401 Access Denied (opens in a new tab)
Why: Delinea bi-weekly podcast with Joseph Carson on identity security and InfoSec practice — official hub remapped from dead Libsyn path.
Last verified 6 September 2026
Open
Library
254 current resources. Refine by category, type, starting-point strength and last verified.
Showing 254 current resources
Abuse.ch (opens in a new tab)
Why: Abuse.ch operates free community threat-intelligence projects (malware, botnets, URLhaus and related feeds) widely used for blocking and hunting.
Last verified 6 September 2026
Open
Atomic Red Team (opens in a new tab)
Why: Open library of portable, ATT&CK-mapped tests that security teams can run to check whether their detections actually catch real attacker behaviours.
Last verified 6 September 2026
Open
Awesome Threat Hunting (opens in a new tab)
Why: Curated collection of hunting tools, methods and references — a practical starting point when building or refreshing a threat-hunting programme.
Last verified 6 September 2026
Open
Black Lotus Labs (Lumen) (opens in a new tab)
Why: Lumen threat research arm; China-nexus IoT/proxy quartermaster enablement model — high value for edge/IoT defenders.
Last verified 6 September 2026
Open
CERT Société Générale IRM Playbooks (opens in a new tab)
Why: Ready-to-use English incident response methodology playbooks covering common attack scenarios, so teams can rehearse and respond with shared steps rather than inventing process under pressure.
Last verified 6 September 2026
Open
CERT/CC Vulnerability Notes (opens in a new tab)
Why: Authoritative Carnegie Mellon CERT Coordination Centre vulnerability notes and advisories.
Last verified 6 September 2026
Open
CIS Benchmarks (opens in a new tab)
Why: Widely used secure-configuration baselines for operating systems, cloud and applications, helping teams harden systems to an agreed, repeatable standard.
Last verified 6 September 2026
Open
CIS Controls (opens in a new tab)
Why: Prioritised, actionable safeguards that help teams sequence hardening work by impact.
Last verified 6 September 2026
Open
CISA Cross-Sector Cybersecurity Performance Goals (CPGs) (opens in a new tab)
Why: Voluntary CISA baseline protections for critical infrastructure (CPGs 2.0, aligned to NIST CSF 2.0) that help organisations prioritise practical safeguards when starting a maturity journey.
Last verified 6 September 2026
Open
CISA Cybersecurity Advisories (US-CERT) (opens in a new tab)
Why: Official US CISA cybersecurity advisory feed covering urgent vulnerabilities and threats, so organisations can act on authoritative government guidance quickly.
Last verified 6 September 2026
Open
CISA ICS Advisories (US-ICS-CERT) (opens in a new tab)
Why: CISA advisories focused on industrial control systems, helping OT teams track product risks and patch priorities that affect plant and field environments.
Last verified 6 September 2026
Open
CISA Industrial Control Systems (OT/ICS) (opens in a new tab)
Why: CISA evergreen OT/ICS hub linking role-specific guidance, recommended practices, training and alerts for critical infrastructure defenders.
Last verified 6 September 2026
Open
CISA Internet Exposure Reduction (opens in a new tab)
Why: Practical attack-surface guidance for getting unnecessary IT/OT exposure off the internet.
Last verified 6 September 2026
Open
CISA Known Exploited Vulnerabilities (KEV) Catalog (opens in a new tab)
Why: CISA's catalogue of vulnerabilities known to be exploited in the wild — the practical must-patch list for teams prioritising fixes that attackers are already using.
Last verified 6 September 2026
Open
CISA Secure by Demand Guide (opens in a new tab)
Why: CISA buyer guidance that helps organisations demand secure products in procurement — a practical lever for reducing digital risk when acquiring software during change programmes.
Last verified 6 September 2026
Open
CISA Secure by Design (opens in a new tab)
Why: US CISA programme pushing software makers to ship products with security built in by default, reducing burden on defenders and buyers.
Last verified 6 September 2026
Open
CISA Shields Up (opens in a new tab)
Why: CISA heightened-threat readiness hub with practical actions for organisations to harden, detect and respond when cyber risk is elevated.
Last verified 6 September 2026
Open
CISA StopRansomware (opens in a new tab)
Why: US whole-of-government ransomware hub consolidating prevention, response and recovery guidance plus #StopRansomware advisories.
Last verified 6 September 2026
Open
CISA Tabletop Exercise Packages (CTEPs) (opens in a new tab)
Why: Ready-made CISA tabletop packages spanning cyber and physical scenarios, so teams can practise response without designing every exercise from scratch.
Last verified 6 September 2026
Open
Cisco Talos blog (opens in a new tab)
Why: High-yield detection engineering research including agentic post-compromise tradecraft.
Last verified 6 September 2026
Open
Cloudflare Radar (opens in a new tab)
Why: High-signal DDoS and internet-health view grounded in large-scale edge telemetry.
Last verified 6 September 2026
Open
Counteractive Incident Response Plan Template (opens in a new tab)
Why: Practical open-source incident response plan template that teams can adapt for policy, roles, escalation paths and documentation when building or refreshing their IR capability.
Last verified 6 September 2026
Open
CrowdStrike Global Threat Report 2026 (opens in a new tab)
Why: Annual CrowdStrike threat landscape report — adversary trends, malware families, and industry risk themes for planners and responders.
Last verified 6 September 2026
Open
CTO at NCSC Substack (opens in a new tab)
Why: Olly Whitehouse (NCSC CTO) Substack — senior UK cyber perspective and pointers to useful practitioner resources.
Last verified 6 September 2026
Open
CVE Program (cve.org) (opens in a new tab)
Why: Home of the CVE programme that assigns the standard identifiers used worldwide for software flaws — the naming backbone behind most vulnerability tracking and advisories.
Last verified 6 September 2026
Open
Cyber Work (opens in a new tab)
Why: Infotec Institute careers podcast with hiring managers and practitioners on skills, roles and how to progress in cyber security.
Last verified 6 September 2026
Open
CyberChef (opens in a new tab)
Why: The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis.
Last verified 6 September 2026
Open
Darknet Diaries (opens in a new tab)
Why: Story-driven true-crime podcast about hacking incidents and underground culture — strong for awareness and lessons learned.
Last verified 6 September 2026
Open
Defrag This (opens in a new tab)
Why: Ipswitch/Progress technical podcast on file transfer, network and security operations — useful for IT and security teams sharing infrastructure concerns.
Last verified 6 September 2026
Open
Dragos OT/ICS resource hub (opens in a new tab)
Why: Specialist OT and ICS threat research and practitioner resources for defenders protecting industrial and critical infrastructure environments.
Last verified 6 September 2026
Open
ENISA — Threats and risks hub (opens in a new tab)
Why: Standing EU ENISA hub for threat landscape and risk publications, helping teams track European threat trends and risk analysis without hunting across scattered releases.
Last verified 6 September 2026
Open
ENISA publications hub (opens in a new tab)
Why: EU Agency for Cybersecurity catalogue of reports, guidance and sector studies — a primary source for EU policy context and practitioner research across member states.
