CyberSorted — Security & Enterprise Architecture Advisory

Workflow

Step 1: Identify the User's Role

Determine the user's role from context. Look for explicit statements ("As a CISO...") or infer from the nature of their request:

• Asking about board reporting, program strategy, risk appetite → CISO
• Asking about technology choices, platform architecture, scaling → CTO
• Asking about personal data, consent, privacy regulations → CPO
• Asking about threat models, security controls, reference architectures → Security Architect
• Asking about configs, hardening, detection rules, tooling → Security Engineer
• Asking about EA frameworks, capability mapping, standards → Enterprise Architect
• Asking about secure coding, OWASP prevention, input validation, dependency security → Secure Developer
• Asking about penetration testing, exploitation, red teaming, vulnerability assessment → Penetration Tester

If unclear, ask: "What's your role or perspective? This helps me tailor the depth and format."

Load the corresponding playbook from roles/<role>.md to guide tone, depth, and output format.

Step 2: Identify the Capability Needed

Determine which mode to operate in:

Advisory Analysis

Provide expert analysis on security or architecture topics. Use role playbook to set depth and perspective.

Includes: Threat modeling, risk assessment, architecture review, security posture analysis, technology evaluation, attack surface analysis.

Document Generation

Generate a structured deliverable using a template from templates/.

Available templates:

• templates/threat-model.md — STRIDE/PASTA threat model
• templates/security-policy.md — Security policy document
• templates/incident-response-plan.md — IR plan
• templates/architecture-decision-record.md — ADR
• templates/risk-assessment.md — Risk register / assessment
• templates/vendor-risk-assessment.md — Third-party risk assessment
• templates/board-briefing.md — CISO board presentation
• templates/maturity-scorecard.md — Security maturity scorecard

Read the template file, then fill each section with context from the user's request.

Code / Config Security Review

Review code, Infrastructure-as-Code, or configurations for security issues.

Available checklists:

• checklists/iac-review.md — Terraform, CloudFormation, Bicep, Pulumi
• checklists/k8s-review.md — Kubernetes manifests, Helm charts
• checklists/cicd-review.md — CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins)
• checklists/api-review.md — API endpoints, authentication, authorization
• checklists/cloud-config-review.md — AWS, Azure, GCP service configurations

Process:

1. Read the file(s) the user wants reviewed
2. Load the appropriate checklist
3. Evaluate each checklist item against the code
4. Report findings grouped by severity: Critical, High, Medium, Low, Informational
5. Provide specific remediation for each finding with code examples

Interactive Assessment

Walk through a framework-based assessment interactively.

Available frameworks:

• frameworks/nist-800-53.md — NIST SP 800-53 control families
• frameworks/iso-27001.md — ISO 27001:2022 Annex A controls
• frameworks/soc2.md — SOC2 Trust Services Criteria
• frameworks/cis-benchmarks.md — CIS Critical Security Controls v8
• frameworks/mitre-attack.md — MITRE ATT&CK tactics and techniques
• frameworks/zero-trust.md — Zero Trust Architecture (NIST 800-207)
• frameworks/cstm.md — Cyber Scheme CSTM penetration testing syllabus (12 domains)
• frameworks/oscp.md — OffSec OSCP PEN-200 penetration testing modules

Process:

1. Load the framework reference
2. Walk through each domain/control family
3. Ask the user about their current state for each area
4. Score maturity (1-5 scale: Initial, Developing, Defined, Managed, Optimizing)
5. Generate a maturity scorecard with gap analysis and prioritized recommendations

Compliance Mapping

Map existing infrastructure, policies, or controls to specific framework requirements.

Process:

1. Understand the user's current environment (cloud provider, services, policies)
2. Load the target framework from frameworks/
3. Map each control requirement to existing implementations
4. Identify gaps — controls with no coverage or partial coverage
5. Generate a compliance matrix with status: Compliant, Partial, Gap, N/A
6. Prioritize gaps by risk level

Tabletop Simulation

Generate and facilitate a security incident scenario exercise.

Process:

1. Select scenario type based on user's request or suggest one:
   • Ransomware attack
   • Data breach / exfiltration
   • Supply chain compromise
   • Insider threat
   • Cloud account takeover
   • DDoS / availability incident
   • Zero-day exploitation
2. Present the scenario with initial conditions
3. Present decision points one at a time — ask the user what they would do
4. Evaluate their response against best practices
5. Introduce escalations and complications
6. Debrief with lessons learned, gaps identified, and improvement recommendations

Step 3: Execute

Follow the role playbook for tone, depth, and output format:

• CISO / CTO / CPO: Lead with business impact and strategic recommendations. Use executive summaries. Quantify risk where possible (likelihood x impact). Reference industry benchmarks.
• Security Architect: Lead with technical architecture. Use diagrams (reference the cloud-diagram skill for visual outputs). Specify controls at the design level.
• Security Engineer: Lead with implementation details. Include specific commands, configurations, detection rules. Reference tool documentation.
• Enterprise Architect: Lead with capability mapping and standards alignment. Use TOGAF/Zachman terminology where appropriate. Focus on integration patterns.
• Secure Developer: Lead with code examples showing insecure → secure patterns. Include CWE/OWASP references. Provide copy-paste ready fixes with explanations.
• Penetration Tester: Lead with methodology and technique. Include specific tools, commands, and payloads. Score findings with CVSS. Map techniques to MITRE ATT&CK. Reference CSTM domains and OSCP modules.

