeRole and role chaining, permission boundaries, PassRole, Access Analyzer.
Guide
Cloud & Workload Identity
Azure RBAC and Service Principals Guide: Role Assignments
How to secure Azure RBAC and service principals: role scopes, privileged roles, conditions, Key Vault RBAC, app registrations and managed identity abuse.
Buyer's Guide
Cloud & Workload Identity
Cloud Workload Identity Buyer’s Guide
Vendor-neutral guide to choosing a workload identity platform: federation, secretless access, attestation, policy, pricing models, RFP questions and a PoC.
Secrets Management
Guide
Secrets Management
API Key Management Guide: The Full Lifecycle from Creation to Retirement
Create, scope, store, rotate and revoke API keys safely: when to use something stronger, leak paths, AI keys, metrics and a leaked-key response plan.
Guide
Secrets Management
Cloud Secrets Managers Guide: AWS, Azure and Google Cloud Compared
Compare AWS Secrets Manager, Azure Key Vault and Google Secret Manager: access control, rotation, replication, audit logs and the NHIs that read secrets.
Guide
Secrets Management
Crypto Exchange Identity and Key Security Guide: Wallet Keys, Signing and Insider Risk
How crypto exchanges protect wallet keys and signers: HSM, MPC and multisig, transaction verification after Bybit, insider risk, DPRK lures, MiCA and NYDFS.
SaaS & OAuth Integrations
Guide
SaaS & OAuth Integrations
Atlassian Cloud Security Guide: Jira, Confluence and API Tokens
Secure Atlassian Cloud: Guard and authentication policies, Jira permission schemes, Confluence anonymous access, API tokens, Marketplace apps and MCP server.
Guide
SaaS & OAuth Integrations
Consent Phishing and Illicit OAuth Grants Guide: Controlling App Consent
How consent phishing and illicit OAuth grants work, how to detect them in Entra ID and Google Workspace, and the consent settings that stop them.
Guide
SaaS & OAuth Integrations
Entra ID Applications and Consent Guide: Enterprise Apps
Govern Entra ID enterprise apps: user consent settings, app consent policies, admin consent workflow, Graph permissions and consent phishing response.
AI Governance & Security
AI Regulation & Law
Guide
AI Regulation & Law
AI Incident Reporting Guide: EU AI Act Serious Incidents and OECD AIM
EU AI Act serious incident reporting explained: Article 73 deadlines, deployer and GPAI duties, Digital Omnibus dates, OECD AIM and GDPR and NIS2 overlap.
Guide
AI Regulation & Law
AI Liability and Product Liability Guide: Who Pays When AI Causes Harm
How the EU Product Liability Directive 2024/2853 covers software and AI, the AI Liability Directive withdrawal, UK and US positions and what to change.
Guide
AI Regulation & Law
California AI Laws Guide: SB 53, CCPA ADMT Rules and AI Transparency
California AI laws explained: SB 53 frontier AI duties, CCPA ADMT rules due 1 January 2027, AB 2013 training data and AI Transparency Act provenance.
AI Governance & Risk
Guide
AI Governance & Risk
AI Contract Clauses Guide: Data, Liability and Model Change Terms
Example AI contract points to negotiate: no training on your data, retention, model change notice, incidents, liability, IP, EU AI Act roles and exit terms.
Guide
AI Governance & Risk
AI Ethics Board and AI Review Committee Guide: Charter, Membership and Decisions
How to charter an AI ethics board or AI review committee: membership, decision rights, risk-tier triage, review process, metrics and common failure patterns.
Guide
AI Governance & Risk
AI Governance Guide: Policies, Inventories and Oversight
How to run AI governance: committees, use case registers, risk tiers, human oversight and decommissioning, mapped to NIST AI RMF, ISO 42001 and the EU AI Act.
LLM & GenAI Security
Guide
LLM & GenAI Security
AI App Builder Security Guide: Lovable, Bolt and Replit
How to secure apps built with Lovable, Bolt and Replit: row-level security, secrets, agent permissions, workspace publishing controls and scanner limits.
Guide
LLM & GenAI Security
AI Coding Agents Security Guide: Protecting Secrets, Code and Pipelines
Secure AI coding assistants and agents in the IDE, terminal and CI/CD: secrets in context, over-scoped tokens, supply chain risk and sandboxing.
Guide
LLM & GenAI Security
AI Gateway and LLM Gateway Guide: Routing, Policy and Cost Control
How AI and LLM gateways work: virtual keys and per-agent credentials, routing and failover, token budgets, caching, guardrails and gateway hardening.
AI Platforms
Guide
AI Platforms
Amazon Bedrock Security Guide: Securing Models, Agents and Knowledge Bases
How to secure Amazon Bedrock: IAM for models, agent and knowledge base service roles, API keys, enforced guardrails, invocation logging and detections.
Guide
AI Platforms
Azure OpenAI and Azure AI Foundry Security Guide: Securing Enterprise AI Workloads
Secure Azure OpenAI and Microsoft Foundry: Foundry RBAC roles, agent identity, disabling API keys, private endpoints, content filters, logging and Defender.
Guide
AI Platforms
ChatGPT Enterprise Security Guide: Admin Controls, Data and Connectors
ChatGPT Enterprise security guide: SSO and SCIM, admin roles, apps and connectors, custom GPTs, agent mode, retention, residency, compliance logs, hardening.
AI Threats & Model Security
Guide
AI Threats & Model Security
AI Data Poisoning and Backdoors Guide
How AI data poisoning and model backdoors work, from web-scale data to RAG and model files, and the provenance, signing and testing controls that stop them.
Guide
AI Threats & Model Security
AI Model Security Guide: Model Theft, Extraction and Inversion
How to protect AI models from weight theft, query based extraction, distillation and adversarial evasion, with inference API controls and monitoring.
Guide
AI Threats & Model Security
AI Red Teaming Guide
How to scope and run AI red teaming for models, apps and agents: harm vs security testing, PyRIT, garak, promptfoo, attack success rate and EU AI Act rules.
Shadow AI & AI Use
Template
Shadow AI & AI Use
AI Acceptable Use Policy Template
AI acceptable use policy template for staff: approved AI tools register, data rules by classification, prohibited uses, human review, agents and sign-off.
Guide
Shadow AI & AI Use
AI Browser Extensions Security Guide: Risks, Vetting and Controls
How AI browser extensions leak prompts and sessions, how to vet them, and how to enforce an allowlist with Chrome and Edge ExtensionSettings policy.
Guide
Shadow AI & AI Use
AI Usage Monitoring Guide: Visibility into Employee and Agent AI Use
How to monitor employee and AI agent use of AI services with SSE, CASB, browsers, AI gateways and audit logs, within privacy and works council rules.
AI Agents
Agent Identity & Access
Standards Tracker
Agent Identity & Access
Agent Identity Standards Tracker
Where AI agent identity standards stand: MCP, A2A, OAuth and IETF drafts, OpenID AuthZEN, SPIFFE, FIDO, NIST, EU AI Act and OWASP.
Guide
Agent Identity & Access
Agent-to-Agent Authentication Guide: Proving Identity Between AI Agents
How AI agents prove identity to each other: A2A security schemes, mTLS, DPoP, SPIFFE SVIDs, OAuth token exchange, signed Agent Cards and webhook checks.
Glossary
Agent Identity & Access
Agentic AI Glossary
Clear definitions of agentic AI identity and security terms: agents, MCP, A2A, delegation, prompt injection, memory poisoning and more.
Agent Governance & Risk
Guide
Agent Governance & Risk
Agentic AI Compliance Guide: EU AI Act, NIST AI RMF and ISO/IEC 42001
Map AI agent identity controls to the EU AI Act (post-Omnibus dates), NIST AI RMF, ISO/IEC 42001, GDPR, DORA and NIS2, with audit evidence.
Template
Agent Governance & Risk
Agentic AI Risk Assessment Template: Scoring Agents Before They Go Live
Agentic AI risk assessment template: score agency and impact, set risk tiers, map to OWASP ASI01 to ASI10, approvals, reassessment triggers and metrics.
Guide
Agent Governance & Risk
Agentic AI Security Guide: Threats and Controls Across the Agent Stack
A layered threat model for agentic AI mapped to the OWASP Agentic Top 10, with controls for inputs, memory, tools, orchestration and identity.
Agent Threats & Attacks
Guide
Agent Threats & Attacks
AI Agent Goal Hijacking Guide: How Agents Get Redirected and How to Stop It
How AI agents get redirected by content they read (OWASP ASI01), where goal hijacking shows up, how to detect drift and the design patterns that limit it.
Guide
Agent Threats & Attacks
AI Agent Memory Poisoning Guide: Attacks, Detection and Defences
How AI agent memory poisoning works across assistant memory, project files, shared stores and RAG, with detection signals, hardening and rollback steps.
Guide
Agent Threats & Attacks
AI Agent Memory Security Guide
Protect AI agent memory from poisoning and cross-user leakage: isolation, write controls, no secrets in memory, logging and retention.
Agent Controls & Monitoring
Guide
Agent Controls & Monitoring
Agentic AI in the SOC Guide: Autonomous Triage, Investigation and Response
Run an agentic SOC safely: agent roles and handoffs, skills and prompts as code, tool privilege and MCP, evaluation pipelines, monitoring and metrics.
Guide
Agent Controls & Monitoring
AI Agent Action Approvals and Spending Limits Guide: Thresholds, Budgets and Step-Up
How to set AI agent approval boundaries and spend limits: action classes, per-action, session and adaptive budgets, CIBA and RFC 9396 step-up, and metrics.
Guide
Agent Controls & Monitoring
AI Agent Behaviour Baselining and Anomaly Detection Guide: Spotting Agents That Go Off Script
Build per-agent behavioural baselines: declared and learned baselines, tool sequence and egress features, version-aware detection, metrics and mappings.
MCP, Protocols & Agent Platforms
Guide
MCP, Protocols & Agent Platforms
Agent Payments Protocols Guide: AP2 and Card Network Agent Tokens
How AP2 mandates, Visa and Mastercard agent tokens, ACP and x402 secure AI agent payments: verification rules, constraints, threats, rollout and metrics.
Guide
MCP, Protocols & Agent Platforms
Agentic Commerce Identity Guide: AI Agents That Buy
The identity model behind AI agent payments: agent identity, verifiable mandates, tokenised credentials, AP2, FIDO and what to do now.
Guide
MCP, Protocols & Agent Platforms
AI Agent Tool and Plugin Security Guide: Tool Poisoning
Secure the tools and plugins AI agents call: tool poisoning, rug pulls, tool shadowing, scoped permissions, schema and output validation and sandboxing.
Security Operations
SOC & Detection Engineering
Guide
SOC & Detection Engineering
AI SOC Guide: Autonomous Triage and Investigation
AI SOC guide: copilots vs triage agents, autonomy levels and approval gates, measuring false negatives, prompt injection risks and agent identity permissions.
Guide
SOC & Detection Engineering
Alert Fatigue Reduction Guide: Tuning, Triage and Automation That Cut Noise
Cut SOC alert fatigue with per-rule quality metrics, scoped exceptions with expiry, alert grouping, risk-based alerting, enrichment and safe automation.
Guide
SOC & Detection Engineering
Alert Triage Guide: Prioritising, Investigating and Closing Alerts
How SOC teams triage alerts: workflow, risk-based prioritisation, enrichment, disposition codes, automation, metrics and failure patterns, mapped to NIST.
Incident Response & Forensics
Template
Incident Response & Forensics
Account Takeover Response Playbook: Recovering Compromised User and Service Accounts
Account takeover response template for user and service accounts: block, revoke sessions and tokens, reset MFA, remove persistence, recover with named roles.
Template
Incident Response & Forensics
Business Email Compromise Response Playbook: Stopping Payments and Evicting Attackers
BEC response playbook template: recall fraudulent payments, report to IC3 or Report Fraud, and evict attackers from Microsoft 365 mailboxes with named roles.
Template
Incident Response & Forensics
CI/CD Pipeline Compromise Playbook: Responding to Build System Attacks
CI/CD pipeline compromise playbook template: triggers, roles, evidence, disabling workflows, secret rotation, OIDC trust review, clean rebuilds and metrics.
Threat Intelligence & Threat Actors
Guide
Threat Intelligence & Threat Actors
APT28 (Fancy Bear) Threat Actor Profile: Credential Theft, Edge Devices and Defences
APT28 (Fancy Bear, Forest Blizzard) profile: aliases, targets, ATT&CK techniques, credential theft, edge device abuse, incidents and the defences that work.
Guide
Threat Intelligence & Threat Actors
APT29 (Midnight Blizzard) Threat Actor Profile: Cloud Identity Abuse and Defences
APT29 (Midnight Blizzard, Cozy Bear) profile: aliases, targets, ATT&CK techniques, OAuth and service account abuse, key incidents and identity defences.
