Cybersecurity toolkit
Every studio tool and figure in the course, organised the way the course thinks: by the NIST CSF 2.0 function it serves, and the stage it belongs to. Pick a function to see what builds, defends, finds, answers or restores.
Studio tools
10 shownRisk register board
Plot risks on a likelihood-against-impact quadrant and record the treatment decision and owner for each one.
Open toolThreat model canvas
Lay out a data-flow of processes, stores and external entities across trust zones, and tag each element with its STRIDE threats.
Open toolVulnerability triage queue
Order a patch queue by the KEV-first, EPSS-weighted rule instead of CVSS alone, and see why each item sits where it does.
Open toolZero trust rollout planner
Set current and target maturity for each of the five CISA ZTMM pillars and name the next step that moves each one.
Open toolPurdue zoning designer
Place OT assets on Purdue levels, group them into zones with a 62443 target security level, and declare the conduits that may cross.
Open toolIncident runbook builder
Fill a swimlane of roles against the SP 800-61r3 phases, capturing the action and the evidence to keep at each step.
Open toolBackup and recovery designer
Rank backup copies by how well they survive an attacker, flag any that share production credentials, and set RTO and RPO per service.
Open toolPost-quantum migration inventory
Position each system against the 2028, 2031 and 2035 milestones, flagging harvest-now-decrypt-later risk where data outlives the deadline.
Open toolRegulation applicability mapper
Describe the organisation, then mark each UK and EU regime as applies, watch or out of scope with its first deadline.
Open toolDetection coverage board
Score detection coverage across the ATT&CK tactics and your own data sources, and read the per-tactic coverage back as a heat row.
Open toolFigure library
74 shownThe NCSC working definition of cyber security and its three components
The NCSC definition fixes scope, subject and threat as three separate components, then places supply chain software, offsite backup tapes and smart-building controls inside the attack surface, so a reading limited to desktop computers misses most of what has to be defended.
Security as a system, not a product
The product chain ends in an arrow marked no loop back, while the six NIST CSF 2.0 functions run as a cycle, so a purchase that stops at step three leaves nothing that would ever ask whether the tool is still doing its job.
Four risk-treatment options compared
Only the financial impact moves when a risk is transferred, which is why the four options carry a use-when condition rather than a rank and a risk covered by insurance stays on the register with its operational and recovery exposure untouched.
Threat, vulnerability, exploit, incident
Threat, vulnerability and exploit are separate links, each carrying its own Target 2013 anchor, and the incident needs all three, so removing any one of them prevents the harm and the useful question is which link is cheapest to break.
Three data states, three risks, three controls
Data is only protected in the state you named it in: each of the three carries its own dominant risk and its own control, so an organisation that encrypts at rest and in transit has left data in use unprotected, the state where it must be decrypted to be processed.
Hash against HMAC: where a shared key adds authenticity to integrity
The lanes run the same four steps and diverge at the key: an attacker replaces message and digest together under a plain hash but cannot forge a keyed one, so a hash sent over a channel the attacker controls proves nothing about who wrote it.
Defence in depth, layers and dimensions
Every layer needs a people, a process and a technology control, so a stack that is strong only in the technology column can still be crossed end to end by one forgotten account, which is what the Colonial Pipeline callout records.
Stateless against stateful firewall
One packet enters both lanes and only the connection-table lookup differs, so the static rule that lets a legitimate reply through on port 443 lets an unsolicited packet through on the same port as well.
Six common attacks against the CIA properties
Cells are marked primary or secondary rather than simply ticked, so an attack such as ransomware, which takes availability first and integrity after, cannot be answered by a control that defends only one of the two.
STRIDE, six threats and the property each violates
A threat list is only checkable if something bounds it. Microsoft's STRIDE ties each of the six letters to the one CIA-style property it violates, so applying all six at a data-flow boundary yields a list you can check; asking whether a design is secure yields nothing.
How a proxy phishing kit steals the session and where a passkey refuses
The one-time code passes because the proxy relays the real login, so the factor never fails and the stolen item is the session cookie issued afterwards, which is why only the domain-bound passkey branch stops the chain.
Second factor options compared
SMS, TOTP and the FIDO2 hardware key are scored on channel, phishing, SIM-swap and cost, so a second factor can close one risk and leave the other open, and only the hardware key column resists both, which is what its recommendation rests on.
The three authentication factor categories
Knowledge, possession and inherence each carry a weakness the other two do not share, so MFA only removes a weakness when its two factors are drawn from different categories, which is why two passwords are not two factors however long they are.