Last verified 6 September 2026
Open
FIRST Traffic Light Protocol (TLP) (opens in a new tab)
Why: Industry-standard Traffic Light Protocol for marking how far threat information may be shared, so responders and partners can exchange intelligence without accidental oversharing.
Last verified 6 September 2026
Open
Google Project Zero (opens in a new tab)
Why: Google Project Zero researches and discloses high-impact zero-day vulnerabilities with detailed technical write-ups that inform defence and vulnerability management.
Last verified 6 September 2026
Open
GTFOBins (opens in a new tab)
Why: Unix living-off-the-land binaries companion to LOLBAS; essential for detection engineering and abuse-path review.
Last verified 6 September 2026
Open
ISO/IEC 27001 and 27002 (opens in a new tab)
Why: Global ISMS requirements and control guidance underpinning certification and supplier assurance.
Last verified 6 September 2026
Open
Mandiant M-Trends (opens in a new tab)
Why: Mandiant’s annual M-Trends report — real-world breach findings and frontline response lessons.
Last verified 6 September 2026
Open
Microsoft Threat Actor Naming (opens in a new tab)
Why: Microsoft's weather-themed naming system for threat actors, essential for decoding Defender alerts and Microsoft threat reports into clear, consistent actor labels.
Last verified 6 September 2026
Open
Microsoft Threat Intelligence (opens in a new tab)
Why: Standing hub for identity/edge tradecraft (device-code phishing, TerminalFix, Unicode phishing).
Last verified 6 September 2026
Open
MITRE ATT&CK (opens in a new tab)
Why: Living knowledge base of adversary tactics and techniques for threat-informed detection and defence.
Last verified 6 September 2026
Open
MITRE ATT&CK Groups (opens in a new tab)
Why: MITRE's catalogue of known adversary groups mapped to ATT&CK techniques, helping teams compare aliases, understand shared tactics and brief others with a common naming baseline.
Last verified 6 September 2026
Open
MITRE ATT&CK Navigator (opens in a new tab)
Why: Interactive ATT&CK layer viewer for mapping techniques to detections and coverage, helping teams visualise gaps and brief stakeholders on adversary behaviour.
Last verified 6 September 2026
Open
MITRE Caldera (opens in a new tab)
Why: Open-source automated adversary-emulation platform for running ATT&CK-mapped red-team and purple-team exercises safely in your own lab.
Last verified 6 September 2026
Open
NCSC advice & guidance (opens in a new tab)
Why: UK National Cyber Security Centre hub of practical advice and guidance for organisations, covering everyday defence through to emerging topics such as AI and operational technology.
Last verified 6 September 2026
Open
NCSC Assess Supply Chain Cyber Security (opens in a new tab)
Why: Practical NCSC method for assessing supplier cyber assurance across procurement, legal and security — built for the organisational change needed to manage third-party digital risk.
Last verified 6 September 2026
Open
NCSC Cyber Assessment Framework (CAF) (opens in a new tab)
Why: UK NCSC Cyber Assessment Framework for critical national infrastructure and essential services — a structured way to judge cyber resilience outcomes and where to improve.
Last verified 6 September 2026
Open
NCSC Cyber Aware — Top tips for staying secure online (opens in a new tab)
Why: NCSC Cyber Aware public guidance: six practical actions (passwords, updates, 2SV, backups) for individuals and micro-businesses.
Last verified 6 September 2026
Open
NCSC Cyber Essentials (opens in a new tab)
Why: UK government baseline certification scheme that sets practical controls for organisations of all sizes to guard against common internet threats.
Last verified 6 September 2026
Open
NCSC Cyber Security Toolkit for Boards (opens in a new tab)
Why: UK NCSC guidance that helps boards oversee cyber risk, culture and investment with clear questions and expectations for organisational leadership.
Last verified 6 September 2026
Open
NCSC Developing a Positive Cyber Security Culture (opens in a new tab)
Why: NCSC board-toolkit guidance on building awareness programmes that shape organisational cyber culture.
Last verified 6 September 2026
Open
NCSC Device Security Guidance (Windows) (opens in a new tab)
Why: UK NCSC guidance on hardening Windows devices for enterprise use, giving clear platform settings that reduce everyday attack surface on endpoints.
Last verified 6 September 2026
Open
NCSC Exercise in a Box (opens in a new tab)
Why: Free UK NCSC scenarios and facilitation packs for running cyber tabletop exercises, so organisations can practise decision-making without designing every drill from scratch.
Last verified 6 September 2026
Open
NCSC Exercise in a Box — Tabletop exercises (opens in a new tab)
Why: NCSC index of free 60–90 minute cyber tabletop discussion exercises. Facilitators pick a scenario (ransomware, supply chain, insider threat, BYOD, etc.), download the pack, and run structured injects with senior leaders, cyber engineers and communications.
Last verified 6 September 2026
Open
NCSC Phishing scams — spot and report (opens in a new tab)
Why: NCSC user-education hub on spotting phishing and reporting scam emails/websites (report@phishing.gov.uk) to take down abuse.
Last verified 6 September 2026
Open
NCSC Risk Management (opens in a new tab)
Why: NCSC guidance for embedding cyber risk into organisational decision-making — essential when programmes, technology choices and risk appetite shift during business change.
Last verified 6 September 2026
Open
NCSC Secure Design Principles (opens in a new tab)
Why: NCSC principles for designing secure systems and services from the start, helping transformation teams reduce risk when building or changing digital capability.
Last verified 6 September 2026
Open
NIST Cybersecurity Framework (CSF) (opens in a new tab)
Why: Widely adopted risk-based framework for organising cyber capability across Identify–Protect–Detect–Respond–Recover.
Last verified 6 September 2026
Open
NIST National Vulnerability Database (NVD) (opens in a new tab)
Why: The US National Vulnerability Database — the main public hub for searching CVEs with severity scores and references, essential for understanding and prioritising software flaws.
Last verified 6 September 2026
Open
NIST SP 800-53 Security and Privacy Controls (opens in a new tab)
Why: Authoritative catalogue of security and privacy controls used to design and assess system safeguards.
Last verified 6 September 2026
Open
OWASP Application Security Verification Standard (ASVS) (opens in a new tab)
Why: Practical application security verification standard that turns secure-design expectations into testable requirements for builders, reviewers and assurance teams.
Last verified 6 September 2026
Open
OWASP Cheat Sheet Series (opens in a new tab)
Why: Concise, maintained secure-coding and configuration cheat sheets covering common risks, giving developers and defenders quick, trusted implementation guidance.
Last verified 6 September 2026
Open
OWASP Top Ten (opens in a new tab)
Why: Canonical web application risk ranking — the shared language practitioners and boards use for the biggest app risks.
Last verified 6 September 2026
Open
PortSwigger Research (opens in a new tab)
Why: PortSwigger Research publishes practical web-security research papers, tools and techniques used by penetration testers and application defenders.
Last verified 6 September 2026
Open
Red Canary Threat Detection Report (opens in a new tab)
Why: Red Canary Threat Detection Report — annual study of detections, ATT&CK techniques, and SOC lessons.
Last verified 6 September 2026
Open
Red Canary threat intelligence resources (opens in a new tab)
Why: Red Canary threat intelligence resources — detection guidance, reports, and practitioner write-ups.