Guide
Threat Intelligence & Threat Actors
APT41 Threat Actor Profile: Espionage, Financially Motivated Intrusions and Defences
APT41 (Brass Typhoon, Wicked Panda, BARIUM): aliases, targets, MITRE ATT&CK techniques, stolen keys and certificates, notable campaigns and defences.
Attack Techniques & Malware
Guide
Attack Techniques & Malware
Botnets Guide: How They Grow, What They Do and How to Defend
Botnets guide: IoT and Mirai lineage, Raptor Train and KV router botnets, residential proxy networks, takedowns, detection signals and device hygiene.
Guide
Attack Techniques & Malware
Command and Control (C2) Guide: Cobalt Strike, Sliver and Beaconing
Detect and stop command and control: ATT&CK TA0011 techniques, beaconing analysis, JA4 and JARM fingerprints, DNS analytics, egress filtering and RMM control.
Guide
Attack Techniques & Malware
Credential Dumping Guide: LSASS, NTDS.dit and Mimikatz
Defend against credential dumping: LSASS, SAM, NTDS.dit, LSA secrets and DCSync mapped to ATT&CK T1003, with LSA protection, event IDs and response steps.
Offensive Security & Testing
Buyer's Guide
Offensive Security & Testing
AI Red Teaming and Testing Tools Buyer’s Guide
Vendor-neutral buyer's guide to AI red teaming and LLM testing tools: open source vs platforms, OWASP and ATLAS coverage, scoring, CI, vendor questions, PoC.
Guide
Offensive Security & Testing
API Penetration Testing Guide: Scoping, Authorisation Flaws and Reporting
How to scope and run API penetration tests: OWASP API Top 10 2023 coverage, BOLA and BFLA testing, test keys as NHIs, provider rules and remediation.
Guide
Offensive Security & Testing
Assumed Breach Testing Guide: Starting Inside to Test Detection and Containment
How to plan and govern assumed breach tests from a provided foothold or service account, measure time to detect and contain, and turn results into fixes.
Infrastructure Security
Endpoint Security
Guide
Endpoint Security
Android Enterprise Security Guide: Work Profiles, Management and Hardening
How to secure Android fleets with Android Enterprise: work profile, COPE, fully managed, zero-touch, AMAPI hardening, patch levels and Play Integrity.
Guide
Endpoint Security
Application Allowlisting Guide: WDAC, AppLocker and Ringfencing
How to plan, test and enforce application allowlisting with App Control for Business (WDAC) and AppLocker: rule types, audit mode, event IDs and rollback.
Guide
Endpoint Security
Browser Extension Security Guide: Permissions and Malicious Extensions
Browser extension security: score permissions, block malicious and hijacked extensions, run an ID allowlist in Chrome, Edge and Firefox, and respond fast.
Network Security
Guide
Network Security
5G Security Guide: Architecture, Network Slicing and SIM Identity
5G security guide: TS 33.501 architecture, SUCI and 5G AKA, SEPP roaming, network slicing, OAuth 2.0 between network functions and private 5G controls.
Guide
Network Security
BGP and Routing Security Guide: RPKI and Route Origin Validation
BGP security for network teams: RPKI ROAs and route origin validation, route leaks, ASPA and BGPsec, IRR prefix filtering, MANRS and BGP hijack response.
Guide
Network Security
Bluetooth, RFID and NFC Security Guide: Short-Range Wireless Risks and Controls
Bluetooth, RFID and NFC security: SP 800-121 pairing modes, BlueBorne, KNOB and BLURtooth defences, badge cloning, OSDP, EMV contactless and NFC keys.
Email & Communications Security
Guide
Email & Communications Security
AiTM Phishing Guide: Evilginx, Tycoon and Token Theft
How AiTM reverse-proxy and device code phishing steal sessions, the kits behind them, and the phishing-resistant MFA and device controls that stop it.
Guide
Email & Communications Security
Callback Phishing (TOAD) Guide: Phone-Led Attacks and Verification Controls
Callback phishing (TOAD) guide: fake invoice and renewal lures, remote access tool abuse, help desk impersonation, detection signals and verification steps.
Guide
Email & Communications Security
Collaboration Tool Security Guide: Teams, Slack and Zoom
Secure Microsoft Teams, Slack and Zoom: external access, guest access, bot tokens and app scopes, chat phishing, meeting controls, retention and DLP.
OT & IoT Security
Guide
OT & IoT Security
Automotive Cybersecurity Guide: ISO/SAE 21434 and UN R155
Automotive cybersecurity explained: UN R155 CSMS and R156 SUMS, ISO/SAE 21434 TARA, CAN bus and SecOC, secure OTA updates with Uptane, and fleet monitoring.
Guide
OT & IoT Security
Aviation Cybersecurity Guide: Airports, Airlines and Aircraft Systems
Aviation cyber security for airports, airlines and aircraft: EASA Part-IS, ICAO Annex 17, CAP 1753, TSA rules, DO-326A, segmentation and metrics.
Guide
OT & IoT Security
Building Management System Security Guide: BACnet, HVAC and Smart Buildings
Building management system security: BACnet and BACnet/SC, Modbus, KNX and Niagara, internet exposure, integrator remote access, segmentation and IEC 62443.
Vulnerability Management
Guide
Vulnerability Management
Asset Inventory and CMDB Security Guide: Building an Inventory Security Can Rely On
Build an asset inventory security can trust: CIS Controls 1 and 2, BOD 23-01, CSF ID.AM, CAASM, CMDB data quality, NHIs and certificates, and CMDB security.
Buyer's Guide
Vulnerability Management
Attack Surface Management Buyer’s Guide: Choosing EASM and CAASM Tools
Vendor-neutral guide to choosing EASM and CAASM tools: pure play vs bundled, evaluation criteria, pricing models, RFP questions and a proof of value.
Guide
Vulnerability Management
Attack Surface Management Guide
Attack surface management guide: EASM vs CAASM, discovery via DNS and certificate transparency, subdomain takeover, exposed admin panels and leaked secrets.
Cloud & Application Security
Cloud Security
Guide
Cloud Security
AWS Organizations and SCPs Guide: Guardrails for Multi-Account Environments
How AWS Organizations SCPs, RCPs and declarative policies are evaluated, which guardrails to deploy first, and how to roll them out safely across accounts.
Guide
Cloud Security
AWS Security Guide
AWS security guide: Organizations, SCPs and RCPs, IAM Identity Center, root protection, CloudTrail, GuardDuty, Security Hub CSPM, S3, KMS, IMDSv2 and CIS.
Guide
Cloud Security
Azure Policy and Management Groups Guide: Governance at Scale
How Azure management groups and Azure Policy enforce guardrails at scale: effects, initiatives, exemptions, deny assignments, rollout and metrics.
Application Security
Guide
Application Security
.NET Security Guide: ASP.NET Core, NuGet and Secrets Handling
.NET security guide: supported versions, ASP.NET Core authorisation, Data Protection and machine keys, BinaryFormatter, managed identities and NuGet security.
Guide
Application Security
Android App Security Guide: Storage, Keys, Network Security and Play Integrity
Android app security in depth: Keystore and StrongBox, exported components, Network Security Config, Play Integrity, embedded API keys and a rollout plan.
Guide
Application Security
Application Security Guide: SAST, DAST, SCA and IAST
Application security guide: NIST SSDF, threat modelling, SAMM, BSIMM and ASVS, how SAST, DAST, IAST, SCA, secrets scanning and RASP fit, triage and SLAs.
Web & API Security
Buyer's Guide
Web & API Security
API Security Buyer’s Guide
Vendor-neutral API security buyer's guide: discovery, posture, runtime protection, testing, OWASP API Top 10 mapping, vendor questions and a proof of concept.
Guide
Web & API Security
API Security Guide
API security guide: OWASP API Top 10 2023, BOLA and BFLA, shadow API inventory, OAuth and DPoP tokens, schema validation, rate limits, GraphQL and detection.
Guide
Web & API Security
Broken Access Control Prevention Guide: IDOR and Privilege Escalation
Prevent broken access control: IDOR, forceful browsing, verb tampering, horizontal and vertical privilege escalation, server-side checks, tests and detection.
Software & AI Supply Chain
Guide
Software & AI Supply Chain
AI Model Provenance and Watermarking Guide: Model Signing and Lineage
How to prove where AI models and outputs come from: model signing with OpenSSF, lineage, SynthID and AI watermarking limits, C2PA and EU AI Act Article 50.
Guide
Software & AI Supply Chain
AI Supply Chain Security and AI-BOM Guide
Secure the AI supply chain: models, data, packages, tools and MCP servers, what an AI-BOM should record, and credential containment.
Guide
Software & AI Supply Chain
Bitbucket Security Guide: Access Tokens, Pipelines and Workspace Settings
Bitbucket security guide: app password retirement, scoped API and access tokens, Pipelines OIDC, secured variables, IP allowlisting and Data Center tokens.
Data Security & Privacy
Data Security
Guide
Data Security
Confidential AI and GPU Enclaves Guide: Protecting AI Data in Use
How GPU confidential computing protects model weights and prompts in use: NVIDIA CC modes, attestation, key release, cloud options and the limits of TEEs.
Guide
Data Security
Confidential Computing Guide
Confidential computing explained: Intel SGX and TDX, AMD SEV-SNP, Arm CCA, Nitro Enclaves, GPU TEEs, RFC 9334 attestation and key release on attestation.
Guide
Data Security
Crypto-Agility Guide: Designing Systems That Can Change Algorithms
How to design and run crypto-agility: protocol identifiers, crypto APIs, central policy, hybrid PQC, rotation, metrics and failure patterns from NIST CSWP 39.
Privacy & Data Protection
Guide
Privacy & Data Protection
AI and GDPR Guide: Lawful Basis, DPIAs and Automated Decisions
How GDPR applies to AI: lawful basis for training and deployment, EDPB Opinion 28/2024, DPIAs, Article 22 automated decisions and UK DUAA changes.
Guide
Privacy & Data Protection
AI and Privacy Guide: Training Data, Personal Data and the AI Act
How GDPR and the EU AI Act apply to AI: legitimate interest for training, model anonymity, membership inference, unlearning and automated decisions.
Guide
Privacy & Data Protection
Brazil LGPD Guide: Legal Bases, ANPD Enforcement and Security Measures
Brazil LGPD for security teams: scope, ten legal bases, ANPD 3 working day incident rule, transfer clauses, sanctions and AI agent impacts, October 2026.
Fraud Prevention
Guide
Fraud Prevention
Account Takeover Prevention Guide
Stop account takeover: credential stuffing defences, NIST SP 800-63B-4 rules, session risk scoring, recovery abuse, metrics and a response playbook.
Guide
Fraud Prevention
Authorised Push Payment (APP) Fraud Guide
APP fraud explained: UK mandatory reimbursement, Confirmation of Payee, scam warnings, payment delays, mule detection and EU verification of payee.
Buyer's Guide
Fraud Prevention
Bot Management Buyer’s Guide
Vendor-neutral bot management buyer's guide: requirements, deployment models, detection and good-bot criteria, vendor questions, red flags and a PoC.
Governance, Risk & Compliance
Security Leadership & Governance
Template
Security Leadership & Governance
Board Cyber Report Template: Risk Posture, Metrics and Decisions Needed
Board cyber report template: one-page summary, risk posture vs appetite, metrics with tolerances incl. NHI and third-party risk, incidents, decisions.
Guide
Security Leadership & Governance
Board Cyber Risk Reporting Guide
How to report cyber risk to the board: appetite and tolerances, a one-page dashboard, metrics vs vanity metrics, FAIR, UK Code, SEC Item 106 and NIS2.
Guide
Security Leadership & Governance
Building the Business Case for Identity and NHI Security
Build a credible business case for NHI, IAM, PAM or agent identity investment: evidence, value framing, risk quantification and costs.
Risk Management
Guide
Risk Management
COSO for Cybersecurity Guide: Applying COSO Internal Control and ERM to Cyber Risk
How to apply the COSO 2013 internal control principles and COSO ERM to cyber risk: Principle 11 ITGCs, cyber risk appetite, deficiencies, metrics and mapping.
Guide
Risk Management
Cyber Insurance Guide: Coverage, Requirements and Claims
Cyber insurance explained: first and third-party cover, underwriting controls like MFA and EDR, war exclusions, claims panels and ransom payment rules.
Template
Risk Management
Cyber Risk Appetite Statement Template: Defining Board-Approved Risk Tolerances
Free cyber risk appetite statement template with appetite scale, category tolerances and KRIs (incl. NHIs and AI agents), escalation rules and board approval.
Audit, Assurance & Compliance
Guide
Audit, Assurance & Compliance
Audit Evidence and Continuous Controls Monitoring Guide
How to produce audit evidence that holds up: test of design vs operating effectiveness, sampling, attestation, PBC lists, and evidence freshness and lineage.
Buyer's Guide
Audit, Assurance & Compliance
Compliance Automation Buyer’s Guide
Vendor-neutral compliance automation buyer's guide: evaluation criteria, least-privilege integrations, auditor acceptance, pricing models, RFP and a PoC.
