↑
Request a Consultation

Cybersecurity resources for security and AI professionals.

Frameworks, regulations, and hands-on tools we trust: AI security, privacy law, threat intelligence, OSINT, blue, red, and purple teaming, DevSecOps, bug bounty, and password security. All free to access.

139 resources

AI Security & Governance

Securing and governing AI systems, models, and agents.

owaspai.orgFeaturedOWASP AI ExchangeOpen, comprehensive guidance on protecting AI systems against threats; contributes to EU AI Act and ISO standards.Visit ↗ genai.owasp.orgOWASP GenAI Security ProjectHome of the OWASP Top 10 for LLM Applications and agentic AI security guidance.Visit ↗ atlas.mitre.orgMITRE ATLASKnowledge base of adversary tactics and techniques against AI-enabled systems.Visit ↗ nist.govNIST AI Risk Management FrameworkVoluntary framework for managing AI risk across the lifecycle, plus the Generative AI Profile.Visit ↗ iso.orgISO/IEC 42001International standard for AI management systems.Visit ↗ eur-lex.europa.euEU AI Act (Official Text)Regulation (EU) 2024/1689, the EU's risk-based AI law.Visit ↗ artificialintelligenceact.euEU AI Act ExplorerReadable, searchable guide to the AI Act with timelines and analysis.Visit ↗ saif.googleGoogle Secure AI Framework (SAIF)Practitioner guidance and risk map for building secure AI systems.Visit ↗ cloudsecurityalliance.orgCSA AI Safety InitiativeCloud Security Alliance research and guidance on AI safety and compliance.Visit ↗ oecd.aiOECD AI Policy ObservatoryAI principles, policies, and incident tracking across countries.Visit ↗ github.comToolMicrosoft PyRITOpen-source framework for red teaming generative AI systems.Visit ↗ github.comToolNVIDIA garakLLM vulnerability scanner for jailbreaks, prompt injection, and leakage.Visit ↗

Privacy & Regulation

Laws, regulators, and official texts.

eur-lex.europa.euGDPR (Official Text)Regulation (EU) 2016/679, the General Data Protection Regulation.Visit ↗ edpb.europa.euEuropean Data Protection BoardGuidelines and opinions on applying GDPR consistently.Visit ↗ oag.ca.govCCPA (California Attorney General)California Consumer Privacy Act overview, rights, and business obligations.Visit ↗ cppa.ca.govCalifornia Privacy Protection AgencyRegulations and enforcement for CCPA/CPRA, including automated decision-making rules.Visit ↗ hhs.govHIPAA Security Rule (HHS)Official guidance on safeguarding electronic protected health information.Visit ↗ hhscyber.hhs.govHHS 405(d) & Cyber GatewayHealth Industry Cybersecurity Practices (HICP) and healthcare cyber resources.Visit ↗ eur-lex.europa.euNIS2 Directive (Official Text)Directive (EU) 2022/2555 on cybersecurity across the EU.Visit ↗ pcisecuritystandards.orgPCI Security Standards CouncilPCI DSS and payment data security standards.Visit ↗

Standards & Frameworks

Control frameworks and maturity models.

nist.govNIST Cybersecurity Framework 2.0The CSF 2.0 core, profiles, and implementation resources.Visit ↗ csrc.nist.govNIST SP 800-53 Rev. 5Security and privacy control catalog for information systems.Visit ↗ csrc.nist.govNIST SP 800-171 Rev. 3Protecting Controlled Unclassified Information in nonfederal systems.Visit ↗ csrc.nist.govNIST Risk Management FrameworkThe RMF process, publications, and quick-start guides.Visit ↗ dodcio.defense.govCMMC (DoD CIO)Official Cybersecurity Maturity Model Certification program information.Visit ↗ cisecurity.orgCIS Critical Security ControlsPrioritized safeguards to defend against the most common attacks.Visit ↗ cisa.govCISA Cross-Sector Performance GoalsBaseline practices for critical infrastructure organizations.Visit ↗ iso.orgISO/IEC 27001International standard for information security management systems.Visit ↗

