Resources

The security library.

Threat intelligence, security reports and templates, each with a short synopsis. Plus the policy templates and workbooks from across the network.

Browse the library Talk to a practitioner

Threat intel · Threat Reports
Verizon 2026 Data Breach Investigations Report (DBIR)
Vulnerability exploitation became the top initial-access vector at ~31% of breaches (surpassing stolen credentials); AI compresses defenders' patch window from months to hours, and ~48% of breaches now involve a third party.
Open ↗
Threat intel · Threat Reports
CrowdStrike 2026 Global Threat Report
Adversaries integrated AI across intrusion tradecraft, social engineering, and influence operations in 2025; ~42% of vulnerabilities were exploited before public disclosure.
Open ↗
Threat intel · Vulnerability Management
CISA Known Exploited Vulnerabilities (KEV) Catalog
CISA's authoritative catalog of CVEs confirmed exploited in the wild — grew ~20% to ~1,484 entries (245 added in 2025). Remediate these first.
Open ↗
Threat intel · Vulnerability Management
NIST NVD Triage Transition (2026)
NIST moved the National Vulnerability Database to a triage model (Apr 2026), enriching only an estimated 15-20% of incoming CVEs — supplement NVD with CISA KEV and commercial intel.
Open ↗
Report · Identity
NIST SP 800-63-4 Digital Identity Guidelines
Updated risk-based digital-identity framework (IAL/AAL/FAL) aligned to continuous authentication, adaptive risk, and zero-trust principles.
Open ↗
Report · AI Security
NIST AI Agent Standards Initiative
NIST research into agent authentication and identity infrastructure for secure human-agent and multi-agent interactions in the agentic-AI era.
Open ↗
Report · NHI / Machine Identity
CSA Non-Human Identity & Agentic AI Governance
Cloud Security Alliance guidance on the non-human-identity governance vacuum and agentic-AI risks: autonomous credential acquisition, multi-agent orchestration, runtime permission escalation.
Open ↗
Report · NHI / Zero Trust
NSA Zero Trust — Machine & System Identity
NSA's updated zero-trust implementation guidance focused on securing machine and system (non-human) identities.
Open ↗
Template · AI Governance
NIST AI Risk Management Framework (AI RMF 1.0)
Voluntary, sector-agnostic AI risk framework structured around four functions — Govern, Map, Measure, Manage — to operationalize trustworthy AI.
Open ↗
Template · AI Governance
ISO/IEC 42001 — AI Management System (AIMS)
The first certifiable international standard for an AI Management System — establishes the structures and processes to govern AI responsibly and earn external validation.
Open ↗
Template · AI Governance / Compliance
EU AI Act
Risk-based EU AI regulation; general-purpose-AI obligations effective Aug 2, 2025, with European Commission enforcement beginning Aug 2, 2026. ISO 42001 / NIST AI RMF cover ~60-70% of its management-system requirements.
Open ↗
Template · AI Security
OWASP Top 10 for LLM Applications (2025)
OWASP's ranked list of the most critical security risks for LLM/GenAI applications (prompt injection, sensitive data disclosure, supply chain, excessive agency, etc.).
Open ↗
Template · AI Security
MITRE ATLAS
MITRE's knowledge base of adversary tactics and techniques against AI/ML systems — the ATT&CK analogue for AI threats.
Open ↗
Template · Secure Development
CISA Secure by Design
CISA's secure-by-design and secure-by-default principles and pledge for building security into products from the start.
Open ↗
Report · AI Analysis
AI Security Reference Architectures
Processing with AI...
Report · AI Analysis
EUSolidarityact
Processing with AI...
Threat intel
aiactionplans
The document highlights critical cybersecurity threats related to the extensive use of PDF linearization and streams. Vulnerabilities in software handling these files could enable malicious code execution through crafted documents, potentially leading to unauthorized system access, data breaches, and compromised system integrity. To mitigate these risks, it is crucial to ensure regular updates and patches of PDF-handling software, employ robust intrusion detection systems, and conduct frequent security audits. However, several sections of the document are unreadable due to corruption or encoding issues, impeding the ability to identify specific threats, implications, and recommendations accurately. It is recommended to verify the document's integrity, re-obtain a clear version, or utilize error-recovery tools for proper analysis. General advice includes enhancing data integrity checks, maintaining strict access controls, ensuring reliable backup and recovery systems, and monitoring access patterns to detect anomalies.
Threat intel
wefsecurity2025
The document thoroughly addresses current cybersecurity threats, emphasizing the severity of data breaches and ransomware attacks due to their increasing sophistication and targeting of critical infrastructure. Key threats include ransomware, phishing, zero-day exploits, and insider threats, all posing significant risks of data loss, financial damage, and service disruption. To combat these, recommendations include enhancing security protocols, conducting thorough employee training, and regular system audits to identify vulnerabilities. Investing in robust backup solutions and developing incident response plans are also crucial to mitigating impacts. Despite some sections of the document being corrupted or unreadable, it's clear that proactive measures and preparedness in cybersecurity operations are essential to counter these high-impact threats.
Template · Privacy
Meta Privacy and Data Protection Standards
Detailed standards for social media data handling, privacy protection, and algorithmic transparency.
Template · AI Governance
AWS AI Service Guidelines
Framework for implementing AI services with built-in compliance and security controls.
Template · Security
IBM Quantum Computing Security Framework
Security framework for quantum computing implementations, including risk assessment and mitigation strategies.
Template · Privacy
Google Cloud Data Privacy Toolkit 2024
Complete guide to implementing privacy-first data practices in cloud environments, aligned with global regulations.
Template · AI Governance
Salesforce AI Ethics Playbook
Comprehensive guide to ethical AI implementation in customer relationship management systems.
Template · AI Governance
Microsoft AI Policy Framework 2024
Comprehensive framework for responsible AI development and deployment, including governance structures and ethical guidelines.

Build it yourself

Policies and workbooks.

When a template is enough, buy it from the store that makes it. When it isn't, scope it with us.

Ready-made

CyberPolicy.shop ↗

Professionally written policy templates, playbooks and compliance packs (SOC 2, ISO 27001, HIPAA), editable Word and PDF.

AI-generated

GeneratePolicy.com ↗

A full policy suite written for your industry, size and frameworks, from a short questionnaire.

CISO workbooks and bundles from ciso.diy · 12

Across the network

Tools and references.

MicroSec Tools ↗: Micro-tools: risk calculators and compliance checkers
ComplianceHub ↗: Framework mappings and control libraries
Global Compliance Map ↗: Regulations by jurisdiction
PolicyQuest.diy ↗: Policies turned into quizzes for your team
Cybersecurity Glossary ↗: Terms, acronyms and concepts
Security Tool Ecosystem ↗: Every property across the network

Four ways in. One practitioner-led team on the other side.

Not sureNot sure what you need?Six plain-language questions, about ninety seconds. A person tells you what it actually is, including when you need less than you feared.ScopeScope it yourselfAnswer structured questions about what to cover and how big it is, and see an indicative range as soon as you send it.TalkBook a scoping callA conversation with a practitioner to shape the engagement before you commit to anything.RFPSend us your RFPAlready have an RFP, RFQ or statement of work? Share it and we'll respond to your format.