Guide
Audit, Assurance & Compliance
Compliance Automation Guide
Automate compliance well: continuous control monitoring, evidence collection, policy as code, OSCAL, GRC integrations, access reviews and audit readiness.
Third-Party & Supply Chain Risk
Guide
Third-Party & Supply Chain Risk
DeepSeek and High-Risk AI Vendor Assessment Guide: Evaluating AI Supplier Risk
How to assess DeepSeek and other high-risk AI suppliers: government bans and orders, hosted vs open-weight risk, model testing, enforcement and metrics.
Guide
Third-Party & Supply Chain Risk
ISO/IEC 27036 Supplier Relationships Guide: Securing the Supply Chain
ISO/IEC 27036 parts 1 to 4 explained: current editions, requirements, evidence, framework mapping and how to govern supplier tokens and OAuth access.
Guide
Third-Party & Supply Chain Risk
NIST SP 800-161 Cyber Supply Chain Risk Management Guide: C-SCRM Practices and Supplier Controls
NIST SP 800-161 Rev. 1 Update 1 explained: the three C-SCRM levels, the SR control overlay, supplier due diligence, identity risks, evidence and mappings.
Security Policies & Awareness
Template
Security Policies & Awareness
Access Control Policy Template: Least Privilege, Reviews and Non-Human Access
Free access control policy template with account types, approval, leaver timings, privileged access, NHI rules, review cadence and NIST, ISO and CIS mapping.
Template
Security Policies & Awareness
Change Management Policy Template: Approval, Emergency Changes and Segregation of Duties
Change management policy template: standard, normal and emergency changes, CAB, segregation of duties, IaC and pipeline changes made by service accounts.
Template
Security Policies & Awareness
Data Classification Policy Template: Levels, Labelling and Handling Rules
Data classification policy template with four levels, labelling rules, a handling matrix, AI tool input rules and controls for service accounts and AI agents.
Regulations & Frameworks
Guide
Regulations & Frameworks
APRA CPS 234 Guide: Information Security for APRA-Regulated Entities
APRA CPS 234 guide: Board accountability, asset classification, third parties, independent testing, 72-hour notification, CPG 234, CPS 230 and AI risk.
Guide
Regulations & Frameworks
Australia IRAP Guide: Assessments Against the ISM for Government Workloads
How IRAP assessments against the ISM work in 2026: the Common Assessment Framework, cloud reports, classifications, identity controls and evidence.
Guide
Regulations & Frameworks
Australian Privacy and Cyber Rules Guide: Privacy Act, SOCI and NDB
Australian privacy and cyber rules for security teams: APP 11, NDB 30-day assessment, POLA Act 2024, SOCI CIRMP and 12-hour reporting, ransomware payments.
Resilience & Recovery
Guide
Resilience & Recovery
Active Directory and Entra ID Recovery Guide
Recover Active Directory and Entra ID after compromise: forest recovery, DSRM, FSMO seizure, double krbtgt reset, Entra soft delete and Connect rebuild.
Buyer's Guide
Resilience & Recovery
Backup and Cyber Recovery Buyer’s Guide
Vendor-neutral buyer's guide to backup and cyber recovery: immutability, isolated vaults, admin controls, clean restore points and a recovery PoC.
Guide
Resilience & Recovery
Backup Identity Isolation Guide: Separating Backup Admin and Service Accounts from Production
How to give backup admins and backup service accounts their own identity plane: separate directory, MFA, quorum approval, break-glass and deletion alerts.
Careers & Certifications
Security Careers
Guide
Security Careers
AI Security Engineer Career Guide: Skills, Roles and How to Get Started
How to become an AI security engineer: what the role does, AI threat skills, OWASP LLM Top 10 and ATLAS, routes in, certifications and progression.
Guide
Security Careers
Application Security Engineer Career Guide: Skills, Roles and Progression
How to become an application security engineer: NICE role, code review and testing skills, SAST/DAST/SCA, routes in, CSSLP, GWAPT, OSWE and progression.
Guide
Security Careers
Cloud Security Engineer Career Guide: Skills, Roles and Progression
Cloud security engineer career guide: AWS, Azure and Google Cloud responsibilities, core skills, routes in, SCS-C03, SC-500, CCSK and CCSP, progression.
Security Certifications
Guide
Security Certifications
AWS Certified Security Specialty Guide: Domains, Requirements and Preparation
AWS Certified Security Specialty SCS-C03 explained: 65 questions in 170 minutes, 750 pass mark, six weighted domains, 300 USD fee, renewal and study plan.
Guide
Security Certifications
Blue Team Certifications Guide: BTL1 and SOC Credentials
Blue team and SOC certifications compared from provider pages: BTL1, BTL2, CDSA, PSAA, CSA, GCIH, GCIA and CySA+ formats, prerequisites, costs and renewal.
Guide
Security Certifications
CCSK Certification Guide: Exam, Requirements and Preparation
CCSK v5 explained: 60 questions in 120 minutes, 80% pass mark, 12 domains, open book online exam, $445 token with two attempts, no expiry and a study plan.
No guides match these filters.
All guides A–Z
- .NET Security Guide: ASP.NET Core, NuGet and Secrets Handling
- 5G Security Guide: Architecture, Network Slicing and SIM Identity
- Access Control Policy Template: Least Privilege, Reviews and Non-Human Access
- Access Review Checklist: Running User Access Reviews
- Access Reviews and Certification Guide
- Account Lockout and Brute-Force Protection Guide: Stopping Password Attacks
- Account Recovery and Help Desk Security Guide
- Account Takeover Prevention Guide
- Account Takeover Response Playbook: Recovering Compromised User and Service Accounts
- Active Directory and Entra ID Hardening Guide
- Active Directory and Entra ID Recovery Guide
- Active Directory Certificate Services (AD CS) Security Guide
- Age Verification and Age Assurance Guide
- Agent Identity Standards Tracker
- Agent Payments Protocols Guide: AP2 and Card Network Agent Tokens
- Agent-to-Agent Authentication Guide: Proving Identity Between AI Agents
- Agentic AI Compliance Guide: EU AI Act, NIST AI RMF and ISO/IEC 42001
- Agentic AI Glossary
- Agentic AI Identity Guide: How AI Agents Get, Use and Lose Identities
- Agentic AI Identity Maturity Model
- Agentic AI in IAM Operations Guide: Using Agents for Access Reviews and Provisioning
- Agentic AI in the SOC Guide: Autonomous Triage, Investigation and Response
- Agentic AI Risk Assessment Template: Scoring Agents Before They Go Live
- Agentic AI Security Guide: Threats and Controls Across the Agent Stack
- Agentic AI Security Policy Template
- Agentic Commerce Identity Guide: AI Agents That Buy
- AI Acceptable Use Policy Template
- AI Agent Action Approvals and Spending Limits Guide: Thresholds, Budgets and Step-Up
- AI Agent Audit Trails for Regulators Guide: Logging Evidence That Stands Up
- AI Agent Authorisation Guide: Least Privilege for Non-Deterministic Actors
- AI Agent Autonomy Levels Framework: Matching Controls to How Much an Agent Decides
- AI Agent Behaviour Baselining and Anomaly Detection Guide: Spotting Agents That Go Off Script
- AI Agent Deployment Checklist: Pre-Production Security Checks
- AI Agent Goal Hijacking Guide: How Agents Get Redirected and How to Stop It
- AI Agent Identity Security Buyer’s Guide
- AI Agent Incident Response Playbook: Contain, Investigate and Recover
- AI Agent Kill Switch and Containment Guide: Stopping Agents Safely and Fast
- AI Agent Memory Poisoning Guide: Attacks, Detection and Defences
- AI Agent Memory Security Guide
- AI Agent Misuse Incident Playbook: Containing a Compromised or Misbehaving Agent
- AI Agent Observability, Audit and Incident Response Guide
- AI Agent Risk Assessment Template: Scoping Autonomy, Access and Controls
- AI Agent Sandboxing and Code Execution Guide: Isolating What Agents Run
- AI Agent Security Testing Checklist: Pre-Release and Ongoing Tests
- AI Agent Threat Model Template: Assets, Threats and Controls
- AI Agent Tool and Plugin Security Guide: Tool Poisoning
- AI Agents vs Agentic AI: What’s the Difference and Why It Matters for Identity
- AI and GDPR Guide: Lawful Basis, DPIAs and Automated Decisions
- AI and Privacy Guide: Training Data, Personal Data and the AI Act
- AI App Builder Security Guide: Lovable, Bolt and Replit
- AI Browser Extensions Security Guide: Risks, Vetting and Controls
- AI Coding Agents Security Guide: Protecting Secrets, Code and Pipelines
- AI Contract Clauses Guide: Data, Liability and Model Change Terms
- AI Data Poisoning and Backdoors Guide
- AI Ethics Board and AI Review Committee Guide: Charter, Membership and Decisions
- AI Gateway and LLM Gateway Guide: Routing, Policy and Cost Control
- AI Governance Guide: Policies, Inventories and Oversight
- AI Governance Platform Buyer’s Guide
- AI Guardrails and AI Firewalls Guide
- AI Hallucination Business Risk Guide: Liability, Controls and Verification
- AI IDE and Coding Agent Security Guide: Cursor, Claude Code, Windsurf and Copilot Agent Mode
- AI Impact Assessment Template
- AI Incident Reporting Guide: EU AI Act Serious Incidents and OECD AIM
- AI Liability and Product Liability Guide: Who Pays When AI Causes Harm
- AI Model Provenance and Watermarking Guide: Model Signing and Lineage
- AI Model Risk Management Guide: Validating and Monitoring Models
- AI Model Security Guide: Model Theft, Extraction and Inversion
- AI Procurement Checklist: Questions to Ask Before Buying AI
- AI Red Teaming and Testing Tools Buyer’s Guide
- AI Red Teaming Guide
- AI Register and AI Inventory Template: Recording Every AI System You Run
- AI Risk Assessment Guide
- AI Safety vs AI Security Guide: Where They Differ and Overlap
- AI Security Architecture Reference Guide: Controls Layer by Layer
- AI Security Engineer Career Guide: Skills, Roles and How to Get Started
- AI Security Maturity Model
- AI Security Platform Buyer’s Guide
- AI Security Posture Management (AI-SPM) Guide
- AI SOC Guide: Autonomous Triage and Investigation
- AI Supply Chain Security and AI-BOM Guide
- AI Training Data Provenance and Copyright Exposure Guide: Knowing What Your Models Learned
- AI Usage Monitoring Guide: Visibility into Employee and Agent AI Use
- AI Use Case Risk Tiering Guide: Classifying AI Systems by Impact
- AI-Driven Account Takeover Guide: How AI Scales Credential Attacks
- AI-Generated Code Review Guide: Catching Flaws Before They Ship
- AI-Powered Cyber Attacks Guide: What Has Changed and How to Defend
- AiTM Phishing Guide: Evilginx, Tycoon and Token Theft
- Alert Fatigue Reduction Guide: Tuning, Triage and Automation That Cut Noise
- Alert Triage Guide: Prioritising, Investigating and Closing Alerts
- Amazon Bedrock Security Guide: Securing Models, Agents and Knowledge Bases
- Android App Security Guide: Storage, Keys, Network Security and Play Integrity
- Android Enterprise Security Guide: Work Profiles, Management and Hardening
- API Key Management Guide: The Full Lifecycle from Creation to Retirement
- API Penetration Testing Guide: Scoping, Authorisation Flaws and Reporting
- API Security Buyer’s Guide
- API Security Guide
- Application Allowlisting Guide: WDAC, AppLocker and Ringfencing
- Application Security Engineer Career Guide: Skills, Roles and Progression
- Application Security Guide: SAST, DAST, SCA and IAST
- Application Security Posture Management (ASPM) Guide
- Application Security Testing Buyer’s Guide
- AppSec Maturity Model: SAMM, BSIMM and DSOMM
- APRA CPS 234 Guide: Information Security for APRA-Regulated Entities
- APT28 (Fancy Bear) Threat Actor Profile: Credential Theft, Edge Devices and Defences
- APT29 (Midnight Blizzard) Threat Actor Profile: Cloud Identity Abuse and Defences
- APT41 Threat Actor Profile: Espionage, Financially Motivated Intrusions and Defences
- ASPM Buyer’s Guide: Evaluating Application Security Posture Management
