uShield
Cyber Security
Payments fell to $820 million in 2025 even as attack volume hit a record in Q3 2026. When encryption stops paying, the business model does not die — it moves to the data, and to the sectors least able to absorb a leak.
Read More
A tabletop exercise that ends with a pleasant discussion and no changed documents was theater. Here is how to run drills that produce artifacts — and why the communications plan is usually the first thing to fail.
Read MoreThe current NIST incident-response guidance, published in April 2025 as a CSF 2.0 Community Profile. It supersedes Rev. 2 and frames incident response across the CSF functions (Govern, Identify, Protect, Detect, Respond and Recover) rather than the older four-phase lifecycle.
A comprehensive, living knowledge base of adversary tactics and techniques. In 2026, it is used to map observed attacker behavior during an incident to known threat actor groups and remediation playbooks.
StrangeBee's commercial case-management platform for SOC, CSIRT and CERT teams. It covers alert triage, investigation, collaboration and reporting, with MISP and MITRE ATT&CK integration and 300+ connectors. TheHive was open source until 2021, when distribution moved to a commercial model.
An open-source SOAR platform that allows IR teams to automate repetitive tasks (like blocking an IP in a firewall or resetting a password) using a visual workflow builder.
A state-of-the-art digital forensics and incident response (DFIR) tool. It enables surgical precision when collecting forensic artifacts from thousands of remote endpoints simultaneously.
An open-source platform for sharing, storing, and correlating Indicators of Compromise (IoCs). It allows organizations to share threat data with peers to prevent the spread of a localized attack.
An open-source tool for collaborative forensic timeline analysis. It allows multiple investigators to analyze logs and system artifacts together to reconstruct the sequence of a breach.
Highly structured operational procedures for conducting cybersecurity incident and vulnerability response. Essential for organizations aligning with federal compliance standards.
SANS's library of printable security posters and cheat sheets, including incident-response references for memory forensics, DDoS response and quick-look intrusion discovery on Windows and Linux.
Published in 2006 and still current, this guide covers testing IR capabilities through tabletop exercises, functional drills and full-scale simulations. Rehearsing the plan is what keeps a real event from turning into improvisation.
Published in 2016 and still current, this guide focuses on the 'Recover' function: strategies for planning, testing and improving the restoration of data and systems after a destructive cyber event.
An open-source, collaborative incident-response platform. Cases, timelines, evidence and shared war rooms sit in one workspace, with MISP, VirusTotal and SIEM integrations, and it can be self-hosted on your own infrastructure.
The reference framework for memory forensics, rewritten for Python 3. It analyses a RAM image for running processes, network connections, injected code and cached credentials, which is often the only evidence left once malware has removed its files. Released under the Volatility Software License.