Free tools for security awareness practitioners

Pick a framework (PCI DSS 4.0, HIPAA, NIS2, DORA, CMMC, GLBA, NIST 800-171 and more) and see its security awareness and training obligations in plain English, with audit evidence and SEAT pillar mapping.

Build a defensible business case with the math shown. Enter incident frequency, cost, expected reduction, and program spend to get a cost-versus-risk estimate you can take to a CFO.

How many people a program actually needs, grounded in the SANS benchmark of about 4.2 FTE for a mature program. Enter headcount and ambition, see the staffing gap you are carrying.

Eight quick questions across the four SEAT pillars return a directional maturity level, from Reactive to Embedded, and show your weakest pillar. A fast snapshot before the full assessment.

Measure your program across Strategy, Engage, Assess, and Train. Get a maturity baseline showing where investment reduces the most risk. 26 questions, no account needed.

Generate a structured third-party risk assessment for vendors and suppliers, aligned to the human-risk questions that frameworks like NIS2 and DORA now require.

An independent, practitioner-maintained map of the human risk management market: vendor positioning, funding, categories, and an honest practitioner take on each.

A focused board of security awareness, human risk, and security culture roles, refreshed daily. The only job board built specifically for this discipline.

An open, vendor-agnostic reference for building your own phishing triage workflow: severity scoring, reference architecture, and SOC integration patterns.