Cialdini's six principles weaponised
Every weaponised tactic is a legitimate principle turned around, so the message does not have to look wrong to work, and the defence is refusing to act on the feeling it produces rather than trying to spot a forgery.
Six social-engineering techniques broken down
The six techniques are separated by their channel but each paired with a trigger, giving a reader who learns the six triggers a way to name an approach that arrives by a channel none of the cards lists.
The verification gates that stop a deepfake payment request
None of the three gates asks anyone to judge whether the caller is real, so a payment change is stopped by the callback, the second approver and the delay even when the impersonation is good enough to be believed.
The eight data-subject rights under UK GDPR Articles 13 to 22
A subject request can only be answered against the specific right exercised, because each of the eight is keyed to its own article across UK GDPR Articles 13 to 22, and none of them is a generic request for a copy of the data.
Seven lawful bases for UK personal data processing
A lawful basis follows from the purpose of the processing, not from convenience: the ICO's UK GDPR guidance sets the seven at the same level, each with its own example, which leaves consent as one option among seven rather than the default anyone starts from.
What each NIST CSF 2.0 function would have done
All six NIST CSF 2.0 functions resolve to one named action against the same incident, from Govern setting supply-chain risk appetite to Recover rotating exposed credentials. Six named actions can be audited one by one; a general instruction to be more secure cannot.
Eight foundation concepts, eight incident questions
Each of the eight foundation concepts is restated as a question that can be put to a real incident, turning the modules into a set of questions to work through against what happened rather than eight definitions to be recalled.
Four threat-actor classes compared
Persistence and target choice track motivation rather than attribution, so the four classes give a defender something to plan against before anyone has worked out which group is responsible.
The ransomware-as-a-service value chain
Developer, broker, affiliate and launderer are each paid for one specialism, so an intrusion needs no single group that can do all of it, and a defender should expect commodity tooling used at volume rather than a rare adversary.
Worked data-flow diagram crossing two trust boundaries where threats live
A review is only as bounded as the diagram makes it: the two dashed boundaries are what pick out where to look, and an open question about whether the whole system is secure becomes a finite list of crossings to work through with STRIDE.
Shostack's four-question threat-modelling loop
Every step leaves a named artefact rather than a conversation, so the fourth question has something to review against, and the ribbon makes the run repeat after each design change instead of ending at launch.
JWT structure and the five validation checks
A token can only be trusted once all five checks have run, since each catches a different forgery, and a server that verifies the signature but skips the audience check will accept a perfectly valid token that was issued for another service.
OAuth 2.0 authorisation-code flow with PKCE
The code and the verifier travel on separate steps, so an attacker who captures the redirect at step two still cannot complete the exchange at step three, which is the property PKCE adds to the flow.
Three XSS variants and the primary fix for each
The primary fix differs by XSS variant, so a team that standardises on output encoding has covered the stored and reflected cases and left the DOM-based one, where the payload never reaches the server at all.
OWASP Top 10:2025 with the change from 2021
The change column records what moved between the 2021 and 2025 editions, showing a ranking that follows evidence rather than opinion, so a programme still built around the 2021 order spends on injection while supply chain has moved above it.
BOLA: three checks on every endpoint
Authenticating the caller and authorising them against the object are two separate checks, so an endpoint that only validates the token returns another tenant's rows to a caller who is genuinely signed in.
Three-layer rate-limit stack: edge, gateway, and service
Each layer counts a different unit, per source IP, then per API key, then per business action, leaving a limit set only at the edge with no way to express abuse that arrives from one valid key at an entirely normal rate.
Six CI/CD security gates from commit to runtime
Each gate resolves to pass or block on one named condition, so an exception cannot be settled by discussion at the gate and has to be written into the risk register as a waiver instead.
SAST, DAST, and SCA compared on when they run and what each sees
The misses rows do not overlap, so any pairing leaves a gap: drop SCA and known dependency CVEs go unseen, drop DAST and live runtime behaviour goes unchecked, drop SAST and the source is never read.
SIEM pipeline from collect to alert
Each stage carries the failure that breaks every stage after it, so a source gap at collection cannot be recovered by better correlation later, and tuning alerts does nothing about data never gathered.
Six categories of security events to log
Detection reaches only as far as the log does: each of the six categories is tied to the behaviour it exposes, a category nobody logs is a behaviour nobody can detect, and the investigator reconstructing the event later has no record to work from.