Cyber Threat Intelligence (CTI) & Vulnerabilities

Advisories, vulnerability data, exploit intelligence, and IOC sources. Intelligence drives every defensive and offensive priority below.

cisa.govCISA Alerts & AdvisoriesCurrent advisories, alerts, and ICS notices from CISA.Visit ↗ nvd.nist.govNational Vulnerability DatabaseCVE enrichment with CVSS scores and references.Visit ↗ cve.orgCVE ProgramThe authoritative catalog of publicly disclosed vulnerabilities.Visit ↗ first.orgFIRST EPSSProbability that a vulnerability will be exploited in the next 30 days.Visit ↗ abuse.chabuse.chCommunity malware, botnet, and IOC tracking projects.Visit ↗ otx.alienvault.comLevelBlue Open Threat ExchangeOpen threat intelligence community and indicator feeds.Visit ↗ virustotal.comVirusTotalAnalyze files, URLs, domains, and IPs against many engines.Visit ↗ exploit-db.comExploit Database (Exploit-DB)Public archive of exploits and proof-of-concept code, mapped to CVEs. Use it to gauge real-world exploitability when prioritizing patches.Visit ↗

OSINT: Open-Source Intelligence

Frameworks, toolkits, and search tools for investigations, attack-surface discovery, and seeing your organization the way an attacker does.

Use OSINT ethically and legally. Investigate only what you're authorized to, follow platform terms and privacy laws, and start with your own organization: what attackers can learn about your staff, domains, and exposed systems is your real attack surface.

osintframework.comFeaturedOSINT FrameworkInteractive tree of free OSINT tools organized by what you are looking for.Visit ↗ bellingcat.gitbook.ioBellingcat Online Investigation ToolkitCurated, documented tools from one of the leading open-source investigation teams.Visit ↗ inteltechniques.comToolIntelTechniques Search ToolsBrowser-based search tools for people, domains, and social media research.Visit ↗ github.comToolSpiderFootAutomates OSINT collection to map your external attack surface.Visit ↗ github.comTooltheHarvesterGathers emails, subdomains, hosts, and names from public sources.Visit ↗ shodan.ioToolShodanSearch engine for internet-connected devices; see which of your systems are exposed.Visit ↗ censys.comToolCensysInternet-wide scan data for hosts, certificates, and exposed services.Visit ↗ crt.shToolcrt.sh Certificate SearchCertificate Transparency search that reveals subdomains issued certificates.Visit ↗ web.archive.orgInternet Archive Wayback MachineHistorical snapshots of websites for investigations and exposure review.Visit ↗ github.comAwesome OSINTLarge curated list of OSINT tools and resources by category.Visit ↗ tracelabs.orgCommunityTrace LabsNonprofit that crowdsources OSINT to help find missing people; great practice for ethical OSINT.Visit ↗

Blue Team

Detection, response, and defensive engineering.

d3fend.mitre.orgMITRE D3FENDKnowledge graph of defensive countermeasures mapped to ATT&CK.Visit ↗ cisa.govCISA Known Exploited VulnerabilitiesVulnerabilities actively exploited in the wild; prioritize these first.Visit ↗ github.comSigma RulesGeneric, SIEM-agnostic detection rule format and repository.Visit ↗ virustotal.github.ioYARAPattern matching for identifying and classifying malware.Visit ↗ docs.velociraptor.appToolVelociraptorOpen-source endpoint visibility and digital forensics at scale.Visit ↗ securityonionsolutions.comToolSecurity OnionFree platform for threat hunting, network monitoring, and log management.Visit ↗ github.comElastic Detection RulesOpen detection rules mapped to MITRE ATT&CK.Visit ↗ learn.microsoft.comToolSysmon (Sysinternals)Windows system activity monitoring for detection and forensics.Visit ↗ gchq.github.ioToolCyberChefThe cyber Swiss Army knife for encoding, decoding, and data analysis.Visit ↗

Red Team & Penetration Testing

What offensive testing is, why it pays off, what regulations require it, and the references testers use.