Last verified 6 September 2026
Open
Risky Business (opens in a new tab)
Why: Long-running news podcast covering cyber risk, breaches and industry developments for practitioners who need a weekly brief.
Last verified 6 September 2026
Open
SANS Internet Storm Center (opens in a new tab)
Why: Practitioner diary of active internet threats, scanning activity and opportunistic attacks.
Last verified 6 September 2026
Open
SigmaHQ detection rules (opens in a new tab)
Why: Open library of Sigma detection rules that translate to many SIEM and EDR backends, accelerating consistent hunting and detection engineering across tools.
Last verified 6 September 2026
Open
SOC-CMM — Security Operations Centre Capability Maturity Model (opens in a new tab)
Why: Industry-standard maturity model for Security Operations Centres, helping teams assess current SOC capability and plan clear improvements over time.
Last verified 6 September 2026
Open
Sygnia threat research (opens in a new tab)
Why: Trusted-infrastructure and evidence-layer tradecraft (e.g. Fire Ant / TACACS).
Last verified 6 September 2026
Open
The Purple Book Community (opens in a new tab)
Why: Community podcast interviewing cyber and software security leaders about real programme challenges, decisions and lessons from the field.
Last verified 6 September 2026
Open
The Virtual CISO Moment (opens in a new tab)
Why: Greg Schaffer Virtual CISO Moment on SMB security leadership — Apple hub remapped from dead CSO Online article URL.
Last verified 6 September 2026
Open
Unsupervised Learning (opens in a new tab)
Why: Daniel Miessler’s podcast on cyber security, AI and technology strategy — high-signal listening for thoughtful practitioners and leaders.
Last verified 6 September 2026
Open
Verizon Data Breach Investigations Report (DBIR) (opens in a new tab)
Why: Verizon DBIR — the industry-standard annual data-breach study used for risk conversations and planning.
Last verified 6 September 2026
Open
2 Cyber Chicks (opens in a new tab)
Why: Interview-led podcast from two practitioners covering careers, community and day-to-day cyber practice for women and allies in the field.
Last verified 6 September 2026
Open
7 Minute Security (opens in a new tab)
Why: Short, practical episodes aimed at busy defenders — quick tips on Windows, Active Directory and hands-on security hygiene.
Last verified 6 September 2026
Open
8th Layer Insights (opens in a new tab)
Why: Perry Carpenter podcast on the human (8th) layer of security — canonical hub remapped from dead Fortinet path.
Last verified 6 September 2026
Open
abuseipdb (opens in a new tab)
Why: Community IP reputation database for checking whether an address has been reported for abuse before you block or investigate it.
Last verified 6 September 2026
Open
Adventures of Alice and Bob (opens in a new tab)
Why: Light-touch storytelling podcast that makes cryptography and security concepts accessible for learners and non-specialist colleagues.
Last verified 6 September 2026
Open
Any Run Malware Trends Tracker (opens in a new tab)
Why: ANY.RUN dashboard of malware trends from live sandboxes, showing which families and behaviours are circulating so teams can prioritise detection and awareness work.
Last verified 6 September 2026
Open
Arbor Digital Attack Map (opens in a new tab)
Why: Classic DDoS visualisation still used for briefings on volumetric attack geography.
Last verified 6 September 2026
Open
Awesome Annual Security Reports (opens in a new tab)
Why: Curated GitHub index of annual security and threat reports — a fast way to find this year’s major publications.
Last verified 6 September 2026
Open
Awesome Threat Intelligence (opens in a new tab)
Why: Curated open list of threat-intelligence feeds, frameworks and research sources — a practical starting index for building a TI stack.
Last verified 6 September 2026
Open
BarCode Cybersecurity Podcast (opens in a new tab)
Why: Chris Glanden BarCode cybersecurity podcast — Apple hub remapped from dead barcode.com path.
Last verified 6 September 2026
Open
Bayse Intelligence (opens in a new tab)
Why: Scans websites and maps related attack infrastructure, helping analysts pivot from a single site to the wider hosting and threat landscape behind it.
Last verified 6 September 2026
Open
BeVigil (opens in a new tab)
Why: Mobile-app security search — find exposed endpoints, secrets and risky configurations across Android and iOS applications.
Last verified 6 September 2026
Open
Bitdefender Threat Map (opens in a new tab)
Why: Live Bitdefender map of malware and attack activity by region, giving practitioners a clear visual snapshot of where campaigns appear to be concentrating right now.
Last verified 6 September 2026
Open
Censys (opens in a new tab)
Why: Internet-wide asset search that helps teams discover exposed hosts, certificates and services on their attack surface.
Last verified 6 September 2026
Open
CERT-EU Security Advisories (opens in a new tab)
Why: Security advisories from CERT-EU for EU institutions and public-sector defenders, helping European teams track urgent flaws and recommended mitigations.
Last verified 6 September 2026
Open
CERT-EU Threat Intelligence publications (opens in a new tab)
Why: CERT-EU threat intelligence publications — EU institutional threat reporting and situational awareness.
Last verified 6 September 2026
Open
Check Point Research (opens in a new tab)
Why: Standing CPR hub for nation-state and crimeware research (e.g. Lazarus / 0-day campaigns).
Last verified 6 September 2026
Open
Check Point ThreatCloud Map (opens in a new tab)
Why: Real-time ThreatCloud map of attack volume and destinations, helpful when you need a fast visual brief on where activity is concentrating.
Last verified 6 September 2026
Open
CISA / G7 Post-Quantum call to action (opens in a new tab)
Why: Joint CISA and G7 call for organisations to inventory cryptography and plan a phased move to post-quantum algorithms before quantum computers break today's encryption.
Last verified 6 September 2026
Open
CISA CTEP — Package Documents (facilitator templates) (opens in a new tab)
Why: Reusable CTEP planner/facilitator handbooks, invitation letter, slide deck, participant feedback and AAR-IP templates. Use alongside any situation manual so exercise teams can run and document a full HSEEP-style tabletop without building paperwork from scratch.
Last verified 6 September 2026
Open
CISA CTEP — Ransomware Situation Manual (opens in a new tab)
Why: Downloadable ransomware CTEP situation manual (DOCX, Sept 2023). Customisable objectives, injects and discussion questions for IR, leadership and communications to rehearse encryption/extortion response and recovery; pair with CTEP package documents.
Last verified 6 September 2026
Open
Cisco Talos Intelligence (opens in a new tab)
Why: Cisco Talos podcasts and briefings on threats, malware and defensive research, giving practitioners timely context from one of the industry's major commercial threat teams.
Last verified 6 September 2026
Open
Cisco Talos Spam and Malware Map (opens in a new tab)
Why: Cisco Talos live map linking spam and malware activity to geographic hotspots, helping teams connect email and malware pressure to places seeing the most traffic.
Last verified 6 September 2026
Open
Click Here (opens in a new tab)
Why: Recorded Future’s geopolitics and threat-intel podcast — one place defenders can hear how nation-state and cybercrime context lands in practical intelligence work.
