4. Security & Compliance

Conducts automated and manual WCAG 2.2 accessibility audits with remediation guidance for website compliance.

Constructs attack trees to visualize threat paths, identify defense gaps, and communicate security risks to stakeholders.

Maps security threats to appropriate controls and mitigations for prioritizing investments, remediation planning, and control validation.

Enforces production-grade security in Kubernetes clusters via NetworkPolicy, PodSecurityPolicy, and RBAC configurations for network isolation and pod security standards.

Derives security requirements from threat models and business context to create security user stories and test cases.

Enables GDPR-compliant data handling with consent management, data subject rights, and privacy by design for EU personal data systems.

Provides security best practices and vulnerability prevention techniques for Solidity smart contracts, including auditing and secure coding patterns.

Expert in secure mobile coding practices, including input validation, WebView security, and mobile-specific security patterns for implementation and code reviews.

Provides analysis of anti-reversing techniques, obfuscation, and anti-debugging mechanisms for authorized security assessment of protected software.

Analyzes project dependencies for vulnerabilities, license compliance, and outdated packages, providing actionable security remediation strategies.

Coordinates multi-layer security scanning and hardening for applications, infrastructure, and compliance controls to enhance security posture.

Expert threat modeling for security architecture reviews, risk assessment, and secure-by-design planning using STRIDE, PASTA, and attack trees.

Enables packet analysis, protocol dissection, and documentation for security assessment of network communications and proprietary protocols.

Identifies security data sources from platform catalogs to capture behavior defined in structured hunt hypotheses, supporting threat hunt planning.

Synthesizes system internals and adversary research to define a structured, testable security hunt hypothesis for targeted threat investigation.

Researches system internals and adversary tradecraft to inform threat hunting strategies, providing candidate abuse patterns and sources before hypothesis formation.

Consolidates prior security research, tradecraft, and analytics into a structured hunt blueprint without new research or assumptions.

Automates resolution of security vulnerabilities in npm dependencies identified by security scanning tools.

Guides users through security risk assessment workflows including asset identification, threat catalog usage, and scenario generation for risk management.

Guides new users through initial setup of CISO Assistant, including organizational structure, security frameworks, and risk assessment configuration for compliance.

Executes security audit workflow: vulnerability scanning followed by verification of identified issues.

Manages explicit identity propagation across system boundaries to ensure secure and consistent access control in distributed environments.

Automates security audits to identify vulnerabilities and flaws in codebases through systematic code review.

Identifies and exploits SQL injection vulnerabilities in web applications across multiple database systems.