ScanVulnerability scanning

Automated tools list known weaknesses. Broad and frequent, but they don't prove anything can be exploited.

PentestPenetration testing

Authorized experts try to exploit weaknesses in a defined scope (network, app, cloud) and show the real impact.

Red teamRed teaming

A goal-based, stealthy campaign that emulates a real adversary to test people, process, and technology, including whether your team notices.

PurplePurple teaming

Attackers and defenders work side by side, test by test, to tune detections and close gaps in real time.

Common use cases
  • External perimeter: what an internet attacker can reach today
  • Internal network and Active Directory: how far a phished laptop gets
  • Web apps and APIs: OWASP Top 10, auth, and business-logic flaws
  • Cloud: IAM misconfiguration, exposed storage, and privilege escalation
  • AI and LLM applications: prompt injection, data leakage, and agent misuse
  • Social engineering: phishing, vishing, and help-desk pretexting
  • Physical and wireless: badge access, tailgating, and rogue Wi-Fi
  • Before a launch, merger, or audit: independent proof before it counts
Why request these services: the business benefits
  • Proof, not theory: shows which risks are actually exploitable so you fix what matters first
  • Smarter spending: validates whether existing tools and controls work before you buy more
  • Tests your response: measures how fast your team or provider detects and contains an attack
  • Evidence for others: reports satisfy auditors, customers' security questionnaires, and insurers
  • Board-ready risk: turns technical findings into business impact leaders can act on
  • Cheaper than a breach: finding a path in yourself costs far less than an incident
When it's required for compliance
PCI DSS v4.0.1Req. 11.4: internal and external penetration tests at least every 12 months and after significant changes, plus segmentation testing.
NYDFS 23 NYCRR 500500.5: penetration testing at least annually, from inside and outside your system boundaries.
EU DORAArt. 26: threat-led penetration testing (TLPT) at least every three years for financial entities designated by authorities.
FedRAMPPenetration testing as part of initial and annual assessments.
CMMC 2.0Level 2 requires vulnerability scanning and periodic control assessments (NIST SP 800-171). Level 3 adds penetration testing under NIST SP 800-172.
HIPAAThe Security Rule requires periodic technical evaluations. The proposed 2025 update would require penetration testing at least every 12 months.
SOC 2Not explicitly mandated, but auditors and customers commonly expect an annual pentest as evidence of monitoring controls.
ISO/IEC 27001:2022Annex A 8.8 (technical vulnerabilities) and 8.29 (security testing) are commonly met with pentesting.
EU Cyber Resilience ActAnnex I requires manufacturers to run effective and regular security tests and reviews of products with digital elements.
Cyber insuranceUnderwriters increasingly ask for recent pentest results and remediation evidence.

Summary for awareness, not legal advice. Confirm requirements against the current official text for your situation.

Before you hire a tester
  • Define scope, goals, and what's off-limits in writing
  • Get signed authorization from the system owner, including any cloud or hosting providers' rules
  • Agree on rules of engagement, testing windows, and an emergency stop contact
  • Ask for sample reports, tester qualifications, and accreditation (such as CREST)
  • Require secure handling and deletion of any data the testers access
  • Budget for remediation and a retest to prove fixes work

Nexus helps you buy and use testing well: we scope the engagement, help select a qualified provider, oversee the test, and turn findings into a prioritized remediation plan your board can follow.

Request a testing consult
attack.mitre.orgMITRE ATT&CKAdversary tactics and techniques based on real-world observations.Visit ↗ owasp.orgOWASP Web Security Testing GuideThe standard methodology for web application security testing.Visit ↗ github.comPayloadsAllTheThingsPayloads and bypasses for web application security testing.Visit ↗ hacktricks.wikiHackTricksCommunity wiki of offensive techniques and methodology.Visit ↗ gtfobins.orgGTFOBinsUnix binaries that can be abused to bypass local security restrictions.Visit ↗ lolbas-project.github.ioLOLBASLiving-off-the-land binaries and scripts for Windows.Visit ↗ csrc.nist.govStandardNIST SP 800-115NIST technical guide to information security testing and assessment: planning, techniques, and reporting.Visit ↗ crest-approved.orgCRESTAccreditation body for penetration testing providers; useful when vetting a vendor.Visit ↗ ecb.europa.euTIBER-EU (ECB)European framework for threat intelligence-based ethical red teaming, aligned with DORA TLPT.Visit ↗ pcisecuritystandards.orgPCI SSC Document LibraryPCI DSS v4.0.1 (Requirement 11.4) and the PCI penetration testing guidance.Visit ↗