- Asset Inventory and CMDB Security Guide: Building an Inventory Security Can Rely On
- Assumed Breach Testing Guide: Starting Inside to Test Detection and Containment
- Atlassian Cloud Security Guide: Jira, Confluence and API Tokens
- Attack Surface Management Buyer’s Guide: Choosing EASM and CAASM Tools
- Attack Surface Management Guide
- Audit Evidence and Continuous Controls Monitoring Guide
- Australia IRAP Guide: Assessments Against the ISM for Government Workloads
- Australian Privacy and Cyber Rules Guide: Privacy Act, SOCI and NDB
- Authenticator Apps and OTP Guide: TOTP, HOTP and Push
- Authorisation Models Guide: RBAC, ABAC, ReBAC and Policy Engines
- Authorised Push Payment (APP) Fraud Guide
- Automotive Cybersecurity Guide: ISO/SAE 21434 and UN R155
- Aviation Cybersecurity Guide: Airports, Airlines and Aircraft Systems
- AWS Certified Security Specialty Guide: Domains, Requirements and Preparation
- AWS IAM Policies and Roles Guide: Policy Types and Trust Policies
- AWS Organizations and SCPs Guide: Guardrails for Multi-Account Environments
- AWS Security Guide
- Azure OpenAI and Azure AI Foundry Security Guide: Securing Enterprise AI Workloads
- Azure Policy and Management Groups Guide: Governance at Scale
- Azure RBAC and Service Principals Guide: Role Assignments
- Backup and Cyber Recovery Buyer’s Guide
- Backup Identity Isolation Guide: Separating Backup Admin and Service Accounts from Production
- Backup Security and Immutable Backup Guide
- BGP and Routing Security Guide: RPKI and Route Origin Validation
- Biometric Authentication and Verification Guide
- Bitbucket Security Guide: Access Tokens, Pipelines and Workspace Settings
- BloodHound and Active Directory Attack Path Guide: Finding and Closing Paths to Tier 0
- Blue Team Certifications Guide: BTL1 and SOC Credentials
- Bluetooth, RFID and NFC Security Guide: Short-Range Wireless Risks and Controls
- Board and CISO Briefing: Agentic AI Identity Risk
- Board Briefing: AI Security Risks, Questions and Oversight
- Board Briefing: Non-Human Identity Risk for Directors and CISOs
- Board Cyber Report Template: Risk Posture, Metrics and Decisions Needed
- Board Cyber Risk Reporting Guide
- Bot Management Buyer’s Guide
- Bot Management Guide: Scraping, Credential Stuffing and Scalping
- Bot vs AI Agent Traffic Management Guide: Web Bot Auth and Good Bots
- Botnets Guide: How They Grow, What They Do and How to Defend
- Box and Dropbox Security Guide: Sharing Controls, Apps and Admin Access
- Brazil LGPD Guide: Legal Bases, ANPD Enforcement and Security Measures
- Breach and Attack Simulation (BAS) Guide
- Breach and Attack Simulation Buyer’s Guide: Choosing a BAS Platform
- Breach Notification Laws by Country Guide: Deadlines, Thresholds and Regulators
- Break-Glass and Emergency Access Account Guide
- Broken Access Control Prevention Guide: IDOR and Privilege Escalation
- Browser and Computer-Use Agent Security Guide
- Browser Extension Security Guide: Permissions and Malicious Extensions
- Browser Security Buyer’s Guide: Enterprise Browsers
- BSI IT-Grundschutz Guide: Modules, Methodology and Certification
- Bug Bounty and Vulnerability Disclosure Guide
- Building a SOC from Scratch Guide: People, Process, Technology and First Year Plan
- Building Management System Security Guide: BACnet, HVAC and Smart Buildings
- Building the Business Case for Identity and NHI Security
- Business Continuity and Disaster Recovery Guide
- Business Continuity Plan Template: Impact Analysis, Strategies and Plan Structure
- Business Email Compromise Response Playbook: Stopping Payments and Evicting Attackers
- Business Impact Analysis Template
- Business Logic Vulnerabilities Guide: Designing and Testing Workflow Abuse Out
- BYOD Policy Template: Enrolment, Separation of Data and Offboarding
- California AI Laws Guide: SB 53, CCPA ADMT Rules and AI Transparency
- Callback Phishing (TOAD) Guide: Phone-Led Attacks and Verification Controls
- Canada AI Regulation Guide (post-AIDA): The Current Landscape
- Canada PIPEDA and Bill C-27 Guide: Privacy Duties, Breach Records and Reform Status
- CASB Guide: Visibility, Data Protection and SaaS Control
- CCSK Certification Guide: Exam, Requirements and Preparation
- CCSP Certification Guide: Domains, Requirements and Preparation
- CDPSE Certification Guide: Domains, Requirements and Preparation
- CEH Certification Guide: Exam, Requirements and Preparation
- Certificate Expiry Outages and 47-Day TLS Certificates Guide: Automating Renewal
- Certificate Lifecycle Management Buyer’s Guide
- Certified Kubernetes Security Specialist (CKS) Guide: Exam, Requirements and Preparation
- CGEIT Certification Guide: Domains, Requirements and Preparation
- Change Management Policy Template: Approval, Emergency Changes and Segregation of Duties
- Charming Kitten (APT35) Threat Actor Profile: Credential Phishing and Impersonation
- ChatGPT Enterprise Security Guide: Admin Controls, Data and Connectors
- China Generative AI Measures and AI Labelling Rules Guide: What Providers Must Do
- China PIPL Guide: Consent, Cross-Border Transfers and Security Duties
- ChromeOS and Chromebook Security Guide: Policies, Enrolment and Data Protection
- CI/CD Pipeline Compromise Playbook: Responding to Build System Attacks
- CI/CD Pipeline Identity Security Guide
- CI/CD Security Guide: Pipeline Poisoning, Runners and Workflow Attacks
- CIAM Buyer’s Guide
- CIPM and CIPT Certification Guide: Exam, Requirements and Preparation
- CIPP/E and CIPP/US Certification Guide: Exam, Requirements and Preparation
- CIRCIA Incident Reporting Guide: Covered Entities, Deadlines and Rule Status
- CIS Controls Guide: Implementation Groups, Safeguards and Benchmarks
- CISA Certification Guide: Domains, Requirements and Preparation
- CISA Cross-Sector Cybersecurity Performance Goals (CPGs) Guide: Baseline Practices and Adoption
- CISA Zero Trust Maturity Model Guide: Pillars, Stages and Practical Use
- CISM Certification Guide: Domains, Requirements and Preparation
- CISO Guide: First 90 Days
- CISO Personal Liability Guide: Legal Exposure and How to Manage It
- CISSP Certification Guide: Domains, Requirements and Preparation
- Citizen Developer and Internal AI App Governance Guide: Low-Code, No-Code and AI Builders
- CJIS Security Policy Guide: Protecting Criminal Justice Information
- Claude for Enterprise Security Guide: Controls, Data Handling and Admin Settings
- Clickjacking Guide: Frame Protection with CSP and X-Frame-Options
- Client-Side Security Guide: Magecart and Script Risk
- Cloud Access Key Leak Playbook: Revoking, Rotating and Investigating Exposed Keys
- Cloud Concentration Risk and Exit Strategy Guide: Planning to Leave Before You Must
- Cloud Credential Compromise Playbook: Contain, Revoke and Investigate
- Cloud Forensics Guide: Investigating Incidents in AWS, Azure and Google Cloud
- Cloud IAM Review Checklist: AWS, Azure and Google Cloud
- Cloud Incident Response Guide
- Cloud Landing Zone Security Guide: Secure Foundations for New Cloud Estates
- Cloud Logging and Audit Trail Guide: CloudTrail and Activity Logs
- Cloud Misconfiguration Guide: Top Causes and Fixes
- Cloud Network Security Guide: VPCs and Security Groups
- Cloud PAM and CIEM Guide
- Cloud Penetration Testing Guide: Scope, Provider Rules and Identity Paths
- Cloud Recovery and Clean Room Guide: Rebuilding After a Destructive Attack
- Cloud Secrets Managers Guide: AWS, Azure and Google Cloud Compared
- Cloud Security Alliance CCM and STAR Guide: Cloud Controls Matrix
- Cloud Security Engineer Career Guide: Skills, Roles and Progression
- Cloud Security Guide: Shared Responsibility to CNAPP
- Cloud Security Maturity Model
- Cloud Workload Identity Buyer’s Guide
- Cloud Workload Identity Guide
- Cloudflare Security Configuration Guide: API Tokens, Zero Trust and WAF Settings
- CNAPP Buyer’s Guide
- CNAPP Guide: CSPM, CWPP, CIEM and CDR
- Co-Managed SOC and SOC-as-a-Service Guide: Models, Responsibilities and Contract Terms
- COBIT 2019 Guide: Governance Objectives and Design Factors
- Code Signing Buyer’s Guide: Choosing a Code Signing Platform
- Code Signing Security Guide
- Collaboration Tool Security Guide: Teams, Slack and Zoom
- Colorado AI Act Guide: ADMT Duties for Developers and Deployers
- Command and Control (C2) Guide: Cobalt Strike, Sliver and Beaconing
- Command Injection Guide: Preventing OS Command Execution Flaws
- Commercial Spyware Guide: Mercenary Spyware Risks and Protecting High-Risk Users
- Compliance Automation Buyer’s Guide
- Compliance Automation Guide
- Compliance Calendar Template: Tracking Recurring Security and Regulatory Deadlines
- CompTIA CySA+ Guide: Domains, Requirements and Preparation
- CompTIA PenTest+ Guide: Domains, Requirements and Preparation
- CompTIA Security+ Guide: Domains, Requirements and Preparation
- CompTIA SecurityX (CASP+) Guide: Domains, Requirements and Preparation
- Conditional Access Guide
- Confidential AI and GPU Enclaves Guide: Protecting AI Data in Use
- Confidential Computing Guide
- Connected and Autonomous Vehicle Security Guide: UN R155, ISO/SAE 21434 and Fleet Credentials
- Consent Management Guide: Cookies, CMPs, GPC and Consent Mode
- Consent Management Platform Buyer’s Guide
- Consent Phishing and Illicit OAuth Grants Guide: Controlling App Consent
- Container Image Security Guide: Base Images, Scanning and Signing
- Container Registry Security Guide: Access, Signing and Scanning
- Container Runtime Security Guide: Detecting and Containing Threats in Running Workloads
- Container Security Buyer’s Guide
- Container Security Guide
- Continuous Automated Red Teaming (CART) Guide: How CART Works and Where It Fits
- Contractor Identity Lifecycle Guide: Onboarding, Access Reviews and Offboarding
- Control Mapping Guide: One Control Set Across ISO 27001, SOC 2 and NIST
- COPPA and Children’s Privacy Guide: Consent, Data Minimisation and Security Duties
- CORS Misconfiguration Guide: Origin Policies That Do Not Leak Data
- COSO for Cybersecurity Guide: Applying COSO Internal Control and ERM to Cyber Risk
- Council of Europe AI Convention Guide: The First Binding AI Treaty
- Credential Dumping Guide: LSASS, NTDS.dit and Mimikatz
- Credential Vaulting for AI Agents Guide: Keeping Secrets Out of Prompts and Code
- CRISC Certification Guide: Domains, Requirements and Preparation
- Crisis Management Guide: Leading the Organisation Through a Major Cyber Incident
- Critical Infrastructure Identity Security Guide: Access Control for Essential Services
- Crypto Exchange Identity and Key Security Guide: Wallet Keys, Signing and Insider Risk
- Crypto Scam and Drainer Guide
- Crypto Wallet Security Guide
- Crypto-Agility Guide: Designing Systems That Can Change Algorithms
- Cryptographic Inventory and CBOM Guide: Finding Every Key, Certificate and Algorithm
- Cryptographic Key Management Guide: KMS, HSM and Signing Keys
- Cryptography Basics Guide for Security Teams
- Cryptojacking Guide: Stolen Cloud Credentials, Detection and Cost Control
- CSRF Prevention Guide: Tokens, SameSite Cookies and Framework Defences
- CUI Guide: CUI Basic vs CUI Specified, Marking and Handling
- Customer IAM (CIAM) Guide: Securing Customer Identity
- CVE Programme and NVD Backlog Guide: How CVEs Work and Coping with Enrichment Gaps
- CWE Top 25 Guide: The Most Dangerous Software Weaknesses
- Cyber Essentials Guide
- Cyber Insurance Guide: Coverage, Requirements and Claims
- Cyber Kill Chain and Diamond Model Guide: Frameworks for Analysing Intrusions
- Cyber Ranges, CTFs and Hands-On Training Guide: Building Practical Skills
- Cyber Recovery Vault Guide: Isolated, Immutable Recovery for Ransomware
- Cyber Resilience Guide
- Cyber Risk Appetite Statement Template: Defining Board-Approved Risk Tolerances
- Cyber Risk Quantification Guide: FAIR and Monte Carlo
