Skill UI

This skill covers the complete lifecycle for establishing, implementing, and maintaining an Information Security Management System (ISMS) based on ISO/IEC 27001:2022. Users learn the full process, from initial gap analysis and risk assessment (including defining risk treatment plans) to selecting Annex A controls, developing the Statement of Applicability (SoA), conducting internal audits, and preparing for final certification. It is essential for organizations needing to achieve formal security compliance and robust governance.

This skill defines the process and framework for establishing mandatory Service Level Agreements (SLAs) for mitigating identified vulnerabilities. It guides users on how to calculate remediation timeframes based on vulnerability severity (CVSS, KEV), asset criticality (Tier 1, 2, 3), and exploit availability. The process includes setting up escalation chains, defining exception processes, and tracking key performance indicators (KPIs) like Mean Time to Remediate (MTTR) to ensure robust security governance and compliance.

Implement Okta as a centralized Identity Provider (IdP) for robust multi-cloud security across AWS, Azure, and GCP. This skill covers configuring Single Sign-On (SSO), deploying phishing-resistant Multi-Factor Authentication (MFA), automating user lifecycle management via SCIM, and enforcing adaptive access policies based on device posture and user risk, helping organizations achieve Zero Trust compliance.

Automate and execute comprehensive access recertification campaigns within Saviynt Enterprise Identity Cloud. This process validates user entitlements against industry standards like SOX, SOC2, and HIPAA. It helps organizations mitigate security risks by identifying and revoking excessive or unnecessary access rights, ensuring robust identity governance and compliance.

BloodHound is an open-source reconnaissance tool that leverages graph theory to analyze Active Directory relationships. This guide details the process of collecting AD data using SharpHound and visualizing complex attack paths. It helps identify potential privilege escalation chains, trust abuses, and misconfigurations necessary for an attacker to move from a low-privilege user account to Domain Admin, making it essential for advanced red-teaming and security auditing.

This skill guides users through conducting a comprehensive maturity assessment using the NIST Cybersecurity Framework (CSF) 2.0. It covers calculating an organization's cybersecurity posture against the six core functions (Govern, Identify, Protect, Detect, Respond, Recover) and the four Implementation Tiers (Partial to Adaptive). The process culminates in detailed gap analysis and the creation of a strategic improvement roadmap.

This skill guides the execution of structured purple team exercises, simulating real-world adversary techniques (Red Team) and validating the effectiveness of existing detection rules and controls (Blue Team). It is essential for Security Operations Center (SOC) teams to identify critical detection gaps, optimize analyst response playbooks, and enhance the overall security posture against specific threat actors mapped to MITRE ATT&CK techniques.

Nikto is a powerful open-source web server and web application scanner designed for comprehensive vulnerability assessment. It tests against over 7,000 potentially dangerous files, checks for outdated server software (over 1,250 versions), and identifies common vulnerabilities including XSS, SQL injection, misconfigurations, and weak SSL/TLS settings. It is essential for penetration testing and rigorous security auditing.

Evaluates pitch decks slide by slide, benchmarking against the 11-slide VC template, scoring every section, flagging common killer patterns, and benchmarking versus famous decks for actionable fundraising feedback.

Scans a company or sector for hiring, funding, product, team, market, and tech signals using CLAUDE web search and Python scoring to surface investment readiness, momentum, and competitive risks for VC deal sourcing.

A comprehensive guide for preparing SaaS and cloud infrastructure companies for SOC 2 Type I and Type II audits. Covers mapping Trust Service Criteria (TSC), generating control matrices, performing thorough gap analysis, collecting evidence, and assessing overall compliance readiness across Security, Availability, Confidentiality, and Privacy domains. Essential for demonstrating operational trustworthiness to enterprise clients.

This skill automates the entire SOC 2 Type II audit lifecycle. It facilitates gap assessment against AICPA Trust Services Criteria (CC1-CC9) and collects continuous evidence from major cloud providers (AWS, Azure, GCP) and identity systems (Okta, Jira). It supports validating control effectiveness, remediation tracking, and overall compliance monitoring for Security, Availability, Processing Integrity, Confidentiality, and Privacy.