Last verified 6 September 2026
Open
CrowdStrike Adversaries (opens in a new tab)
Why: Catalogue of named adversaries with aliases and campaign context, supporting research, briefings and consistent attribution language across teams.
Last verified 6 September 2026
Open
CRT sh (opens in a new tab)
Why: Certificate Transparency log search — enumerate domains and subdomains that have obtained TLS certificates.
Last verified 6 September 2026
Open
Crypto-Gram Security Podcast (opens in a new tab)
Why: Bruce Schneier’s companion to the Crypto-Gram newsletter — clear takes on crypto, privacy and security policy for practitioners.
Last verified 6 September 2026
Open
Cyber Security Headlines by the CISO Series (opens in a new tab)
Why: Short daily headlines from the CISO Series that summarise the day's cyber news for leaders and practitioners who need a quick, reliable brief.
Last verified 6 September 2026
Open
Cyber Security Sauna (opens in a new tab)
Why: WithSecure Cyber Security Sauna catalog hub (production ended 2024; F-Secure/WithSecure site paths 404) — still useful archive listening.
Last verified 6 September 2026
Open
Cybersecurity Today by ITWC (opens in a new tab)
Why: Canadian ITWC daily brief covering major cyber news for practitioners who want a concise North American-oriented round-up.
Last verified 6 September 2026
Open
Cyberside Chats (opens in a new tab)
Why: LMG Security Cyberside Chats with Sherri Davidoff and Matt Durrin — official hub remapped from dead CSO Online article URL.
Last verified 6 September 2026
Open
CyberWire Daily (opens in a new tab)
Why: Concise daily briefing from The CyberWire covering major cyber news, so busy practitioners can keep pace without reading every headline themselves.
Last verified 6 September 2026
Open
CyBOK Knowledge Base (opens in a new tab)
Why: The Cyber Security Body of Knowledge — structured academic and practitioner reference covering the core knowledge areas of the discipline.
Last verified 6 September 2026
Open
DeHashed (opens in a new tab)
Why: Search leaked credentials and related identity artefacts from known breaches — useful when checking exposure after phishing or account takeover.
Last verified 6 September 2026
Open
DFIR Report Year in Review (opens in a new tab)
Why: Annual DFIR year-in-review — practical incident response lessons and case themes from the DFIR Report team.
Last verified 6 September 2026
Open
DNSDumpster (opens in a new tab)
Why: Fast DNS reconnaissance that maps hosts, records and related infrastructure for a domain during investigations and attack-surface reviews.
Last verified 6 September 2026
Open
DNSTwist.it (opens in a new tab)
Why: Generates lookalike domain variants so you can spot typosquatting and phishing infrastructure before attackers use it against your brand.
Last verified 6 September 2026
Open
Dont Panic - Unit42 by Palo Alto (opens in a new tab)
Why: Unit 42 podcast covering adversary behaviour, incident lessons and threat research for practitioners.
Last verified 6 September 2026
Open
Dr Dark Web Podcast (opens in a new tab)
Why: Practitioner-facing discussions on dark-web tradecraft, OSINT and threat awareness for defenders tracking underground activity.
Last verified 6 September 2026
Open
ENISA Foresight Cybersecurity Threats for 2030 (opens in a new tab)
Why: ENISA foresight on cybersecurity threats out to 2030 — useful for long-range risk and strategy conversations.
Last verified 6 September 2026
Open
ExploitDB (opens in a new tab)
Why: Curated archive of public exploits and proof-of-concept code for vulnerability research, detection writing and controlled testing.
Last verified 6 September 2026
Open
FIRST (Forum of Incident Response and Security Teams) (opens in a new tab)
Why: Global forum for incident response teams, sharing standards, community practice and CVSS context that underpins how responders collaborate worldwide.
Last verified 6 September 2026
Open
Fofa (opens in a new tab)
Why: Cyberspace search engine (FOFA) for finding exposed assets and fingerprinting services on the public internet during OSINT and attack-surface reviews.
Last verified 6 September 2026
Open
Fortiguard Threat Encyclopedia (opens in a new tab)
Why: Fortinet encyclopaedia of malware, vulnerabilities and threat intelligence for rapid lookup during research and response.
Last verified 6 September 2026
Open
FortiGuard Threat Map (opens in a new tab)
Why: Live Fortinet sensor feed useful for spotting surge patterns and regional pressure.
Last verified 6 September 2026
Open
Fortiguard Threat Signal Report (opens in a new tab)
Why: FortiGuard Threat Signal Report — weekly Fortinet roundup of notable threats and exploit activity.
Last verified 6 September 2026
Open
Fortinet FortiGuard Outbreak Threat Map (opens in a new tab)
Why: Outbreak-oriented FortiGuard map for tracking active malware campaigns geographically.
Last verified 6 September 2026
Open
FSB Cyber Resilience workstream (opens in a new tab)
Why: Standing hub behind G20 systemic cyber/AI-patch risk messaging.
Last verified 6 September 2026
Open
FullHunt (opens in a new tab)
Why: Attack-surface search that helps organisations discover internet-facing assets tied to their domains, supporting continuous external exposure monitoring and review.
Last verified 6 September 2026
Open
Ghidra (opens in a new tab)
Why: Open-source reverse-engineering suite (NSA-origin) for analysing binaries when dissecting malware or unknown software.
Last verified 6 September 2026
Open
GrayHatWarfare (opens in a new tab)
Why: Indexes publicly exposed cloud storage buckets so analysts can find accidental data spills and misconfigured object stores.
Last verified 6 September 2026
Open
Grep App (opens in a new tab)
Why: Code search across hundreds of thousands of public git repositories — useful for finding secrets, vulnerable patterns and reuse of known code.
Last verified 6 September 2026
Open
GreyNoise (opens in a new tab)
Why: Internet noise intelligence — tell scanner/benign mass probing apart from targeted attacks on your IPs.
Last verified 6 September 2026
Open
H4unt3d Hacker (opens in a new tab)
Why: Independent podcast mixing news, interviews and community chat aimed at newcomers and hands-on hobbyist defenders.
Last verified 6 September 2026
Open
Hacker Valley Studio Podcast (opens in a new tab)
Why: Career and culture interviews from Hacker Valley Studio — practical listening for people building cyber skills and professional networks.
Last verified 6 September 2026
Open
Hacking Humans (opens in a new tab)
Why: CyberWire series on social engineering and phishing case studies — concrete lessons for awareness programmes and human-risk teams.
Last verified 6 September 2026
Open
haveibeenpwned (opens in a new tab)
Why: Free breach-notification service to check whether an email address or password has appeared in known data breaches.
Last verified 6 September 2026
Open
Hunter (opens in a new tab)
Why: Finds publicly listed email addresses tied to a domain — useful for OSINT checks and phishing-defence awareness work.
Last verified 6 September 2026
Open
IBM Security X-Force Threat Intelligence Index (opens in a new tab)
Why: IBM X-Force Threat Intelligence Index — annual view of attack trends, industries hit, and attacker techniques.
Last verified 6 September 2026
Open
Imperva Cyber Threat Attack Map (opens in a new tab)
Why: Real-time Imperva view of cyber attacks useful for application-threat briefings.