Purple Team

Adversary emulation and detection validation.

atomicredteam.ioAtomic Red TeamSmall, portable tests mapped to ATT&CK to validate detections.Visit ↗ caldera.apache.orgToolCaldera (Apache)Automated adversary emulation platform.Visit ↗ vectr.ioToolVECTRTrack red and purple team testing and measure detection coverage over time.Visit ↗ github.comPurple Team Exercise FrameworkMethodology for planning and running purple team exercises.Visit ↗ evals.mitre.orgMITRE ATT&CK EvaluationsTransparent evaluations of security products against emulated adversaries.Visit ↗ mitre-attack.github.ioToolATT&CK NavigatorVisualize and annotate ATT&CK coverage and gaps.Visit ↗ github.comToolDeTT&CTScore and compare data source quality and detection coverage.Visit ↗

Simulations, Cyber Ranges & Testing Labs

Exercise packages, breach and attack simulation, and intentionally vulnerable labs to practice safely.

cisa.govFeaturedCISA Tabletop Exercise Packages (CTEPs)Free, ready-to-run scenarios with facilitator guides for ransomware, insider threat, supply chain, and more.Visit ↗ caldera.apache.orgToolCaldera (Apache)Automated adversary emulation to test detections continuously.Visit ↗ atomicredteam.ioToolAtomic Red TeamSmall, safe, ATT&CK-mapped tests for validating controls.Visit ↗ stratus-red-team.cloudToolStratus Red TeamGranular attack techniques for AWS, Azure, GCP, and Kubernetes to test cloud detections.Visit ↗ github.comLabGOAD: Game of Active DirectoryVulnerable Active Directory lab for practicing attacks and detections.Visit ↗ github.comLabCloudGoatVulnerable-by-design AWS scenarios for cloud security testing practice.Visit ↗ owasp.orgLabOWASP Juice ShopIntentionally insecure modern web app for testing and training.Visit ↗ cyberdefenders.orgLabCyberDefendersBlue team and DFIR investigation labs with real-world artifacts.Visit ↗

DevSecOps & Software Supply Chain

Build security into the pipeline: secure development frameworks, scanners, SBOMs, and maturity models.

csrc.nist.govStandardNIST SP 800-218 SSDFSecure Software Development Framework; the basis for federal software attestations.Visit ↗ dsomm.owasp.orgOWASP DevSecOps Maturity Model (DSOMM)Maturity levels and activities for building security into delivery pipelines.Visit ↗ owaspsamm.orgOWASP SAMMSoftware Assurance Maturity Model for measuring and improving secure development.Visit ↗ slsa.devSLSASupply-chain Levels for Software Artifacts: build integrity and provenance.Visit ↗ scorecard.devToolOpenSSF ScorecardAutomated security health checks for open-source dependencies.Visit ↗ dependencytrack.orgToolOWASP Dependency-TrackSBOM analysis platform that tracks component risk across your portfolio.Visit ↗ trivy.devToolTrivyScanner for vulnerabilities, misconfigurations, secrets, and SBOMs in containers and IaC.Visit ↗ semgrep.devToolSemgrepFast static analysis with community rules for many languages.Visit ↗ github.comToolGitleaksDetects hardcoded secrets in git repositories and CI.Visit ↗ cisa.govCISA Secure by DesignPrinciples and pledge for shipping products that are secure out of the box.Visit ↗

Bug Bounty & Vulnerability Disclosure

Let the security community report flaws safely, from a simple disclosure policy to a paid bounty program.