- Cyber Warfare Guide: State Conflict in Cyberspace and What It Means for Organisations
- Cyber Whistleblowing Guide: Reporting Channels, Protections and Handling
- CyberArk Security Hardening Guide: Protecting the Vault That Protects You
- Cybercrime Ecosystem Guide: RaaS, Initial Access Brokers and Bulletproof Hosting
- Cybersecurity Careers Guide: Roles and Paths
- Cybersecurity Certifications Guide
- Cybersecurity Skills Gap and Hiring Guide: Recruiting, Developing and Retaining Talent
- Dark Web Monitoring Buyer’s Guide: Choosing a Provider
- Dark Web Monitoring Guide
- Data Access Governance Guide: Who Can Access Sensitive Data and Why
- Data Breach Notification Checklist (GDPR and US States)
- Data Centre Security Guide: Physical, Environmental and Access Controls
- Data Classification Guide
- Data Classification Policy Template: Levels, Labelling and Handling Rules
- Data Exfiltration Guide: Techniques and Detection
- Data Extortion Without Encryption Guide: Theft-Only Attacks and Response
- Data Governance and Data Catalogue Security Guide: Ownership, Classification and Access
- Data Loss Prevention (DLP) Guide
- Data Mapping and ROPA Guide
- Data Masking and Tokenisation Buyer’s Guide: Evaluating Data De-identification Tools
- Data Retention and Secure Deletion Guide: Schedules and Sanitisation
- Data Security Guide: DSPM, DDR and Data Exposure
- Data Security Maturity Model
- Data Security Platform Buyer’s Guide
- Data Sovereignty and Residency Guide: Sovereign Cloud and Localisation
- Database Credential and Access Security Guide: Service Accounts
- Database Security Guide
- Databricks Security Guide: Workspaces, Unity Catalog and Service Principals
- DDoS Protection Buyer’s Guide: Evaluating Mitigation Services and Architectures
- DDoS Protection Guide
- DDoS Response Playbook: Detecting, Mitigating and Recovering from Attacks
- Deception Technology Buyer’s Guide: Choosing a Deception Platform
- Deception Technology Guide: Honeypots and Canary Tokens
- Deepfake CEO Fraud Response Playbook: Stopping Impersonation Payments
- Deepfake-Resistant Identity Verification Guide: Liveness, Injection Attacks and Assurance
- Deepfakes, Social Engineering and AI Impersonation Guide
- DeepSeek and High-Risk AI Vendor Assessment Guide: Evaluating AI Supplier Risk
- Defence Industrial Base Identity Security Guide: CMMC, Cyber Essentials and Supplier Access
- Degraded-Mode Operations and Manual Workarounds Guide: Keeping Critical Services Running Without IT
- Denial-of-Wallet and AI Agent Cost Runaway Guide: Limits and Detection
- Detection Engineer Career Guide: Skills, Roles and Progression
- Detection Engineering Guide: Detection as Code, Sigma and Coverage
- Detection Engineering Maturity Model: From Vendor Defaults to Detection as Code
- Device and IoT Identity Guide
- Device Code Phishing Guide: Detecting and Blocking OAuth Device Flow Abuse
- Device Compliance and Endpoint Posture Guide
- Device Intelligence and Fingerprinting Guide
- DevSecOps Guide: Building Security into the Delivery Pipeline
- DFIR Analyst Career Guide: Skills, Roles and Progression
- Digital Forensics (DFIR) Guide
- Digital Forensics Tools Buyer’s Guide: Evaluating DFIR Platforms and Tools
- Digital Identity, eID and Identity Wallets Guide
- Digital Twin Security Guide: Data Flows, Access and Model Integrity
- Disaster Recovery Plan Template: Recovery Objectives, Runbooks and Testing
- Disinformation and Brand Impersonation Guide: Fake Accounts, Sites and Response
- Disk Encryption Guide: BitLocker and FileVault Deployment
- DLP Buyer’s Guide
- DMARC Buyer’s Guide: Choosing a DMARC Reporting and Enforcement Service
- DMARC, SPF and DKIM Guide: From p=none to p=reject
- DNS Security Guide: Protective DNS, DNSSEC and DoH
- DORA and NIS2 Overlap Mapping Guide: One Programme for Both Regimes
- DORA Guide: Digital Operational Resilience for Financial Entities
- DPIA Guide: When and How to Run a Data Protection Impact Assessment
- DPIA Template
- Drone and Counter-UAS Security Guide: Fleet Security, Threats and Legal Limits
- DSAR Guide: Handling Data Subject Requests at Scale
- DSPM Buyer’s Guide
- EBA ICT and Security Risk Guidelines Guide: Requirements and the Move to DORA
- Edge Device Security Guide
- eDiscovery and Legal Hold Guide: Preserving and Producing Electronic Evidence
- EDR and XDR Buyer’s Guide
- EDR Evasion and Defence Guide: BYOVD, Unhooking and Tamper Protection
- EDR Guide: Deployment, Tuning and Operations
- EDR Tuning and Exclusions Management Guide: Reducing Noise Without Creating Blind Spots
- Education Identity Security Guide
- Elastic Security Guide: SIEM, Detection Rules and Endpoint Protection
- Electron and Desktop App Security Guide: Hardening Cross-Platform Apps
- Email Authentication for Developers Guide: BIMI, ARC and MTA-STS
- Email Identity and BEC Guide: DMARC, SPF and DKIM
- Email Security Buyer’s Guide
- Email Security Guide: SEG, ICES and API-Based Protection
- Embedded AI in SaaS Guide: Governing AI Features Switched On by Vendors
- Embedded Device Security Guide: EMB3D and Secure Firmware Updates
- Employee Monitoring and Privacy Guide: Lawful, Proportionate Workplace Monitoring
- Employee Offboarding Security Guide: Revoking Every Account and Credential
- Encryption Buyer’s Guide: Evaluating Key Management, HSM and Data Encryption
- Encryption Guide: At Rest, In Transit and In Use
- Encryption Policy Template: Algorithms, Key Management and Data States
- Endpoint DLP Guide: Policies, Channels and Deployment
- Endpoint Hardening Checklist
- Endpoint Privilege Management Buyer’s Guide: Evaluating Local Admin Removal Tools
- Endpoint Privilege Management Guide: Removing Local Admin Rights
- Endpoint Security Guide: EDR, XDR, EPP and Hardening
- Endpoint Security Maturity Model
- Endpoint Telemetry Guide: What to Collect and How to Use It
- Energy Sector Identity and OT Access Guide: Engineers, Vendors and Remote Sites
- Enterprise Browser and Browser Security Guide
- Enterprise Data Lake Security Guide: Access, Encryption and Governance
- Entra ID Applications and Consent Guide: Enterprise Apps
- Entra ID Security Guide: Hardening Your Microsoft Identity Tenant
- Essential Eight Guide
- ETSI EN 303 645 Consumer IoT Guide: The 13 Provisions and How to Meet Them
- EU AI Act AI Literacy Obligations (Article 4) Guide: What Organisations Must Do
- EU AI Act Compliance Guide
- EU AI Act High-Risk AI Systems Guide: Classification and Obligations
- EU AI Act Prohibited Practices Guide: What Article 5 Bans
- EU Cyber Resilience Act Guide
- EU Data Act Guide: Data Access, Cloud Switching and Security Obligations
- EU General-Purpose AI (GPAI) Code of Practice Guide: Transparency, Copyright and Safety
- EU Radio Equipment Directive Cybersecurity Guide: Delegated Act Requirements and EN 18031
- EV Charging Security Guide: OCPP, ISO 15118 and Charger Identity
- Executive and VIP Device Protection Guide: Securing High-Value Targets
- Executive Deepfake and CEO Fraud Guide: Verification Controls That Work
- Executive Protection and Digital Footprint Guide: Reducing Exposure for Leaders
- Explainable and Fair AI Guide: Testing for Bias and Explaining Decisions
- Exposure Management and CTEM Guide
- Exposure Management Buyer’s Guide: Choosing a CTEM Platform
- Externalised Authorisation Buyer’s Guide: Choosing a Policy Engine
- FDA Medical Device Cybersecurity Guide: Premarket Submissions, SBOMs and Section 524B
- Federation and Trust Guide: AD Trusts and Cross-Tenant Access
- FedRAMP Guide
- FERPA Guide for Security Teams: Protecting Education Records and Access
- FFIEC Cybersecurity Guidance Guide: Handbooks, Assessments and Expectations
- File Upload Security Guide: Validation and Unrestricted Uploads
- Fileless Malware Guide: Living off the Land, Detection and Prevention
- FIN7 Threat Actor Profile: From Card Theft to Ransomware Partnerships
- Financial Services Identity Security Guide
- Fine-Tuning and LoRA Security Guide: Protecting Custom Models
- Firewall Buyer’s Guide
- Firewall Management Guide: Rules, Reviews and Policy Hygiene
- Firewall Rule Review Checklist
- Firmware and Boot Security Guide: UEFI, Secure Boot and TPM
- France SecNumCloud Guide: ANSSI Qualification for Trusted Cloud
- Fraud and Cyber Convergence Guide
- Fraud Prevention Guide for Digital Businesses
- Fraud Prevention Platform Buyer’s Guide
- Frontier AI Model Risk Frameworks Guide: Comparing AI Lab Safety Policies
- Fuzzing Guide: Finding Bugs with Coverage-Guided and API Fuzzing
- GDAP and MSP Delegated Admin Access Guide: Least Privilege for Partners
- GDPR Compliance Guide for Security Teams
- Gemini for Google Workspace Security Guide: Admin Controls and Data Protection
- Generative AI Data Loss Prevention Guide
- Germany BSI C5 Guide: Cloud Compliance Criteria and Attestation
- GIAC GCFA Guide: Exam, Requirements and Preparation
- GIAC GCIH Guide: Exam, Requirements and Preparation
- GIAC GPEN Guide: Exam, Requirements and Preparation
- GIAC GREM Guide: Exam, Requirements and Preparation
- GIAC GSEC Guide: Exam, Requirements and Preparation
- Git Secret Scanning Guide: Finding and Stopping Leaked Credentials
- GitHub and GitHub Actions Security Guide: Tokens and Runners
- GitHub Copilot Security Guide: Governing AI Coding Assistants
- GitLab Security Guide: Tokens, Runners and Pipeline Security
- GitOps Security Guide: Argo CD and Flux
- GLBA Safeguards Rule Guide
- Global AI Regulation Map
- Global Cybersecurity Regulatory Map
- Global Privacy Regulatory Map
- gMSA and dMSA Guide: Group and Delegated Managed Service Accounts
- Golden Ticket, Silver Ticket and DCSync Guide: Detecting and Preventing Kerberos Abuse
- Google Cloud IAM and Service Accounts Guide: Roles and Keys
- Google Cloud Organization Policy Guide: Constraints and Guardrails
- Google Cloud Security Guide
- Google Professional Cloud Security Engineer Guide: Exam, Requirements and Preparation
- Google Security Operations (Chronicle) Guide: UDM, YARA-L Detections and SOAR
- Google Vertex AI Security Guide: Securing Models, Agents and Data
- Google Workspace Security Guide
- GraphQL Security Guide: Introspection, Query Depth and Batching
- GRC Analyst Career Guide: Skills, Roles and Progression
- GRC Maturity Model
- GRC Platform Buyer’s Guide
- Hacktivism Guide: DDoS, Defacement, OT Claims and Response
- Hardware Security Keys Buyer’s Guide: Evaluating FIDO2 Keys for the Enterprise
- Hardware Security Keys Guide: FIDO2 Keys, YubiKeys and eTokens
- HashiCorp Vault Guide: Auth Methods, Dynamic Secrets and Operations
- Health Data Privacy Beyond HIPAA Guide: My Health My Data and State Laws
- Healthcare Identity Security Guide
- Helm Security Guide: Charts, Repositories and Release Secrets
- HHS HIPAA Security Rule Update (2025 NPRM) Guide: What the Proposed Changes Mean and Their Status
- HIPAA Security Rule Guide
- Hiring Fraud and Candidate Identity Verification Guide: Verifying Candidates Before Access Is Granted
- HITRUST CSF Guide: e1, i1 and r2 Assessments and Certification
- Home Office and Remote Worker Security Guide: Securing Work Outside the Office
- HTTP Request Smuggling Guide: Proxy Desync Risks and Prevention
- HubSpot Security Guide: Users, Private Apps and Integration Tokens
- Hugging Face Security Guide: Models, Spaces and Access Tokens
- Human vs Non-Human Identity
- Human-in-the-Loop for AI Agents Guide: Approval Gates and Oversight Patterns
- Hypervisor and Virtualisation Security Guide: Protecting the Virtualisation Layer
- IAM and Identity Provider Buyer’s Guide
- IAM and IGA Basics
- IAM Engineer Career Guide: Skills, Roles and Progression
- IAPP AIGP (AI Governance Professional) Guide: Domains, Requirements and Preparation
- Identity Attack Paths Guide
- Identity Certifications Guide: CIDPRO and Vendor IAM Credentials
- Identity Convergence Guide