Applied-stage assessment board
Every panel on the board resolves to one check question, and an assessment is judged on how many of those questions it can answer. A panel left blank is itself the finding, not a section still to be written.
Risk-register row format with seven worked fields
Four worked rows from the FinPay capstone fill all seven columns, owner and review date included. Record a finding without those two and nobody is committed to it, and no date exists on which anyone will notice the entry has gone stale.
OWASP SAMM v2.0 maturity matrix
Maturity can only be read per function rather than as one score, which is how a team sits at level three in verification and level one in governance at the same time, and why the honest answer is a position on each of the five rows.
Microsoft SDL seven phases with an exit gate
Each SDL phase carries an exit gate rather than a milestone, so design cannot be called finished until the threat list is signed off, and the defects that gate would have caught are otherwise found later, where they cost most.
The four outcome objectives of the NCSC Cyber Assessment Framework v4.0
The four objectives of the NCSC Cyber Assessment Framework version 4.0 are written as outcomes rather than controls, asking for evidence that risk was managed, attack resisted, events detected and impact limited, so no product bought for each one answers them.
UK and EU cyber regulation mapped
The UK and EU lanes carry their own dates from 2018 to 2028, so an obligation is fixed by jurisdiction and application date rather than by which regime is best known, and a UK operator reading across may be reading law that does not bind it.
The five stages of ransomware extortion, from encryption to exposure
The answer column moves as the pressure does, so tested offline backups that answered stage one answer nothing at stage four, where nothing is encrypted and the threat is publication of what was already taken.
The ransom payment decision, gate by gate
The five gates are conjunctive and each names who has to be told, so any one of them can end the question on its own and no part of the organisation can settle it by arguing the other four.
The backup immutability ladder
What each copy survives is decided by who can delete it, so a replica reachable with production credentials is a convenience rather than a recovery position, and only the locked and offline rungs remain against backup-admin rights.
The first 72 hours of recovery
Across the first 72 hours the four lanes run at once rather than in sequence, so the regulatory clock in the bottom lane is already running while the technical lane is still isolating, and rehearsing them separately never meets that overlap.
The key-management lifecycle loop
Each transition around the NIST SP 800-57 loop carries a custody question rather than a cryptographic one, putting the risk at who held the key and over what channel, which is where the hub says failure arrives before the mathematics does.
The post-quantum migration timeline
The NIST standards track and the NCSC migration track share one time spine from 2024 to 2035, so the two can be read against each other, and the completion dates at the foot are what discovery and priority work must be planned backwards from.
How OT inverts the IT priority order
The priority order inverts because an OT failure can mean physical harm rather than data loss, so an IT patching policy applied to a plant optimises confidentiality on assets that will still be running in twenty years.
Purdue levels, zones, and conduits
Only two conduits cross the industrial DMZ, and the traced maintenance session uses them to reach a Level 1 controller, so the air gap is opened by ordinary operational need rather than by an attacker defeating it.
Four AI security problems, kept apart
Each of the four carries its own named failure, so a control that answers one lens can be seen not to answer another: output filtering does not fix prompt injection, and AI risk bolted on at the end is not governance.
The LLM application attack surface
Retrieved content, user prompts and tool metadata all arrive at the LLM on the same channel as instructions, so no filter can separate the two, and the approval card is the last place a proposed action can be stopped before it runs.
Three segmentation levels with the blast each contains
The blast radius is set by the segment unit, so an estate divided by subnet contains an intrusion to a subnet, and only workload identity as the unit contains it to the single compromised pod.
Zero trust: PEP intercepts, PDP decides
The enforcement point intercepts every request and the decision point weighs subject, device, resource and telemetry each time, as NIST SP 800-207 requires, so being already inside the network supplies none of the four inputs and grants nothing.
Container security in five layers
The five controls sit on top of one another, so a scanned image running as root under no runtime policy has spent its effort on the layers below and left the two that decide what a compromise can do.
Cloud shared-responsibility matrix
Data and identity read customer in the IaaS, PaaS and SaaS columns alike; the operating system and runtime pass to the provider from PaaS onward, and the one further layer SaaS hands over is the application, so the model never moves who owns access.
SLSA build track from L0 to L3
Provenance is only as good as who can sign it: the levels below L3 leave the attestation within reach of the build script itself, and a tampered build can still produce a document that verifies exactly as it should.