Last verified 6 September 2026
Open
InfoSec Live (opens in a new tab)
Why: Infotec Institute live-style podcast covering current InfoSec topics and guest perspectives for working security professionals.
Last verified 6 September 2026
Open
Inquest Labs (opens in a new tab)
Why: Deep file-inspection laboratory for analysing suspicious samples and extracting indicators — useful when you need richer context than a quick multi-engine scan.
Last verified 6 September 2026
Open
IntelligenceX (opens in a new tab)
Why: Search engine for leaked data, dark-web content and historical internet records when investigating compromised accounts and domains.
Last verified 6 September 2026
Open
Kaspersky Cyberthreat Map (opens in a new tab)
Why: Global attack-distribution view with common vectors for quick situational awareness.
Last verified 6 September 2026
Open
LeakIX (opens in a new tab)
Why: Search engine for publicly indexed services and leak indicators — helps find exposed databases, panels and misconfigurations on the open internet.
Last verified 6 September 2026
Open
Life of a CISO (opens in a new tab)
Why: Dr Eric Cole Life of a CISO podcast on CISO practice and board communication — Libsyn hub remapped from dead Buzzsprout path.
Last verified 6 September 2026
Open
LOLBAS Project (opens in a new tab)
Why: Living Off the Land Binaries and Scripts for Windows — essential reference for detection engineering and abuse-path reviews alongside GTFOBins.
Last verified 6 September 2026
Open
Malicious Life (opens in a new tab)
Why: Story-driven history of hacking, malware and cyber conflict — strong background listening that puts today's threats in a longer historical context.
Last verified 6 September 2026
Open
MITRE D3FEND (opens in a new tab)
Why: Countermeasure knowledge graph that maps defensive techniques against attacker behaviours.
Last verified 6 September 2026
Open
MITRE Engage (opens in a new tab)
Why: MITRE active-defence framework for denial, deception and adversary engagement, mapped to ATT&CK for defender planning.
Last verified 6 September 2026
Open
Naked Security Podcast (opens in a new tab)
Why: Sophos Naked Security team podcast unpacking recent threats and research in plain language for IT and security staff.
Last verified 6 September 2026
Open
NCSC Actions to take when the cyber threat is heightened (opens in a new tab)
Why: UK NCSC checklist of concrete steps organisations should take when the national cyber threat level rises — from hardening and monitoring to communications and recovery readiness.
Last verified 6 September 2026
Open
NCSC Cyber Security Culture Principles (opens in a new tab)
Why: NCSC principles for building a security-supporting culture — useful when leading behaviour, leadership and process change alongside technical transformation.
Last verified 6 September 2026
Open
NCSC EiB — Ransomware attack delivered by phishing email (opens in a new tab)
Why: 60–90 minute NCSC tabletop for senior leaders, cyber engineers and communications. Walks phishing-delivered ransomware from detection through containment, recovery and external messaging; ZIP pack includes facilitator and participant PDFs.
Last verified 6 September 2026
Open
Netlas (opens in a new tab)
Why: Internet-wide asset search and monitoring for hosts, services and related observables during OSINT and attack-surface work.
Last verified 6 September 2026
Open
NETSCOUT Cyber Threat Horizon (opens in a new tab)
Why: NETSCOUT horizon view of DDoS and infrastructure threats at internet scale — strong for understanding volumetric attack patterns that hit networks and service providers.
Last verified 6 September 2026
Open
NHS Data Security and Protection Toolkit (DSPT) (opens in a new tab)
Why: Mandatory UK health and care self-assessment of data security and information governance practice.
Last verified 6 September 2026
Open
NHS Keep I.T. Confidential (opens in a new tab)
Why: NHS campaign materials that help staff handle information confidentially and build everyday data-security habits across clinical and administrative teams.
Last verified 6 September 2026
Open
NIST SP 800-171 Rev. 2 (opens in a new tab)
Why: US federal security baseline for protecting Controlled Unclassified Information on non-federal systems — a practical checklist for suppliers and partners handling sensitive US government data.
Last verified 6 September 2026
Open
ONYPHE (opens in a new tab)
Why: Cyber threat intelligence search across IPs, domains and related observables — a practical OSINT and enrichment source when investigating hosts and infrastructure.
Last verified 6 September 2026
Open
Open Source Security Podcast (opens in a new tab)
Why: Conversations on securing open-source software and supply chains — useful for teams that depend on OSS and need clearer risk thinking and community practice.
Last verified 6 September 2026
Open
Packet Storm Security (opens in a new tab)
Why: Long-running feed of advisories, exploits and tools for staying current on disclosed vulnerabilities and attack techniques.
Last verified 6 September 2026
Open
Palo Alto Unit 42 resources (opens in a new tab)
Why: Unit 42 research hub — threat reports, actor profiles, and vulnerability write-ups from Palo Alto Networks.
Last verified 6 September 2026
Open
PimEyes (opens in a new tab)
Why: Facial recognition search — find where a face appears online (use carefully; privacy-sensitive).
Last verified 6 September 2026
Open
PolySwarm (opens in a new tab)
Why: Crowdsourced malware scanning for files and URLs, giving multi-engine verdicts useful in triage and indicator validation.
Last verified 6 September 2026
Open
PublicWWW (opens in a new tab)
Why: Source-code search across public websites to find scripts, trackers and technology fingerprints at scale — useful for OSINT, brand protection and supply-chain checks.
Last verified 6 September 2026
Open
Pulsedive (opens in a new tab)
Why: Threat intelligence search with community-scored risk context on indicators, helping analysts decide which IPs, domains and hashes deserve closer attention.
Last verified 6 September 2026
Open
Radware Live Threat Map (opens in a new tab)
Why: Live application and network attack map for application-layer threat awareness.
Last verified 6 September 2026
Open
Rapid7 Labs (opens in a new tab)
Why: Edge persistence research plus Global Threat Landscape series.
Last verified 6 September 2026
Open
Recorded Future Insikt Group research (opens in a new tab)
Why: Standing Insikt research hub (Russia initial access, DPRK IT-worker pipelines, etc.).
Last verified 6 September 2026
Open
SANS Internet Stormcenter Daily Cyber Podcast (Stormcast) (opens in a new tab)
Why: Short daily SANS Internet Storm Center briefing on active threats and defensive tips — a practical morning listen for hands-on defenders and analysts.
Last verified 6 September 2026
Open
SCF Security & Privacy Capability Maturity Model (SP-CMM) (opens in a new tab)
Why: Pairs Secure Controls Framework controls with a capability maturity model, so programmes can score security and privacy practice maturity against a common control set.
Last verified 6 September 2026
Open
SearchCode (opens in a new tab)
Why: Source-code search across millions of public projects — useful for finding leaked secrets, vulnerable patterns and library usage.
Last verified 6 September 2026
Open
Secure Controls Framework (SCF) (opens in a new tab)
Why: Cross-maps many regulatory and security frameworks into one controls set for multi-obligation programmes.
Last verified 6 September 2026
Open
Securelist (Kaspersky) (opens in a new tab)
Why: Kaspersky’s long-running research hub for malware analysis, APT reporting and threat insights used by defenders worldwide.