- Identity Data Privacy and Consent Guide
- Identity Data Quality and Identity Fabric Guide
- Identity for IoT Fleets Guide: Provisioning and Rotating Device Credentials
- Identity for OT Environments Guide: Securing Access to Industrial Systems
- Identity Fraud Prevention Guide
- Identity Governance for AI Agents Guide: Registry and Ownership
- Identity Governance Maturity Model: Assessing IGA Maturity Levels
- Identity in Mergers and Acquisitions Guide: Day One and Divestitures
- Identity Incident Response Playbook: Compromised Accounts
- Identity Orchestration Buyer’s Guide: Evaluating Orchestration Platforms
- Identity Orchestration Guide: Unifying Fragmented Identity Systems
- Identity Proofing and KYC Guide: Verifying People Before You Trust Them
- Identity Provider and SSO Security Guide
- Identity Security Maturity Model
- Identity Security Metrics and KPIs Guide
- Identity Security Posture Management (ISPM) Guide
- Identity Security Programme Guide
- Identity Security Regulatory Map
- Identity Threat Detection and Response (ITDR) Guide
- Identity Verification Buyer’s Guide
- IDS and IPS Guide: Detection Methods, Placement and Tuning
- IEC 62443 Guide: Zones, Conduits and Security Levels
- IGA Buyer’s Guide
- Illinois BIPA and Biometric Privacy Guide: Consent, Retention and Litigation Risk
- Incident Communication Plan Template: Stakeholders and Regulators
- Incident Response Guide: Plans, Playbooks and Retainers
- Incident Response Maturity Model
- Incident Response Plan Template
- Incident Response Retainer Buyer’s Guide: Evaluating IR Retainer Services
- Incident Severity Classification Matrix Template: Rating and Escalating Incidents
- India DPDP Act Guide: Digital Personal Data Protection Act
- Industrial IoT (IIoT) Security Guide: Device Identity, Gateways and Cloud Connections
- Information Security Policy Template
- Infostealer Threat Guide
- Infrastructure as Code Security Guide: Terraform and Scanning
- Insecure Deserialisation Guide: Object Injection and Gadget Chains
- Insider Data Theft Guide: Detecting and Preventing Data Exfiltration by Insiders
- Insider Data Theft Response Playbook: Investigating and Containing Insider Exfiltration
- Insider Risk from AI Tools Guide: Data Leakage, Shadow AI and Monitoring Limits
- Insider Risk Management Buyer’s Guide: Signals, Privacy and Case Workflow
- Insider Threat and Identity Guide
- Insider Threat from Fake IT Workers Guide (North Korean IT Worker Schemes): Detecting and Preventing Fraudulent Remote Hires
- Insider Threat Programme Guide: Detection, DLP and HR Process
- Insurance Sector Identity Security Guide: Brokers, Claims Systems and Regulator Expectations
- Internal Audit for Cybersecurity Guide: Planning and Delivering Cyber Audits
- iOS and iPadOS Enterprise Security Guide: Managing and Hardening Apple Mobile Devices
- iOS App Security Guide: Keychain, App Transport Security and App Attest
- IoT Security Buyer’s Guide: Device Visibility, Segmentation and Vendor Questions
- IoT Security Guide
- IPv6 Security Guide: Router Advertisements and DHCPv6
- IRS Publication 1075 Guide: Safeguarding Federal Tax Information
- ISACA AAISM and AAIA AI Certifications Guide: Exam, Requirements and Preparation
- ISC2 Certified in Cybersecurity (CC) Guide: Domains, Requirements and Preparation
- ISO 22301 Business Continuity Guide: Building and Certifying a BCMS
- ISO 27001 Certification Readiness Checklist: Preparing for Stage 1 and Stage 2 Audits
- ISO 27001 Guide: Certification Step by Step
- ISO 27001 Lead Auditor and Lead Implementer Guide: Courses, Exams and Career Value
- ISO 27002 Controls Guide: Annex A Controls and Themes
- ISO 31000 Risk Management Guide: Principles, Framework and Process
- ISO 42001 Lead Auditor and Lead Implementer Guide: Courses, Exams and Career Value
- ISO/IEC 23894 AI Risk Management Guide: Applying ISO 31000 to AI
- ISO/IEC 27005 Information Security Risk Guide: Assessing and Treating Risk
- ISO/IEC 27017 Cloud Security Controls Guide: Guidance for Providers and Customers
- ISO/IEC 27018 Cloud PII Protection Guide: Controls for Public Cloud Processors
- ISO/IEC 27035 Incident Management Guide: Principles, Process and Readiness
- ISO/IEC 27036 Supplier Relationships Guide: Securing the Supply Chain
- ISO/IEC 27701 Privacy Information Management Guide
- ISO/IEC 42001 Guide: AI Management Systems
- ISO/IEC 42005 AI System Impact Assessment Guide: Assessing Effects on People
- ITDR Buyer’s Guide
- ITIL 4 Information Security Management Guide: The Practice and Its Links to ISO 27001
- IVIP and ISPM Buyer’s Guide
- Jamf Guide: Securing Apple Fleet Management and API Access
- Japan AI Promotion Act Guide: What It Means for Organisations
- Japan APPI Guide: Handling Personal Information, Transfers and Breach Reporting
- Java and Spring Security Guide: Securing Enterprise Java Applications
- Jenkins Security Guide: Controllers, Agents, Plugins and Credentials
- Joiner-Mover-Leaver (JML) Guide
- Just-in-Time Access and Zero Standing Privilege Guide
- JWT Security Guide: Signing, Validation and Token Attacks
- Kerberos Delegation Security Guide: Unconstrained and Constrained
- Kerberos Security Guide: Kerberoasting, Ticket Attacks and Detection
- Kimsuky Threat Actor Profile: Spear Phishing, Impersonation and Defences
- Kiosk and Shared Device Security Guide: Locking Down Multi-User Endpoints
- Know Your Agent (KYA) Guide: Verifying AI Agents Before You Trust Them
- KQL for Threat Hunting Guide: Queries and Hunts Across Microsoft Logs
- Kubernetes Admission Control Guide: OPA Gatekeeper and Kyverno
- Kubernetes NHI Security Guide
- Kubernetes RBAC Guide: Roles, Bindings and Service Account Permissions
- Kubernetes Security Guide
- Kubernetes Service Account Token Guide: Bound, Short-Lived and Least Privilege
- KYB and Business Identity Verification Guide
- LAPS Guide: Windows LAPS Deployment and Permissions
- Lapsus$ Threat Actor Profile: MFA Fatigue, Insiders and Help Desk Abuse
- Lateral Movement Guide: Techniques and Detection
- Law Firm Identity and Data Security Guide: Client Confidentiality and Access Control
- Layer 2 Attacks Guide: VLAN Hopping, ARP Spoofing and MAC Flooding
- Lazarus Group Threat Actor Profile: Crypto Theft, Fake Recruiters and Defences
- Leaked Credential and Secret Incident Response Playbook
- Linux Detection and Response Guide: auditd, eBPF and Linux EDR
- Linux Server Hardening Guide
- Living off the Land Guide: LOLBins and Dual-Use Tools
- LLM Observability Guide: Tracing, Logging and Monitoring AI Applications
- LLM Provider API Key Security and LLMjacking Guide
- LLM Security Guide: Prompt Injection, Jailbreaks and Data Leakage
- Local Government Identity Security Guide: Councils, Shared Services and Resilience
- Log Management and Retention Guide
- Logging and Monitoring Policy Template: Log Sources, Retention and Review
- Lost or Stolen Device Response Checklist
- Low-Code Agent Platform Security Guide
- Machine Identity, PKI and Certificate Lifecycle Guide
- Machine-to-Machine OAuth (Client Credentials) Guide: Securing Service Access
- macOS Detection and Response Guide: Telemetry and Threat Hunting
- macOS Security Guide for Enterprises
- Mainframe Security Guide: RACF, ACF2 and Top Secret
- Major IT Outage Lessons Guide: Resilience Lessons from Large-Scale Failures
- Malicious Package and Dependency Confusion Guide
- Malvertising and SEO Poisoning Guide: Fake Downloads and Defences
- Malware Guide: Types, Families and How They Work
- Managed File Transfer (MFT) Security Guide: Hardening and Monitoring
- Manufacturing Identity and OT Access Guide: Securing the Plant Floor
- Maritime Cybersecurity Guide: Vessel OT, IMO Rules and Port Systems
- MAS Technology Risk Management Guide: TRM Guidelines and Cyber Hygiene
- MCP Gateway and MCP Server Governance Guide: Approving, Brokering and Monitoring MCP
- MCP Security Guide: Securing the Model Context Protocol
- MDR Buyer’s Guide
- MDR Guide: Choosing and Working with a Provider
- Medical Device Security Guide
- Memory Forensics Guide: Capturing and Analysing Volatile Evidence
- Memory-Safe Languages Guide: Why They Matter and How to Migrate
- MFA Fatigue and Bypass Guide: Push Bombing, SIM Swap and Downgrade Attacks
- MFA Guide: Methods, Phishing Resistance and Bypass Techniques
- Microservices Security Guide: Service Identity, APIs and Segmentation
- Microsoft 365 Copilot Security Deep Dive: Oversharing, Permissions and Data Protection
- Microsoft 365 Security Guide
- Microsoft Azure Security Guide
- Microsoft Defender for Endpoint Guide: Deployment, Hardening and Operations
- Microsoft Intune Guide: Compliance Policies, Admin Roles and Hardening
- Microsoft Security Certifications Guide: SC-100, SC-200, SC-300 and SC-500
- Microsoft Sentinel Guide: Data Connectors, Analytics Rules and Automation
- MITRE ATLAS Guide: AI Attack Techniques Explained
- MITRE ATT&CK Coverage Mapping Guide: Measuring Detection Coverage Honestly
- MITRE ATT&CK Guide for Defenders
- MITRE D3FEND Guide: Defensive Techniques Mapped
- Mobile App Security Guide
- Mobile App Security Testing Guide: MASVS and MASTG
- Mobile Device Security Guide: MDM, MAM, MTD and BYOD
- Mobile Driving Licence (mDL) Guide
- Mobile Forensics Guide: Acquiring and Analysing Mobile Device Evidence
- Mobile Malware Guide: Android Banking Trojans and Spyware
- Mobile Threat Defense Buyer’s Guide: Evaluating MTD for iOS and Android
- Model Supply Chain Guide: Malicious Models, Pickle Files and Safetensors
- Money Mule Detection Guide: Mule Accounts, Networks and AML Signals
- mTLS Guide: Mutual Authentication Between Services
- Multi-Cloud Identity Guide: AWS, Azure and Google Cloud
- Multi-Tenant SaaS Architecture Security Guide: Tenant Isolation by Design
- NCSC Cyber Assessment Framework (CAF) Guide: Objectives and Principles
- NDR Buyer’s Guide
- NERC CIP Guide: Compliance for the Bulk Electric System
- Network Access Control (NAC) Guide
- Network Access Control Buyer’s Guide: Evaluating Device Admission and Posture Tools
- Network Detection and Response (NDR) Guide
- Network Forensics Guide: Capturing and Analysing Network Evidence
- Network Monitoring and Packet Capture Guide: Flow Data, Full Capture and Retention
- Network Ports and Protocols Security Guide
- Network Segmentation and Microsegmentation Guide
- Next-Generation Antivirus (NGAV) Guide: How It Works and Where It Fits
- NHI and IAM Glossary
- NHI Authentication Guide
- NHI Governance Maturity Model
- NHI Offboarding and Decommissioning Guide: Retiring Machine Identities Safely
- NHI Ownership and Accountability Guide
- NHI Ownership Attestation Campaigns Guide: Certifying Owners for Machine Identities
- NHI Policy Template: Ownership, Credentials, Rotation and Decommissioning
- NHI Risk Scoring Guide: Prioritising Machine Identity Risk
- NHI Security Platform Buyer’s Guide
- NIS2 Directive Guide
- NIS2 Readiness Checklist: Preparing for NIS2 Obligations
- NIST AI 600-1 Generative AI Profile Guide: The 12 GenAI Risks and Actions
- NIST AI RMF Guide
- NIST CSF to ISO 27001 Mapping Guide: Using Both Frameworks Together
- NIST Cybersecurity Framework 2.0 Guide
- NIST Risk Management Framework (SP 800-37) Guide: The Seven Steps from Prepare to Monitor
- NIST Secure Software Development Framework (SSDF, SP 800-218) Guide: Practices, Attestation and Implementation
- NIST SP 800-161 Cyber Supply Chain Risk Management Guide: C-SCRM Practices and Supplier Controls
- NIST SP 800-171 and CMMC 2.0 Guide
- NIST SP 800-190 Container Security Guide: Securing Images, Registries, Orchestrators and Hosts
- NIST SP 800-207 Zero Trust Architecture Guide: Tenets, Components and Deployment Models
- NIST SP 800-30 Risk Assessment Guide: Threats, Likelihood, Impact and Risk Ratings
- NIST SP 800-53 Guide
- NIST SP 800-61 Incident Response Guide: Recommendations Mapped to CSF 2.0