Step 1Publish a disclosure policy

A vulnerability disclosure policy (VDP) and a security.txt file tell researchers how to report issues safely. See ours as an example.

Step 2Offer safe harbor and triage

Promise good-faith researchers you won't take legal action, then set up a process to acknowledge, validate, and fix reports.

Step 3Add a bug bounty when ready

Paying for valid findings brings more testers. Start private and narrow in scope once you can fix issues quickly.

Disclosure is increasingly expected: the EU Cyber Resilience Act requires manufacturers to have a coordinated vulnerability disclosure policy, and U.S. federal agencies must maintain one under CISA BOD 20-01. A bounty complements, but doesn't replace, regular penetration testing.

cisa.govFeaturedCISA Vulnerability Disclosure Policy TemplatePlain-language VDP template you can adapt for your organization.Visit ↗ disclose.iodisclose.ioOpen standards and safe-harbor language for vulnerability disclosure programs.Visit ↗ cheatsheetseries.owasp.orgOWASP Vulnerability Disclosure Cheat SheetGuidance for both researchers and organizations receiving reports.Visit ↗ securitytxt.orgToolsecuritytxt.orgGenerate an RFC 9116 security.txt so researchers know how to reach you.Visit ↗ iso.orgStandardISO/IEC 29147International standard for vulnerability disclosure.Visit ↗ hackerone.comHackerOneManaged bug bounty and VDP platform with a large researcher community.Visit ↗ bugcrowd.comBugcrowdCrowdsourced security platform for bug bounty, VDP, and pentest programs.Visit ↗ intigriti.comIntigritiEuropean bug bounty and VDP platform.Visit ↗ yeswehack.comYesWeHackEuropean bug bounty and exposure management platform.Visit ↗

Passwords, Passkeys & Account Security

Check password strength, find breached passwords, and move to MFA and passkeys.

How strong is my password?🔒 Runs only in your browser. Nothing is sent or saved.

Enter a password to see an estimate.

    This is an estimate based on length, character variety, and common patterns. Don't type a password you use on a real account into any website, including this one. To check whether a password has been breached, use Pwned Passwords. NIST SP 800-63B-4 recommends at least 15 characters for passwords used alone (8 with MFA), no forced complexity rules, and screening against breached-password lists.

    haveibeenpwned.comFeaturedHave I Been Pwned: Pwned PasswordsCheck whether a password has appeared in a breach using k-anonymity (the full password never leaves your device).Visit ↗ haveibeenpwned.comToolHave I Been PwnedCheck whether your email address has been exposed in a data breach.Visit ↗ pages.nist.govStandardNIST SP 800-63B-4Current federal guidance: long passwords, no forced composition rules, breached-password screening.Visit ↗ cisa.govCISA: Use Strong PasswordsPlain-language guidance and password manager tips for staff.Visit ↗ cisa.govCISA: Multifactor AuthenticationTurn on MFA and move to phishing-resistant options.Visit ↗ fidoalliance.orgFIDO Alliance: PasskeysHow passkeys replace passwords with phishing-resistant sign-in.Visit ↗ 2fa.directoryTool2FA DirectoryFind which websites support two-factor authentication and which methods.Visit ↗ bitwarden.comToolBitwardenOpen-source password manager with free personal and business plans.Visit ↗ keepassxc.orgToolKeePassXCFree, open-source, offline password manager.Visit ↗

    Phishing, Smishing & Email Threats

    Recognize, prevent, and report phishing, text-message scams, and business email compromise.

