Results for “mapping”

Conducts comprehensive inventory of protected health information across the enterprise per HIPAA Security Rule requirements at 45 CFR §164.308(a)(1)(ii)(A) and §164.310(d). Covers identification of all ePHI repositories, data flow mapping, classification of PHI by sensitivity, and integration with risk analysis. Keywords: PHI inventory, ePHI, data mapping, information asset, data flow, HIPAA risk analysis, designated record set.

Reviews local branch changes for bugs, security vulnerabilities, and code quality issues using a structured checklist and attack surface mapping.

Audits codebases against HIPAA Security Rule safeguards, mapping findings to 45 CFR sections and tracing PHI data flows.

Entry P1 category router for reconnaissance and methodology. Use when mapping scope, discovering assets, fingerprinting technology, building endpoint inventory, and choosing the first high-value security testing path.

Reviews Django codebases for access control vulnerabilities and IDOR by tracing authorization flows, mapping attack surfaces, and reporting confirmed gaps with enforceable fixes.

Automate OSINT collection using SpiderFoot REST API and CLI for target profiling, module-based reconnaissance, and structured result analysis across 200+ data sources.

Map MITRE ATT&CK coverage to identify detection gaps, prioritize rule development, and measure SOC detection maturity against adversary techniques.

Conducts a GDPR data audit covering personal data mapping, lawful basis assessment, consent management, data retention policies, DSAR processes, and cross-border transfer compliance.

Applies ISO/IEC 42001 to establish, audit, or certify an AI Management System, mapping controls to clauses 4-10 and producing governance plans.

Implement technical and organizational measures required by GDPR, including data mapping, DPIAs, data subject rights management, breach notification, and cross-border transfer mechanisms.

Analyzes npm packages by fetching registry metadata, evaluating bundle size via the bundlephobia API, checking security advisories with npm audit, and mapping dependency trees using arborist.

Configure Okta as a SAML 2.0 Identity Provider and implement SP-initiated and IdP-initiated SSO flows with attribute mapping, assertion encryption, and security hardening.

Surface every assumption embedded in a plan, strategy, or document, assess how critical and how validated each one is, and identify which ones to test first. Load when the user asks to map assumptions, surface hidden beliefs, find what must be true for this to work, run an assumption audit, or when deep-thinking diagnoses an assumption frame. Also triggers on "what are we assuming", "what must be true for this to work", or "find the untested beliefs". Based on David Bland and Alex Osterwalder's assumption mapping method from Testing Business Ideas.

Analyze git repositories to build a security ownership topology mapping people to files, compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization.

Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization.

Maps an organization's external attack surface using public sources like DNS records, certificate transparency logs, search engines, social media, and data breach databases, without directly interacting with target systems.

Analyzes prompt injection, retrieval poisoning, memory contamination, planner drift, and tool-boundary abuse in agentic systems, mapping trust boundaries and proving exploit chains.

Applies the Sarbanes-Oxley Act to assess financial-reporting integrity and IT general controls, mapping executive certification and internal-control areas to auditable evidence for public companies.

Prepare for SOC 2 audits by mapping Trust Service Criteria, building control matrices, collecting audit evidence, performing gap analysis, and assessing Type I vs Type II readiness.

Assess cloud infrastructure for security misconfigurations, IAM privilege escalation paths, S3 public exposure, open security group rules, and IaC security gaps across AWS, Azure, and GCP with MITRE ATT&CK mapping.

Runs a six-phase security audit covering attack-surface mapping, STRIDE/PASTA threat modeling, technical checklists, red/blue team exercises, and a final verdict, plus incident-response and monitoring guidance.

Runs a structured security audit across six phases: attack-surface mapping, STRIDE/PASTA threat modeling, technical checklists, red/blue team analysis, and a final verdict, with optional Python automation scripts.

Assess AI/ML systems for prompt injection, jailbreak vulnerabilities, model inversion risk, data poisoning exposure, and agent tool abuse, with MITRE ATLAS mapping and guardrail recommendations.

Assesses cloud infrastructure for security misconfigurations, IAM privilege escalation paths, S3 public exposure, open security group rules, and IaC security gaps across AWS, Azure, and GCP with MITRE ATT&CK mapping.

Map threat actor behavior to the MITRE ATT&CK framework, build technique coverage heatmaps, identify detection gaps, and produce actionable intelligence reports.

Runs a structured 6-phase security audit covering attack-surface mapping, STRIDE/PASTA threat modeling, technical checklists, red/blue team exercises, and a final verdict, plus incident-response and monitoring playbooks.

Map advanced persistent threat (APT) group tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework using the ATT&CK Navigator and attackcti Python library.

Runs an evidence-first, read-only workflow over large codebases via an external JSONL REPL server, retrieving only minimal file slices and greps to produce cited architecture and audit reports.

Performs a white-box source code security review structured around OWASP ASVS 5.0, mapping attack surfaces, tracing data flows, and chaining into downstream penetration testing and threat modeling skills.

Audits codebases for GDPR and CCPA/CPRA compliance by inventorying PII fields, mapping data collection points, reviewing consent mechanisms, verifying data subject rights, tracing third-party data sharing, and checking retention policies.