- NIST SP 800-63 Digital Identity Guidelines Guide: Assurance Levels in Practice
- NIST SP 800-82 OT Security Guide: Applying Revision 3 to Industrial Systems
- NIST SP 800-92 Log Management Guide: Planning, Collecting and Retaining Security Logs
- Node.js Security Guide: npm Supply Chain, Runtime Risks and Secrets
- Non-Profit Identity Security Guide: Low-Cost Controls for Charities
- NYC Automated Employment Decision Tools (AEDT) Law Guide: Bias Audits and Candidate Notices
- NYDFS Part 500 Guide: 23 NYCRR 500 Requirements and Amendments
- OAuth 2.0 and OpenID Connect Guide for Identity Teams
- OAuth 2.1, GNAP and FAPI Guide: Modern Authorisation Protocols Explained
- OAuth Token Exchange and Delegation Guide: RFC 8693 and On-Behalf-Of
- OAuth Token Theft Incident Playbook: Contain, Revoke and Recover
- OECD AI Principles Guide: The Five Values and How to Apply Them
- Oil and Gas Cybersecurity Guide: Upstream, Pipeline and Refinery OT Security
- Okta Security Hardening Guide: Admin Roles and Session Protection
- Open Redirect Guide: Safe Redirects and OAuth Redirect URI Validation
- Open Source Licence Compliance Guide: Obligations, SBOMs and Policy
- Open Source Security Guide
- Open-Weight Model Security Guide: Llama, Mistral, DeepSeek and Qwen
- OpenSSF Scorecard Guide: Checks, Scores and Using Results in Dependency Decisions
- Oracle Cloud Infrastructure Security Guide: IAM, Network and Tenancy Controls
- Oracle E-Business Suite and Fusion Security Guide: Patching, Access and Exposure
- OSCP Certification Guide: Exam, Requirements and Preparation
- OSEP and OSWE Certification Guide: Exam, Requirements and Preparation
- OSINT and Reconnaissance Guide: Measuring and Reducing Your Exposed Footprint
- OT and ICS Identity and Access Guide
- OT Asset Visibility Guide: Discovery, Inventory and Monitoring
- OT Incident Response Guide: Containment, Safety and Recovery
- OT Penetration Testing Guide: Safe Testing of Industrial Control Systems
- OT Remote Access Guide: Vendor Access, Jump Hosts and Session Control
- OT Security Guide: ICS, SCADA, the Purdue Model and Segmentation
- OT Security Maturity Model
- OT Security Platform Buyer’s Guide
- OWASP ASVS Guide: Levels, Requirements and Benchmark Testing
- OWASP Mobile Top 10 Guide: Risks and Controls for Mobile Apps
- OWASP Top 10 for Agentic Applications Guide: Each Risk and Its Controls
- OWASP Top 10 for LLM Applications Guide
- OWASP Top 10 Guide
- PAM Buyer’s Guide
- PAM Maturity Model: Assessing Privileged Access Management Maturity
- Pass-the-Hash and Pass-the-Ticket Guide: Detecting and Preventing Credential Replay
- Passkey Rollout Guide: Moving Users Off Passwords
- Password Manager Buyer’s Guide: Evaluating Enterprise Password Managers
- Password Policy Guide (NIST-aligned): Length, Screening and No Forced Rotation
- Password Policy Template: Length, Screening, MFA and Service Account Rules
- Password Security and Password Manager Guide
- Password Spraying and Credential Stuffing Guide
- Passwordless and MFA Buyer’s Guide
- Passwordless and Passkeys Guide for Workforce and Customers
- Patch Management Buyer’s Guide
- Patch Management Guide: Windows, macOS, Linux and Third-Party Apps
- Patch Management Policy Template: Timelines, Testing and Exceptions
- Patch Tuesday Guide: Planning Monthly Microsoft Updates
- Path Traversal Guide: Preventing Directory Traversal and File Access Flaws
- Payment Fraud Guide: Card-Not-Present, 3DS and Chargebacks
- PCI DSS 4.0 Guide
- PCI DSS 4.0 to ISO 27001 Mapping Guide: Reusing Controls Across Both
- PCI DSS Readiness Checklist: Preparing for a PCI DSS 4.0.1 Assessment
- Penetration Test Scoping Checklist
- Penetration Tester Career Guide: Skills, Certifications and Ethics
- Penetration Testing Guide: Types, Scoping and PTaaS
- Penetration Testing Provider Buyer’s Guide
- Permission-Aware RAG Guide: Securing Agent Access to Enterprise Data
- Persistence Techniques Guide: Run Keys, Scheduled Tasks and Implants
- Personnel Security and Background Screening Guide: Screening, Ongoing Assurance and Leavers
- Pharma and GxP Cybersecurity Guide: Data Integrity, Validated Systems and Part 11
- Phishing Guide: Types, Kits and Defences
- Phishing Incident Response Playbook
- Phishing Simulation Programme Guide
- Phishing-Resistant MFA Guide
- PHP and WordPress Security Guide: Core, Plugins, Secrets and Hardening
- Physical Security Guide for Security Teams: Sites, Access Control and Convergence with Cyber
- Ping Identity Security Hardening Guide: Locking Down PingOne and PingFederate
- Play Ransomware Profile: Initial Access, Extortion and Defences
- PLC Security Guide: Hardening Controllers, Logic Integrity and Engineering Access
- Policy Lifecycle Management Guide: Writing, Approving and Retiring Security Policies
- Policy-as-Code for Authorisation Guide: OPA, Cedar and Rego
- Ports and Logistics Cybersecurity Guide: Terminal OT, Port Community Systems and Supply Chain
- Post-Incident Review and Root Cause Analysis Template: Blameless Learning After Incidents
- Post-Quantum Cryptography Migration Guide: Crypto Inventory and Agility
- Post-Quantum Migration for NHIs Guide: Preparing Machine Credentials
- Post-Quantum Readiness for Identity and PKI
- PowerShell Security Guide: Logging, Constrained Language and Abuse
- Practical Red Team Certifications Guide: CRTO, CRTP and PNPT
- Printer and Print Server Security Guide: Hardening an Overlooked Attack Surface
- Privacy by Design Guide for Engineering Teams
- Privacy Management Platform Buyer’s Guide
- Privacy Programme Guide for Security Teams: From GDPR to US State Laws
- Privacy Programme Maturity Model
- Privacy-Enhancing Technologies Guide: Anonymisation, Differential Privacy and Clean Rooms
- Privileged Access Management Guide
- Privileged Identity Management (PIM) Guide: Eligible Assignments
- Privileged Session Management Guide
- Promotion and Bonus Abuse Guide: Multi-Accounting and Referral Fraud
- Prompt Injection Guide: Direct, Indirect and Tool Poisoning
- Prototype Pollution Guide: JavaScript Object Safety and Prevention
- PSD2/PSD3 Strong Customer Authentication Guide: Requirements, Exemptions and Changes
- Public Sector Identity Security Guide
- Purple Teaming Guide: Adversary Emulation and Detection Validation
- Python Security Guide: Dependencies, Unsafe Patterns and Secrets
- Q-Day Planning Guide: Preparing for Cryptographically Relevant Quantum Computers
- QR Code Phishing (Quishing) Guide
- Race Condition Vulnerabilities Guide: Concurrency Flaws and Safe Design
- RAG Security Guide: Retrieval Poisoning and Vector Database Security
- Rail Cybersecurity Guide (TS 50701): Zones, Conduits and Signalling Security
- Ransomware Groups Guide: LockBit, Akira, Qilin and Others
- Ransomware Negotiation Guide: Decisions, Legal Limits and Process
- Ransomware Payments and Sanctions Guide: OFAC, UK Payment Ban Proposals and Reporting
- Ransomware Playbook Template
- Ransomware Prevention Guide
- Ransomware Response and Recovery Guide
- Rate Limiting and API Abuse Guide: Throttling, Quotas and Bot Defence
- Reachability Analysis Guide: Prioritising Vulnerabilities That Can Actually Be Reached
- React and Next.js Security Guide: Securing Modern Web Front Ends
- Red Team Rules of Engagement Template: Scope, Authorisation and Stop Conditions
- Red Teaming AI Agents for Identity Abuse
- Red Teaming Guide
- Regulatory Change Management Guide: Tracking and Implementing New Obligations
- Remediation SLAs and Vulnerability Exceptions Guide: Setting Deadlines and Governing Exceptions
- Remote Access Identity Guide: From VPN to ZTNA
- Remote Access Policy Template: Approved Methods, MFA and Third-Party Access
- Remote Browser Isolation Guide: How Isolation Works and When It Helps
- Remote Desktop (RDP) Security Guide: Exposure, NLA and Gateways
- Remote Monitoring and Management (RMM) Tool Security Guide
- Removable Media and USB Control Guide: Device Control and Encryption
- Research Institution Identity Security Guide: Federated Access, Research Data and Export Controls
- Retail and E-Commerce Identity Security Guide: Protecting Customers and Stores
- Risk Register Template
- Risk-Based Vulnerability Management Guide: Using KEV, EPSS and Context to Prioritise
- Robotics Security Guide: Industrial Robots, Cobots and Robot Identity
- Rogue and Runaway AI Agent Detection Guide: Signals and Response
- Role Mining and Role Design Guide
- Rootkits and Bootkits Guide: Boot Integrity, Detection and Recovery
- RPA and Bot Identity Security Guide: UiPath and Power Automate
- Rust Security Guide: Memory Safety, unsafe Code and Crate Supply Chain
- SaaS API Token Security Guide: Slack, GitHub PATs and Salesforce Connected Apps
- SaaS Backup Buyer’s Guide: Evaluating Backup for Microsoft 365, Google Workspace and Salesforce
- SaaS Security Buyer’s Guide
- SaaS Security Guide: SSPM and Configuration Drift
- SaaS-to-SaaS and OAuth App Governance Guide
- Safety Instrumented Systems Security Guide: Protecting the Last Line of Defence
- Salesforce Security Guide: Connected Apps and Permission Sets
- Salt Typhoon Threat Actor Profile: Telecom Intrusions and Lawful Intercept Exposure
- SAML Security Guide: Golden SAML and Signature Wrapping
- Sandworm Threat Actor Profile: Destructive Attacks on Critical Infrastructure
- SAP Identity and Access Guide: Authorisations and Firefighter Access
- SASE and SSE Buyer’s Guide
- SASE and SSE Guide
- Satellite IoT and Satellite Communications Security Guide: Ground Stations, Terminals and Links
- Saudi NCA Essential Cybersecurity Controls Guide: Domains, Scope and Compliance
- SBOM Guide: SPDX, CycloneDX and VEX
- Scattered Spider Threat Actor Profile: Help Desk Social Engineering and Identity Attacks
- SCIM and Automated Provisioning Guide
- SD-WAN Security Guide: Securing Overlays, Controllers and Branch Edges
- SEC Cybersecurity Disclosure Rules Guide
- Secret Sprawl Measurement Guide: Metrics That Show Real Exposure
- Secrets Management Buyer’s Guide
- Secrets Management Guide: Centralise, Restrict, Shorten and Remove
- Secrets Management Maturity Model: From Hard-Coded Secrets to Automated Rotation
- Secrets Rotation Runbook Template: Planned and Emergency Key Rotation
- Secrets Scanning Buyer’s Guide: Evaluating Tools for Leaked Credentials
- Secure Code Review Guide: Methods, Checklists and Tooling
- Secure Coding Guide
- Secure Development Lifecycle (SSDLC) Guide: Secure by Design
- Secure File Sharing Guide: External Sharing, Links and Collaborators
- Secure SDLC Policy Template: Security Gates from Design to Release
- Secure Web Gateway and Web Filtering Guide
- Securing Agent Frameworks Guide: LangChain, LangGraph, CrewAI and AutoGen
- Securing AI Infrastructure: Workload Identity for AI Pipelines, Models and GPUs
- Securing Enterprise AI Copilots and Assistants
- Securing Microsoft Copilot Studio Agents Guide: Connectors, Authentication and DLP
- Securing Multi-Agent Systems and Agent-to-Agent (A2A) Trust
- Securing OpenAI Agents SDK and Responses API Guide: Tools, Guardrails and Keys
- Securing Salesforce Agentforce Guide: Permissions, Data Access and Trust Layer
- Securing ServiceNow AI Agents Guide: Roles, Workflows and Governance
- Security Architect Career Guide: Skills, Paths and Certifications
- Security Architecture Review Guide: Assessing Designs Before They Ship
- Security Awareness and Human Risk Management Guide
- Security Awareness Maturity Model: From Compliance Training to Measured Behaviour Change
- Security Awareness Plan Template: Audiences, Topics, Phishing Simulation and Metrics
- Security Awareness Training Buyer’s Guide
- Security Budget Planning Guide: Allocation and Return on Investment
- Security Champions Programme Guide: Building Security into Every Team