    Spot it
    • Urgency, threats, or “act now” pressure
    • Sender or link that doesn't match the real domain
    • Unexpected attachments, QR codes, or login pages
    • Texts about packages, tolls, or bank holds (smishing)
    Stop it
    • Phishing-resistant MFA (passkeys / FIDO2) for email and admins
    • SPF, DKIM, and DMARC at enforcement on your domain
    • Email filtering, link rewriting, and attachment sandboxing
    • Verify payment or bank-detail changes by phone, never by reply
    Report it
    • Use your email's “Report phishing” button and tell IT
    • Forward scam texts to 7726 (SPAM) in the U.S.
    • Report fraud or wire loss to the FBI IC3 immediately
    • If you clicked: change passwords, then call IT right away
    cisa.govCISA: Recognize and Report PhishingPlain-language signs of phishing and how to report it.Visit ↗ consumer.ftc.govFTC: Recognize and Avoid Phishing ScamsConsumer guidance on phishing emails and what to do if you clicked.Visit ↗ consumer.ftc.govFTC: Spam Text Messages (Smishing)How to spot and report text-message scams, including forwarding to 7726 (SPAM).Visit ↗ cisa.govCISA: Multifactor AuthenticationWhy MFA matters and how to move to phishing-resistant options.Visit ↗ attack.mitre.orgMITRE ATT&CK: Phishing (T1566)How adversaries use phishing, with detections and mitigations.Visit ↗ ic3.govFBI Internet Crime Complaint Center (IC3)Report business email compromise, wire fraud, and other internet crime.Visit ↗ apwg.orgAPWG: Report PhishingForward phishing emails to the Anti-Phishing Working Group.Visit ↗ safebrowsing.google.comGoogle Safe Browsing: Report a Phishing PageReport malicious sites so browsers warn other users.Visit ↗ m3aawg.orgM3AAWGIndustry best practices on email authentication, anti-abuse, and messaging security.Visit ↗ sans.orgSANS OUCH! NewsletterFree monthly security awareness newsletter for staff.Visit ↗

    Website & Application Security

    Test and harden websites and web apps against the OWASP Top 10.

    owasp.orgOWASP Top 10The most critical web application security risks.Visit ↗ asvs.owasp.orgOWASP ASVSApplication Security Verification Standard: testable security requirements.Visit ↗ owasp.orgOWASP Web Security Testing GuideMethodology for testing web applications.Visit ↗ developer.mozilla.orgToolMDN HTTP ObservatoryFree scan of a website's HTTP security headers and configuration.Visit ↗ cisa.govCISA Secure by DesignPrinciples for building products that are secure out of the box.Visit ↗ rfc-editor.orgRFC 9116: security.txtStandard file that tells researchers how to report vulnerabilities.Visit ↗

    Free Training & Labs

    Hands-on learning at no cost.

    niccs.cisa.govCISA NICCS TrainingCatalog of cybersecurity training, including free federal courses.Visit ↗ cisa.govCISA No-Cost Services & ToolsFree services and tools from CISA and partners for organizations.Visit ↗ portswigger.netPortSwigger Web Security AcademyFree, hands-on web security labs.Visit ↗ owasp.orgOWASP Juice ShopIntentionally insecure web app for practice and training.Visit ↗ isc2.orgISC2 Certified in CybersecurityEntry-level certification with free training options.Visit ↗ sans.orgSANS Free ResourcesPosters, cheat sheets, white papers, and webcasts.Visit ↗ tryhackme.comTryHackMeGuided cyber labs with a free tier.Visit ↗ academy.hackthebox.comHack The Box AcademyStructured offensive and defensive modules, with free content.Visit ↗ blueteamlabs.onlineBlue Team Labs OnlineDefensive investigations and challenges.Visit ↗ letsdefend.ioLetsDefendSOC analyst training with simulated alerts.Visit ↗ antisyphontraining.comAntisyphon TrainingPay-what-you-can and low-cost security courses.Visit ↗

    Communities

    Professional organizations and forums.

    owasp.orgOWASP FoundationOpen-source application security projects and local chapters.Visit ↗ first.orgFIRSTGlobal forum of incident response and security teams.Visit ↗ issa.orgISSA InternationalInformation Systems Security Association and local chapters.Visit ↗

    No resources match your search. Try another term or clear the filter.

    External links are provided as a convenience for the security community. Nexus Security Advisors is not affiliated with or endorsed by these organizations, and is not responsible for their content. Suggest a resource: info@nexussecurityadvisors.com.

    Need help applying these?

    Turn frameworks into a plan your board can follow.

    Book a free 30-minute discovery call and we'll tell you plainly where to start.

    Request a consultationBack to home