Last verified 6 September 2026
Open
Secureworks Threat Profiles (opens in a new tab)
Why: Consistent vendor threat profiles that summarise actor behaviour and naming, useful when preparing briefings or aligning research across sources.
Last verified 6 September 2026
Open
Security Now (opens in a new tab)
Why: Long-form weekly show explaining security news, crypto and privacy topics in depth for technically curious listeners.
Last verified 6 September 2026
Open
Security Weekly (opens in a new tab)
Why: Long-running family of shows covering security news, research and interviews — a reliable weekly listen for staying current across the industry.
Last verified 6 September 2026
Open
SecurityTrails (opens in a new tab)
Why: Historical DNS, WHOIS and domain intelligence that helps investigators reconstruct past infrastructure and related assets during domain and host research.
Last verified 6 September 2026
Open
Shadowserver — Subscribe to Reports (opens in a new tab)
Why: Free Shadowserver network-reporting subscriptions that notify organisations about exposed services, malware and other risks on their address space.
Last verified 6 September 2026
Open
Shodan (opens in a new tab)
Why: Search engine for internet-connected devices and services — classic attack-surface reconnaissance.
Last verified 6 September 2026
Open
Simply Cyber (opens in a new tab)
Why: Gerald Auger’s community-focused show on cyber careers, certifications and practical skill-building for early and mid-career practitioners.
Last verified 6 September 2026
Open
Smashing Security (opens in a new tab)
Why: Graham Cluley and friends weekly news show — irreverent but informative briefings on breaches and industry stories.
Last verified 6 September 2026
Open
SOC Compass (opens in a new tab)
Why: Keeps current and target SOC operating models aligned to SOC-CMM, MITRE Inform and SIM3 with living evidence — product hub remapped from retired GitHub path (soft wall).
Last verified 6 September 2026
Open
Sophos Threat Report (opens in a new tab)
Why: Sophos annual threat report — ransomware, malware, and attacker behaviour trends for defenders.
Last verified 6 September 2026
Open
Spamhaus Threat Map (opens in a new tab)
Why: Spamhaus map of botnet and spam-source concentrations, useful when you need a reputation-led view of where abusive infrastructure is clustering worldwide.
Last verified 6 September 2026
Open
TaHiTi Threat Hunting Methodology (opens in a new tab)
Why: Structured threat-hunting methodology that folds threat intelligence into hunt cycles, giving analysts a repeatable way to pursue targeted leads.
Last verified 6 September 2026
Open
Task Force 7 Cyber Security Radio (opens in a new tab)
Why: Interview-led cyber security radio for broad situational awareness — official hub remapped from dead VoiceAmerica path (soft wall).
Last verified 6 September 2026
Open
The 443 Security Simplified (opens in a new tab)
Why: WatchGuard 443 Security Simplified weekly threat and research podcast — Podbean hub remapped from dead Fortinet path.
Last verified 6 September 2026
Open
The Cyber Queens (opens in a new tab)
Why: Women-led cyber podcast highlighting careers, leadership and community — useful listening for practitioners seeking diverse voices in the field.
Last verified 6 September 2026
Open
The Cyber Tap (cyberTAP) (opens in a new tab)
Why: Purdue cyberTAP centre hub for cyber awareness and education content — remapped from invalid Podbean site (podcast path retired).
Last verified 6 September 2026
Open
The Cyberlaw Podcast (opens in a new tab)
Why: Stewart Baker Cyberlaw Podcast on cyber law, regulation and policy — Libsyn hub remapped from dead Steptoe path.
Last verified 6 September 2026
Open
The DFIR Report (opens in a new tab)
Why: Detailed real-world intrusion case write-ups with timelines, tooling and lessons that help responders and hunters improve practice.
Last verified 6 September 2026
Open
The Hacker Mind (opens in a new tab)
Why: Robert Vamosi interviews hackers and researchers about mindset and method — background listening that sharpens threat understanding.
Last verified 6 September 2026
Open
The Shared Security Show (opens in a new tab)
Why: Privacy and security interviews focused on practical controls and policy for teams balancing usability with protection.
Last verified 6 September 2026
Open
The Social-Engineer Podcast (opens in a new tab)
Why: Chris Hadnagy’s long-running show on social-engineering research and defence — essential for awareness and red-team human-risk work.
Last verified 6 September 2026
Open
Trellix Advanced Research Center Threat Reports (opens in a new tab)
Why: Trellix Advanced Research Center threat reports — regular analysis of malware, campaigns, and emerging threats.
Last verified 6 September 2026
Open
Trellix Tools and Techniques Library (opens in a new tab)
Why: Trellix Advanced Threat Research white-paper library covering laboratory techniques (function hooking, patch diffing, ICS simulation, Android SSL pinning, and related methods) for practitioners reducing attack surfaces.
Last verified 6 September 2026
Open
Uncoder.io (opens in a new tab)
Why: Converts Sigma detection rules into formats used by common SIEM and EDR platforms, speeding up detection engineering when the same logic must run across tools.
Last verified 6 September 2026
Open
URL Haus (opens in a new tab)
Why: abuse.ch malware URL blocklist publishing known-bad links for blocking, hunting and research — a trusted free feed for defenders tracking malicious URLs.
Last verified 6 September 2026
Open
URL Scan (opens in a new tab)
Why: Sandbox a suspicious URL — see page behaviour, redirects, and related indicators without opening it yourself.
Last verified 6 September 2026
Open
virustotal (opens in a new tab)
Why: Multi-engine file and URL scanner that helps analysts quickly see whether a sample or link is widely flagged as malicious.
Last verified 6 September 2026
Open
Vulners (opens in a new tab)
Why: Large vulnerability knowledge base spanning CVEs, advisories and related artefacts for prioritisation and research.
Last verified 6 September 2026
Open
WayBackMachine (opens in a new tab)
Why: Internet Archive web history — recover deleted or changed pages and track how sites evolved during investigations.
Last verified 6 September 2026
Open
We Talk Cyber (opens in a new tab)
Why: News and interview podcast covering cyber threats and industry developments for a broad practitioner audience.
Last verified 6 September 2026
Open
Wigle (opens in a new tab)
Why: Community wireless-network map and database for locating Wi-Fi and cellular observations during physical and RF investigations.
Last verified 6 September 2026
Open
ZoomEye (opens in a new tab)
Why: Cyberspace search for hosts, services and exposures across the public internet — useful for OSINT, red-team reconnaissance and attack-surface checks. Canonical hub remapped from zoomeye.org (HTTP 521) to zoomeye.ai.
Last verified 6 September 2026
Open
ANY.RUN Submissions (Malware Reports) (opens in a new tab)
Why: Public malware analysis submissions from the ANY.RUN sandbox — useful for spotting what’s circulating and reviewing related indicators.
Last verified 6 September 2026
Open
BAE Threat Intelligence Insights (opens in a new tab)
Why: BAE Systems threat intelligence newsletter — regular insights from their TI team.
Last verified 6 September 2026
Open
BBRadar (Bug Bounty Programmes) (opens in a new tab)
Why: Discovery hub for bug bounty programmes — helps researchers and programme owners find active scopes and opportunities.