- Security Data Lake Guide: Architecture, OCSF Mapping and Log Analytics
- Security Data Pipeline Buyer’s Guide
- Security Data Pipeline Guide
- Security Engineer Career Guide: Skills, Roles and Progression
- Security Exceptions and Risk Acceptance Guide: Waivers
- Security Governance Committee Charter Template: Mandate, Membership and Reporting
- Security Headers Guide: CSP, HSTS and Cookies
- Security Operations Metrics Guide: MTTD, MTTR and SOC KPIs
- Security Policy Framework Guide
- Security Questionnaires Guide: SIG, CAIQ and HECVAT
- Security Requirements and Abuse Cases Guide: Building Security into Design
- Security Tool Consolidation Guide: Reducing Sprawl Without Losing Coverage
- Security Vendor Evaluation and RFP Guide: Running a Fair, Evidence-Based Selection
- Segregation of Duties (SoD) Guide
- Self-Hosted LLM Security Guide: Ollama, vLLM and LM Studio
- Server-Side Template Injection (SSTI) Guide: Detection and Prevention
- Serverless Security Guide
- Service Account Inventory Template: Recording Owners and Privileges
- Service Account Security Guide: Finding, Reducing and Governing Service Accounts
- Service Mesh Security Guide: Istio, Linkerd and mTLS
- ServiceNow Security Guide: ACLs and Instance Hardening
- Session Hijacking and Cookie Theft Guide: Defending Authenticated Sessions
- Shadow AI and AI Agent Discovery Guide: Finding the AI You Don’t Know About
- Shadow AI Policy Template: Discovering, Approving and Managing Unsanctioned AI
- Shared Signals Framework Guide: CAEP and RISC
- SharePoint and OneDrive Security Guide: Sharing, Permissions and Oversharing Controls
- ShinyHunters Threat Actor Profile: SaaS Data Theft, Vishing and Extortion
- SIEM Buyer’s Guide
- SIEM Guide: Use Cases, Tuning and Migration
- SIM Swap Fraud Guide: Port-Out Fraud, Detection and Recovery
- Singapore Cybersecurity Act Guide: CII Owner Duties and Incident Reporting
- Singapore PDPA Guide: Obligations, Breach Notification and PDPC Enforcement
- Slopsquatting and Package Hallucination Guide: Defending Against AI-Invented Dependencies
- SLSA and Build Provenance Guide
- Small Business Identity and Access Security Guide: Essentials on a Budget
- Smart Card and PIV/CAC Authentication Guide
- Smart Contract Security Guide
- Smart Grid Security Guide: Distributed Energy, Substations and Grid Edge
- Smart Meter Security Guide: Metering Infrastructure, Keys and Firmware
- Snowflake Security Guide: Service Users and Key Pair Auth
- SOAR and Security Automation Guide
- SOAR Buyer’s Guide
- SOC 1 Guide: Reports on Controls Relevant to Financial Reporting
- SOC 2 Guide: Type I, Type II and the Trust Services Criteria
- SOC 2 Readiness Checklist: Preparing for a SOC 2 Type I or Type II Audit
- SOC Analyst Career Guide
- SOC Guide: Building and Running a Security Operations Centre
- SOC Maturity Model
- SOC Runbook Template: Repeatable Procedures for Common Alerts
- SOC Staffing and Shift Models Guide: Coverage, Rotas and Analyst Retention
- Social Engineering and Physical Penetration Testing Guide: Scoping, Safety and Reporting
- Software Supply Chain Maturity Model: From Ad Hoc Dependencies to Verified Provenance
- Software Supply Chain Security Buyer’s Guide
- Software Supply Chain Security Guide
- South Korea AI Basic Act Guide: Obligations and Timelines
- SOX ITGC Guide: Access, Change and Operations Controls
- Space and Satellite Cybersecurity Guide
- Spain ENS Guide: Esquema Nacional de Seguridad Categories and Certification
- SPIFFE and SPIRE Guide: Workload Identity Without Static Secrets
- Splunk Enterprise Security Guide: Risk-Based Alerting, Correlation and Content
- SQL Injection Prevention Guide: Parameterised Queries and Blind SQLi
- SSCP Certification Guide: Domains, Requirements and Preparation
- SSH Key and SSH Certificate Management Guide
- SSRF Prevention Guide: Cloud Metadata Services and URL Validation
- Startup Identity and Secrets Security Guide: The First Controls to Get Right
- StateRAMP / GovRAMP Guide: Authorisation for State and Local Cloud Services
- Storm-0558 and Cloud Key Theft Profile: Forged Tokens and Signing Key Protection
- Supply Chain Compromise Response Playbook: Responding to a Compromised Supplier or Component
- SWIFT Customer Security Programme (CSP) Guide: CSCF Controls and Attestation
- Synthetic Data Risk Guide: Privacy, Quality and Model Collapse
- Synthetic Identity Fraud Guide: Detection at Onboarding and Beyond
- Sysmon Guide: Configuration and Detection Use Cases
- Tabletop Exercise Guide
- Tabletop Exercise Scenario Pack
- Telecom Network Security Guide: Signalling, Core Networks and Operator Credentials
- Telecoms Identity Security Guide: Privileged Network Access, SIM Swap and Lawful Intercept
- Terraform Cloud and HCP Security Guide: Workspaces, Tokens and Dynamic Credentials
- Texas Responsible AI Governance Act (TRAIGA) Guide: Duties, Enforcement and the Sandbox
- Third-Party Access Policy Template: Onboarding, Least Privilege and Revocation
- Third-Party AI Risk Guide: Assessing AI Vendors
- Third-Party Concentration Risk Guide: Lessons from the July 2024 CrowdStrike Outage
- Third-Party Risk Management (TPRM) Guide
- Third-Party Risk Management Maturity Model: Five Levels from Ad Hoc to Optimised
- Third-Party, B2B and Contractor Access Guide
- Threat Actor Groups Guide: APTs, Ransomware Gangs and Naming
- Threat Hunting Guide
- Threat Intelligence Analyst Career Guide: Skills, Roles and Progression
- Threat Intelligence Guide: CTI Lifecycle, Feeds and Sharing
- Threat Intelligence Maturity Model
- Threat Intelligence Platform Buyer’s Guide
- Threat Modelling AI Agents: A Practical Workshop Guide
- Threat Modelling Guide: STRIDE and PASTA
- Threat-Informed Defence Guide: Prioritising Controls by Real Adversary Behaviour
- Threat-Led Penetration Testing Guide: TIBER-EU, CBEST and DORA TLPT
- Three Lines Model for Cyber Risk Guide: Roles, Independence and Assurance
- Tiered Administration Guide: Tier 0, PAWs and Clean Source
- TISAX Guide: VDA ISA, Assessment Levels and Labels
- TLS Inspection Guide
- Token and Session Security Guide
- Token Lifetime Policy Design Guide: Balancing Security and Reliability
- Tokenisation and Data Masking Guide: Vaulted and Vaultless
- Top 10 Active Directory Security Risks and How to Fix Them
- Top 10 Agentic AI Identity Issues
- Top 10 AI Agent Security Risks for CISOs
- Top 10 API Security Risks: The OWASP API Security Top 10 Explained
- Top 10 AWS IAM Mistakes
- Top 10 CI/CD Security Risks
- Top 10 Cloud Security Risks
- Top 10 Container Security Risks
- Top 10 Data Security Risks
- Top 10 EDR Evasion Techniques
- Top 10 Email Security Threats
- Top 10 Endpoint Security Risks
- Top 10 GRC Mistakes
- Top 10 Identity Attacks
- Top 10 Incident Response Mistakes
- Top 10 Kubernetes Security Risks
- Top 10 LLM Deployment Mistakes
- Top 10 MFA Mistakes
- Top 10 Network Security Misconfigurations
- Top 10 NHI Risks
- Top 10 Online Fraud Attacks
- Top 10 OT Security Risks
- Top 10 Phishing Techniques
- Top 10 Privacy Compliance Mistakes
- Top 10 Ransomware Initial Access Vectors
- Top 10 SaaS Security Risks
- Top 10 Secrets Management Mistakes
- Top 10 Shadow AI Risks
- Top 10 SOC Challenges
- Top 10 Supply Chain Attacks: Techniques and Defences
- Top 10 Third-Party Risk Mistakes
- Top 10 Vibe Coding Security Risks
- Top 10 Vulnerability Management Mistakes
- Top 10 Zero Trust Mistakes
- TPRM and Security Ratings Buyer’s Guide
- Transportation Identity and OT Access Guide: Rail, Aviation, Maritime and Road
- Typosquatting and Lookalike Domains Guide: Detection, Takedown and Defensive Registration
- UAE Information Assurance Standards Guide: Controls, Scope and Compliance
- UEBA Guide: Behaviour Baselines for Users and Service Accounts
- UK AI Regulation Guide: The Principles-Based Approach
- UK Cyber Governance Code of Practice Guide: Board Responsibilities and Actions
- UK Cyber Security and Resilience Bill Guide
- UK GDPR and Data Protection Act 2018 Guide: Obligations, Breach Reporting and Recent Reforms
- UK PSTI Act Guide: Security Requirements for Connectable Products
- UK Telecommunications Security Act Guide: Duties, Code of Practice and Ofcom Oversight
- Unified Endpoint Management (UEM) Buyer’s Guide
- Unsanctioned AI Agents and MCP Servers Guide: Finding and Governing Rogue Agents
- US Cyber Trust Mark Guide: The Labelling Programme for Smart Devices
- US Federal AI Policy Guide: Executive Orders, OMB Memos and Agency Rules
- US State Privacy Laws Guide: CCPA, CPRA and the State Patchwork
- Utah AI Policy Act Guide: Generative AI Disclosure Duties
- vCISO Guide: When and How to Use a Virtual CISO
- Vendor SaaS Breach Response Playbook: What to Do When a Supplier Is Breached
- Vendor Security Assessment Template
- Verifiable Credentials Guide: VCs, DIDs and SD-JWT
- Vibe Coding Policy Template: Rules for AI-Generated Code
- Vibe Coding Security Guide: Risks and Guardrails for AI-Built Software
- Virtual Desktop (VDI) and DaaS Security Guide: Citrix and AVD
- Vishing and Smishing Guide
- VMware ESXi Hardening Guide: Securing Hosts and vCenter
- Voice AI Agent Security and Fraud Guide: Deepfakes, Vishing and Controls
- Volt Typhoon Threat Actor Profile: Living off the Land in Critical Infrastructure
- VPN Appliance Security Guide: Vulnerabilities, Hardening and Replacement
- Vulnerability Disclosure Maturity Model: From No Contact Point to a Managed Programme
- Vulnerability Management Buyer’s Guide
- Vulnerability Management Guide: CVSS, EPSS and KEV
- Vulnerability Management Maturity Model
- Vulnerability Management Policy Template: Scope, Timelines and Roles
- Vulnerability Prioritisation Guide: CVSS, EPSS, KEV and Risk-Based Patching
- Vulnerability Scanning Guide: Coverage, Credentialed Scans and Tuning
- WAF and WAAP Buyer’s Guide: Evaluating Web Application and API Protection
- Water and Wastewater Cybersecurity Guide: SCADA and PLC Exposure
- Watering Hole Attacks Guide: Compromised Websites and Strategic Web Compromise
- Web Application Attacks Guide: Injection, XSS, SSRF and Deserialisation
- Web Application Firewall Guide
- Web Application Security Testing Guide: WSTG, DAST and Manual Testing
- Web Cache Poisoning and Cache Deception Guide: Cache Keys and Safe Caching Rules
- Web3 and Crypto Security Guide
- WebSocket Security Guide: Authentication, Origin Checks and Message Validation
- What Is IVIP? Identity Visibility and Intelligence Platforms Explained
- Wi-Fi Security Guide: WPA3, 802.1X and Rogue APs
- Windows Endpoint Hardening Guide: ASR Rules, Credential Guard, LAPS and Tamper Protection
- Windows Event Log Guide for Security Teams: Key Event IDs Explained
- Windows Forensic Artefacts Guide: Prefetch, Amcache and Shimcache
- Windows Hello for Business Guide
- Wiper Malware Guide: Destructive Attacks, Resilience and Recovery
- Wireless Penetration Testing Guide: Scoping and Testing Wi-Fi and Radio Networks
- Workday Security Guide: Security Groups, Integrations and Tenant Hardening
- Workforce Identity Security Guide
- Workload Identity Federation Guide: OIDC Trust and Token Exchange
- XDR Guide: Extended Detection and Response Explained
- XSS Prevention Guide: Stored, Reflected and DOM-Based XSS
- XXE Guide: Preventing XML External Entity Vulnerabilities
- YARA Rules Guide: Writing, Testing and Managing Detection Rules
- Zero Trust for AI Agents: Applying NIST SP 800-207 to Autonomous Actors
- Zero Trust Identity Guide: Identity as the Control Plane
- Zero Trust Maturity Model Guide: Assessing Pillars and Planning the Next Stage
- Zero Trust Network Access (ZTNA) Guide
- Zero-Click Exploits Guide: Exposure, Patching and Protecting High-Risk Devices
- Zero-Day and Exploited Vulnerabilities Guide
- Zscaler Security Configuration Guide: ZIA, ZPA, Admin Access and API Keys
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.