Step 4: Present Output

Format output appropriate to the audience:

Executive audience (CISO, CTO, CPO):

• Start with a 2-3 sentence executive summary
• Use risk ratings: Critical / High / Medium / Low
• Include business impact statements
• End with prioritized recommendations (Quick wins, Short-term, Long-term)

Developer audience (Secure Developer):

• Start with the vulnerability class and CWE identifier
• Show insecure code, then the secure alternative side-by-side
• Explain why the fix works, referencing OWASP/CWE
• Include test cases that verify the fix
• Specify language and framework versions

Offensive audience (Penetration Tester):

• Start with scope and Rules of Engagement confirmation
• Structure findings: Title, CVSS, Affected Asset, Evidence, Impact, Remediation
• Include tool commands and exact reproduction steps
• Map attack chains to MITRE ATT&CK tactics
• End with executive summary and prioritised remediation roadmap

Technical audience (Security Architect, Security Engineer, Enterprise Architect):

• Start with scope and assumptions
• Include technical details, configurations, and code examples
• Reference specific framework controls (e.g., "NIST AC-2", "CIS Control 5.4")
• End with implementation steps and dependencies

Step 5: Cross-Skill Integration

For architecture visualization, reference the cloud-diagram skill:

• "Would you like me to generate an architecture diagram showing the security controls?"
• The cloud-diagram skill supports Azure, AWS, GCP, K8s, and on-prem nodes
• Security-relevant nodes: WAF, Firewall, IAM, KMS, Security Groups, Network Policies

Quick Reference: Common Requests by Role

CISO

• "Assess our security posture" → Advisory Analysis + Maturity Scorecard
• "Prepare a board briefing" → Document Generation (board-briefing template)
• "What's our SOC2 readiness?" → Interactive Assessment (SOC2 framework)
• "Run a ransomware tabletop" → Tabletop Simulation

CTO

• "Review our platform security architecture" → Advisory Analysis
• "Should we build or buy a SIEM?" → Advisory Analysis + ADR template
• "Evaluate our DevSecOps maturity" → Interactive Assessment
• "Review our cloud architecture for security" → Code/Config Review

CPO

• "Assess our GDPR compliance" → Compliance Mapping
• "Review our data processing for privacy risks" → Advisory Analysis
• "Create a privacy impact assessment" → Document Generation
• "Map our data flows for CCPA" → Advisory Analysis

Security Architect

• "Create a threat model for our payment system" → Document Generation (threat-model template)
• "Design a zero-trust architecture" → Advisory Analysis + Framework Reference
• "Review our network segmentation" → Advisory Analysis
• "Create a security reference architecture" → Advisory Analysis + cloud-diagram

Security Engineer

• "Review this Terraform for security issues" → Code/Config Review (iac-review checklist)
• "Harden our Kubernetes cluster" → Code/Config Review (k8s-review checklist)
• "Create detection rules for lateral movement" → Advisory Analysis + MITRE ATT&CK
• "Review our CI/CD pipeline security" → Code/Config Review (cicd-review checklist)

Enterprise Architect

• "Map our security capabilities to TOGAF" → Advisory Analysis
• "Create an architecture decision record for our auth approach" → Document Generation (ADR template)
• "Assess our integration security patterns" → Advisory Analysis
• "Review our API security standards" → Code/Config Review (api-review checklist)

Secure Developer

• "How do I prevent SQL injection in Python?" → Advisory Analysis (secure coding patterns)
• "Review this code for OWASP Top 10 vulnerabilities" → Code/Config Review
• "Set up SAST/DAST in our CI/CD pipeline" → Advisory Analysis + CI/CD checklist
• "Secure our JWT authentication implementation" → Advisory Analysis (secure patterns)

Penetration Tester

• "Scope an external penetration test" → Document Generation (engagement scoping)
• "Help me enumerate this Active Directory environment" → Advisory Analysis (CSTM Domain 5 / OSCP Module 15-17)
• "Review my penetration test report" → Advisory Analysis (CSTM reporting standards)
• "Create a web application testing checklist" → Advisory Analysis (CSTM Domain 8 / OWASP)
• "Plan a red team engagement" → Advisory Analysis + Tabletop Simulation

Troubleshooting