Last verified 6 September 2026
Open
CISA Resources & Tools (opens in a new tab)
Why: US CISA catalogue of free resources and tools spanning guidance, playbooks and programmes for defenders and critical infrastructure operators.
Last verified 6 September 2026
Open
CMMI — Capability Maturity Model Integration (opens in a new tab)
Why: Widely known process-maturity framework that organisations still reference when comparing capability levels alongside cyber-specific maturity models.
Last verified 6 September 2026
Open
CSIRTs Network (EU) (opens in a new tab)
Why: Official EU network linking national CSIRTs and CERT-EU — the coordination hub for cross-border incident response, information sharing and mutual support across Europe.
Last verified 6 September 2026
Open
Cyborg Security Framework (opens in a new tab)
Why: Shared hunting framework that helps teams design detection and hunt workflows in a structured way, useful when building a repeatable threat-hunting practice.
Last verified 6 September 2026
Open
Dark Reading (opens in a new tab)
Why: Industry news and analysis that surfaces vulnerability and threat developments for practitioners.
Last verified 6 September 2026
Open
e2e-assure Recon Review (LinkedIn) (opens in a new tab)
Why: e2e-assure Recon Review — LinkedIn newsletter covering reconnaissance themes and open-source intel.
Last verified 6 September 2026
Open
HP Wolf Security Threat Insights Report (opens in a new tab)
Why: HP Wolf Security Threat Insights — annual report on malware delivery, browser threats, and endpoint risk themes.
Last verified 6 September 2026
Open
IBM Security (YouTube) (opens in a new tab)
Why: IBM Security video channel for advisories, research briefings and product security updates — remapped from legacy /user/ path.
Last verified 6 September 2026
Open
Imperva Cyber Threat Index (opens in a new tab)
Why: Companion index of global cyber-threat statistics and trends alongside the live map.
Last verified 6 September 2026
Open
ISO/IEC 15408 Common Criteria (opens in a new tab)
Why: International criteria for evaluating IT product security claims in procurement and assurance.
Last verified 6 September 2026
Open
MyCloud Attack Dashboard (opens in a new tab)
Why: Live attack dashboard that turns global sensor hits into a simple picture of where activity is rising — handy for quick situational awareness without wading through raw logs.
Last verified 6 September 2026
Open
NCSC Verify Suppliers / Secure Products (opens in a new tab)
Why: NCSC listings of verified suppliers and secure products that help buyers choose assured cyber security offerings with clearer confidence in quality and provenance.
Last verified 6 September 2026
Open
NETSCOUT Threat Intelligence Report (opens in a new tab)
Why: NETSCOUT annual threat intelligence report — DDoS, botnet, and network-attack trends from global telemetry.
Last verified 6 September 2026
Open
NSHC ThreatRecon Team (Medium) (opens in a new tab)
Why: NSHC ThreatRecon Team on Medium — regular threat research posts and campaign write-ups.
Last verified 6 September 2026
Open
Soft Side of Cyber (opens in a new tab)
Why: Podcast and resource brand on the human skills of cyber security — communication, leadership and culture for practitioners and leaders.
Last verified 6 September 2026
Open
SonicWall Security Center Worldwide Attacks (opens in a new tab)
Why: Live worldwide attack view from SonicWall sensors, useful for spotting surge patterns and giving leaders a quick sense of global threat pressure.
Last verified 6 September 2026
Open
SophosLabs (YouTube) (opens in a new tab)
Why: SophosLabs video channel covering malware research, vulnerabilities and defensive tips — a practical watch-list for teams who prefer briefings in short video form.
Last verified 6 September 2026
Open
T-Sec Radar (Deutsche Telekom) (opens in a new tab)
Why: Deutsche Telekom's European security radar showing live attack traffic, useful when you want a continental view of threat pressure alongside the major US vendor maps.
Last verified 6 September 2026
Open
Team Cymru (opens in a new tab)
Why: Community-minded internet security organisation offering threat intelligence, reputation data and research for defenders.
Last verified 6 September 2026
Open
Telekom Security GitHub (opens in a new tab)
Why: Deutsche Telekom Security’s open-source repositories — tools and detection content useful for SOC and security engineering teams.
Last verified 6 September 2026
Open
The Hacker News (opens in a new tab)
Why: Fast-moving cyber news hub useful for situational awareness of newly disclosed vulnerabilities.
Last verified 6 September 2026
Open
The Register (opens in a new tab)
Why: Independent tech news covering security incidents and vulnerability disclosures with practical context.
Last verified 6 September 2026
Open
CISA — Elections Cyber Tabletop in a Box (opens in a new tab)
Why: Elections-infrastructure cyber tabletop package (StopRansomware hub). State/local election officials and cyber partners discuss threats to election systems with template objectives, scenario and discussion questions; editable Word version via CISA Exercises email.
Tabletop Exercises Living doc
Last verified 6 September 2026
Open
CISA CTEP — Cyber-Physical Convergence Scenarios (opens in a new tab)
Why: Hub for CTEPs that explore physical impacts from cyber vectors (and vice versa). Useful for OT/ICS and critical-infrastructure exercise planners designing convergence discussions beyond pure IT scenarios; contact CISA Exercises for packages.
Tabletop Exercises Evergreen hub
Last verified 6 September 2026
Open
CISA CTEP — Cybersecurity Scenarios (listing) (opens in a new tab)
Why: CISA download library of cybersecurity CTEP situation manuals (ransomware, insider threat, ICS, sector packs for healthcare, water, maritime, local government, etc.). Planners download a DOCX scenario then pair it with CTEP package documents for facilitator/AAR templates.
Tabletop Exercises Evergreen hub
Last verified 6 September 2026
Open
CISA CTEP — Electricity Subsector Situation Manual (opens in a new tab)
Why: Electricity-subsector cyber CTEP situation manual (DOCX, July 2024). Grid/utility cyber and operations leads can exercise OT impacts, reliability obligations and multi-party coordination after a cyber attack on electric systems.
Tabletop Exercises Dated artefact
Last verified 6 September 2026
Open
CISA CTEP — Executives and Senior Leadership Situation Manual (opens in a new tab)
Why: Executive/senior-leadership cyber CTEP situation manual (DOCX, Aug 2024). Board-facing discussion injects for decision-making, risk acceptance, external communications and oversight during a major cyber incident—not a technical deep-dive.
Tabletop Exercises Dated artefact
Last verified 6 September 2026
Open
CISA CTEP — Federal Distributed Denial of Service Situation Manual (opens in a new tab)
Why: Federal DDoS CTEP situation manual (DOCX, Nov 2023). Network defenders and service owners rehearse detection, scrubbing/mitigation choices, public messaging and restoration under sustained denial-of-service pressure.
Tabletop Exercises Dated artefact
Last verified 6 September 2026
Open
CISA CTEP — Healthcare and Public Health Situation Manual (opens in a new tab)
Why: Sector CTEP for healthcare/public health cyber scenarios (DOCX, Oct 2023). Useful for hospital CISOs and clinical ops to exercise patient-care continuity, clinical system downtime and regulatory notification under cyber attack.
