Frameworks & Standards
Named, publicly maintained frameworks and standards: prioritization lists and control catalogs that shape how security work gets scoped and communicated. Not a legal requirement by themselves; see Compliance & Regulations for the regimes that are.
Cybersecurity Frameworks & Standards
A map of the major frameworks referenced across this site, what problem each one actually solves, and how they relate to each other.
MITRE ATT&CK
What MITRE ATT&CK actually catalogs, how tactics and techniques differ, and why it's the shared vocabulary behind every attack-technique page on this site.
The CIS Critical Security Controls
A prioritized, actionable list of specific technical safeguards, and how it differs from a broader risk-management framework like NIST CSF.
The NIST Cybersecurity Framework (CSF)
Why the NIST CSF is a way of organizing a security program rather than a checklist of specific technical controls, and how organizations actually use it.
The OWASP Top 10
What the OWASP Top 10 actually is, how it gets built from real data, and how to use it without treating it as a complete checklist.
The OWASP Top 10 for LLM Applications
The risk categories specific to applications built on large language models, and how they differ from both traditional AppSec risks and general AI safety concerns.
The SANS/CWE Top 25
How the SANS Top 25 differs from the OWASP Top 10, why it's built directly from real vulnerability and exploit data, and when to reach for one list over the other.