Skill UI

Provides an OWASP 2025-aligned vulnerability scanning mindset, supply chain defenses, attack surface mapping, and risk prioritization guidance with runtime scripts for automated validation of modern application security.

Integrates FIRST's Exploit Prediction Scoring System (EPSS) API to estimate the probability of a CVE being exploited in the wild within 30 days. This tool moves beyond traditional severity scoring (CVSS) by providing a likelihood measure, allowing security teams to implement a risk-based remediation strategy by combining EPSS scores with CVSS scores to assign immediate, urgent, or low priorities.

This skill provides a structured framework for implementing patch management in Operational Technology (OT) and Industrial Control Systems (ICS) environments. It addresses the critical balance between cybersecurity remediation and maintaining continuous operational safety and availability. Key components include risk-based patch prioritization, vendor compatibility testing, staged deployment through test environments, managing maintenance windows, and implementing compensating controls for unpatchable assets.

This skill provides a comprehensive framework for conducting systematic access reviews and certifications across enterprise applications. It guides users through designing review campaigns, implementing risk-based prioritization (e.g., privileged, PII access), assigning reviewers (manager, application owner), and automating the collection of entitlement data. The process ensures compliance evidence is generated for major standards like SOX, HIPAA, and PCI DSS, helping maintain the principle of least privilege.

This skill implements a multi-factor scoring model to assess the criticality of IT assets. By weighting factors such as business function impact, data sensitivity, regulatory scope, and network exposure, it assigns a risk tier. This tier is then used to dynamically adjust the Service Level Agreements (SLAs) for vulnerability remediation, ensuring that organizations prioritize patching efforts on their most critical 'crown jewel' systems first.

This skill implements a sophisticated risk-based prioritization engine by combining three critical data sources: the CISA Known Exploited Vulnerabilities (KEV) catalog, the Exploit Prediction Scoring System (EPSS), and traditional CVSS scores. It allows security teams to move beyond simple severity ratings, focusing remediation efforts on vulnerabilities confirmed to be actively exploited in the wild or predicted to be highly exploitable. The workflow integrates fetching, enriching, and scoring vulnerabilities to generate an actionable remediation plan with defined SLAs.

This tool conducts comprehensive, sector-specific threat landscape assessments by analyzing designated threat actor patterns (e.g., APT groups, cybercriminals), common attack vectors, and industry-specific vulnerabilities. It is designed to provide actionable intelligence for risk management, security investment prioritization, and executive reporting across critical sectors like finance, healthcare, and energy.

This skill provides a comprehensive guide to the Common Vulnerability Scoring System (CVSS v4.0), the industry standard for assessing vulnerability severity. It teaches users how to calculate CVSS scores using Base, Threat, and Environmental metrics, and crucially, how to integrate real-world context like EPSS scores and CISA KEV listings for advanced, actionable risk prioritization in security operations.

This tool implements the Stakeholder-Specific Vulnerability Categorization (SSVC) framework, providing a structured decision-tree methodology for advanced vulnerability prioritization. It moves beyond traditional CVSS scoring by incorporating critical factors such as active exploitation status (CISA KEV), technical impact, automatability, and mission prevalence. It generates actionable remediation priorities (Track, Attend, Act) to guide security teams in managing risk and improving security program maturity.

This domain-agnostic skill ranks impediments, risks, and gaps by using a specialized value-stream scoring model. It evaluates countermeasures based on four criteria: Return on Investment (ROI), Cost to Implement, Ease of Deployment, and Risk Factor. A proprietary formula calculates a final Priority score (1-100), allowing users to quickly determine the optimal sequence for remediation, improvement backlogs, or triage items.

This skill applies the RICE framework (Reach, Impact, Confidence, Effort) to objectively score and rank product initiatives. It helps teams prioritize backlogs, plan quarters, and compare multiple competing ideas by providing a structured, data-driven ranking. The output identifies quick wins, high-risk moonshots, and critical data gaps for validation.