Tabletop Exercises Dated artefact
Last verified 6 September 2026
Open
CISA CTEP — Industrial Control Systems Situation Manual (opens in a new tab)
Why: ICS/OT-focused CTEP situation manual (DOCX, Aug 2024). Designed for operators and cyber teams to discuss ICS compromise, safety/process impacts and IT–OT coordination; strong fit for critical-infrastructure tabletops.
Tabletop Exercises Dated artefact
Last verified 6 September 2026
Open
CISA CTEP — Information Technology Situation Manual (opens in a new tab)
Why: IT-sector CTEP situation manual (DOCX, June 2024). Suited to MSPs, cloud and enterprise IT teams exercising cyber incident coordination, customer impact and sector information-sharing during an unfolding attack.
Tabletop Exercises Dated artefact
Last verified 6 September 2026
Open
CISA CTEP — Insider Threat Situation Manual (opens in a new tab)
Why: Insider-threat CTEP situation manual (DOCX, Sept 2023). Helps security, HR and legal practise detection, investigation boundaries and containment when a trusted insider abuses access; customisable modules for pre-incident sharing through recovery.
Tabletop Exercises Dated artefact
Last verified 6 September 2026
Open
CISA CTEP — Local Governments Situation Manual (opens in a new tab)
Why: Local-government cyber CTEP situation manual (DOCX, Nov 2023). Built for municipal IT/security and emergency management to exercise ransomware and service disruption against citizen-facing systems and mutual-aid coordination.
Tabletop Exercises Dated artefact
Last verified 6 September 2026
Open
CISA CTEP — Maritime Ports Situation Manual (opens in a new tab)
Why: Maritime ports cyber CTEP situation manual (DOCX, Nov 2023). Port operators and cyber teams can rehearse OT/IT impacts on cargo operations, vessel scheduling and multi-agency response after a cyber incident.
Tabletop Exercises Dated artefact
Last verified 6 September 2026
Open
CISA CTEP — Open-Source Situation Manual (opens in a new tab)
Why: Open-source software risk CTEP situation manual (DOCX, April 2024). Teams discuss dependency inventory, disclosure of vulnerable components and remediation when open-source libraries or tooling become the incident vector.
Tabletop Exercises Dated artefact
Last verified 6 September 2026
Open
CISA CTEP — Vendor Supply Chain Compromise Situation Manual (opens in a new tab)
Why: Vendor/supply-chain compromise CTEP situation manual (DOCX, Aug 2024). Exercises response when a trusted vendor is the intrusion path—vendor isolation, software integrity checks and customer notification for cyber practitioners.
Tabletop Exercises Dated artefact
Last verified 6 September 2026
Open
CISA CTEP — Water and Wastewater Systems Situation Manual (opens in a new tab)
Why: Water/wastewater cyber CTEP situation manual (DOCX, Nov 2023). Utility operators and ICS security leads practise process disruption, public health messaging and recovery when treatment/SCADA systems are targeted.
Tabletop Exercises Dated artefact
Last verified 6 September 2026
Open
NCSC EiB — Being attacked from an unknown Wi-Fi network (opens in a new tab)
Why: Scenario of compromise via unknown Wi-Fi and outdated software. Validates travel/remote working controls, endpoint patch posture and user guidance; short NCSC facilitated discussion with downloadable materials.
Tabletop Exercises Living doc
Last verified 6 September 2026
Open
NCSC EiB — Bring your own device (opens in a new tab)
Why: Tabletop covering compromised personal devices and business data leakage under BYOD. Helps security, IT and policy owners rehearse MDM/conditional access decisions, wipe vs contain choices and staff communications; NCSC pack for facilitators.
Tabletop Exercises Living doc
Last verified 6 September 2026
Open
NCSC EiB — Heightened cyber threat (opens in a new tab)
Why: Exercise for periods of elevated national or sector cyber threat. Leadership and cyber teams practise stepping up monitoring, change freezes, remote-access hardening and crisis comms without waiting for an active breach; free NCSC materials.
Tabletop Exercises Living doc
Last verified 6 September 2026
Open
NCSC EiB — Home and remote working (opens in a new tab)
Why: Tests controls and response when remote/home working drives data compromise risk. Good for validating VPN/zero-trust assumptions, endpoint hygiene and HR/comms playbooks; 60–90 minute NCSC facilitated discussion with downloadable pack.
Tabletop Exercises Living doc
Last verified 6 September 2026
Open
NCSC EiB — Insider threat resulting in a data breach (opens in a new tab)
Why: Scenario where a user grants unauthorised third parties access to sensitive information. Involves cyber, HR and legal in detection, account disablement, evidence handling and breach notification decisions; NCSC tabletop pack.
Tabletop Exercises Living doc
Last verified 6 September 2026
Open
NCSC EiB — Managing a vulnerability disclosure (opens in a new tab)
Why: Practises receiving and handling a vulnerability disclosure on an online system. Security, engineering and comms rehearse triage, patch/mitigation timelines, researcher engagement and public messaging; NCSC facilitator pack.
Tabletop Exercises Living doc
Last verified 6 September 2026
Open
NCSC EiB — Mobile phone theft and response (opens in a new tab)
Why: Tabletop on a stolen mobile used to extract confidential information. Tests device encryption, remote wipe, MFA/session revocation and insider-risk follow-up; suitable for IT, security and staff who handle sensitive data on phones.
Tabletop Exercises Living doc
Last verified 6 September 2026
Open
NCSC EiB — Supply chain (opens in a new tab)
Why: Broader supply-chain risk tabletop for products, systems and services from suppliers. Procurement, cyber and business continuity owners discuss assurance, contractual levers and fallback when a critical supplier fails or is attacked.
Tabletop Exercises Living doc
Last verified 6 September 2026
Open
NCSC EiB — Supply chain ransomware attack (opens in a new tab)
Why: Exercises organisational response when ransomware hits a supplier and cascades into your operations. Useful for IR leads and business owners to test dependency maps, alternate providers and crisis communications; NCSC pack.
Tabletop Exercises Living doc
Last verified 6 September 2026
Open
NCSC EiB — Supply chain software (opens in a new tab)
Why: Focused on software suppliers in the estate. Teams walk a supply-chain software attack: inventory of critical components, detection signals, isolation, rebuild and customer impact; NCSC downloadable discussion pack.
Tabletop Exercises Living doc
Last verified 6 September 2026
Open
NCSC EiB — Third party software compromise (opens in a new tab)
Why: NCSC discussion exercise on responding when a third-party software supplier is compromised. Useful for CISOs and IT leads to stress-test vendor dependency, isolation options and customer/stakeholder communications; downloadable exercise pack.
Tabletop Exercises Living doc
Last verified 6 September 2026
Open
NCSC EiB — Threatened leak of sensitive data (opens in a new tab)
Why: Tabletop on preventing, detecting and responding to threats to leak sensitive information (extortion-style pressure). Brings together cyber, legal, privacy and communications on containment, engagement strategy and notification duties.
Tabletop Exercises Living doc
Last verified 6 September 2026
Open