The four supply-chain attack surfaces
Of the four surfaces it is build that SolarWinds SUNBURST compromised: the artefact was signed with the legitimate vendor certificate and shipped by the normal update route, which leaves every downstream signature check passing while the binary no longer matches the source.
Prioritising CVEs with CVSS, EPSS, and KEV
Severity and likelihood are drawn as independent axes and a CISA KEV listing overrides both, promoting any listed CVE to emergency, so a queue sorted by base score alone can place a critical nobody is exploiting ahead of a medium being scanned today.
Vulnerability lifecycle as a closed loop
Closure feeds back into discovery rather than ending the run, so an SBOM left un-updated after remediation quietly degrades the next scan, and the tiered patch SLAs give the loop a clock to be measured against.
Detection engineering as a closed version-controlled loop
Every edge of the ring carries a question the next stage has to answer, and the closing edge returns tuning to the threat that started it, so a rule that never comes back round is unreviewed rather than finished.
IR lifecycle: NIST and SANS PICERL aligned
The top lane is marked legacy because current NIST guidance aligns incident response to CSF 2.0, so the older four phases and the six SANS PICERL steps stay useful as operating vocabulary only while the label says which is in use.
MITRE ATT&CK chain with NotPetya techniques
Only three of the 14 Enterprise tactics are annotated, and each carries a control that catches the behaviour rather than the binary, so a detection built around the tool NotPetya used stops working the moment the tool is swapped.
UK GDPR Article 5 under accountability
Accountability sits above the six rather than beside them, so meeting a principle is not the same as being able to show it was met, and the records named in the umbrella are what turns practice into compliance.
Privacy Enhancing Technologies compared
The legal-status column under UK GDPR, not the technical strength, decides whether the output is still personal data, so a team that pseudonymises to escape its obligations has kept every one of them and gained a mapping table to protect.
ISO 25010:2023 with Security expanded
Security can only be tested the way reliability or performance are once it is written as a requirement, which is what the five sub-characteristics allow, and it sits as one of eight peers rather than a compliance question asked to one side.
NIST CSF 2.0 Govern hub and five operational functions
Govern, new in CSF 2.0 in 2024, sits at the centre with arrows running outwards to the five operational functions, so strategy, roles and risk appetite set their direction, and a control added without that hub has nothing deciding whether it is the right one.
Practice-strategy synthesis matrix
Each of the three MedCore parts draws a cell from all eight practice-strategy modules at once. Practice-strategy therefore cannot be delivered as eight separate domains, and a control chosen inside one module has to hold in the part where it actually lands.
MedCore target architecture with trust zones
STRIDE changes zone by zone in the MedCore Azure architecture: the clinical edge draws Spoofing and Tampering, where the consequence is patient safety, while regulated data draws Repudiation and Information Disclosure. One standard across the three zones misprices one.
The cybersecurity course: four stages around one governing habit
Each stage hands the next one thing: a shared vocabulary, then design judgement, then an operating capability, with the Govern hub tied to all four, making governance something exercised at every stage rather than added once the technical work is done.
Cybersecurity course spine: 41 modules across four stages
The four columns are not equal, and practice and strategy holds 17 of the 41 modules, more than any other stage, so the largest block of the course sits after the engineering technique is learned, in operations, regulation and governance.
Risk-to-action loop in five phases with feedback to identification
The dashed arc returns review to identification, which makes the asset inventory and the threat model outputs of each pass rather than fixed inputs. A review that retires nothing has not closed the loop.
Detection coverage across ATT&CK tactics and data sources
The live figure behind the detection-coverage-board studio tool: coverage is scored per tactic rather than rolled up into one number, so a tactic no data source can see stays visible as a thin row even when the overall picture looks healthy.
An incident runbook as roles against phases
The live figure behind the ir-runbook-builder studio tool: each cell names who acts in that SP 800-61r3 phase and what evidence they keep, so an empty cell is a gap a rehearsal can surface rather than one the incident finds on your behalf.
A risk register drawn as likelihood against impact
The live figure behind the risk-register-board studio tool: position on the quadrant is the argument and the treatment recorded beside it is the decision that follows, so a risk in the severe band carrying an accept decision is a claim someone must defend.
Zero trust maturity by pillar, from traditional to optimal
The live figure behind the zero-trust-rollout-planner studio tool: the distance between the filled marker and the target ring is the work, read pillar by pillar across the CISA ZTMM, so a roadmap becomes five next steps, not one decision to adopt zero trust.