Featured pillar
Security Operations
See the event, decide if it matters, act before the queue buries it.
SIEM alternatives, log management, and incident cases sit with SOAR, XDR, and AI SOC. Read the job line on each card before the vendor name.
Categories
Shortlists by the job they do.
Each pillar is a job. The lists under it are the ones we can stand behind today. Public docs, not a vendor roll call.
47lists you can open
18pillars with a list
0empty briefs
On the board
Live pillars
Application Security
The bug is still in your code
Output that was never encoded, a query that trusted a parameter, a session that lived too long.
SAST tools
Identity and Access
Who is in the token
How long it lives, and whether a human still has a permanent privileged role.
Privileged access
Cloud Security
The account, not the VM
If your platform only shows you the host, you are looking at the last place the mistake landed.
CSPM tools
Also on the map
AI Security
Treat model output as untrusted. AI SOC stays under Security Operations.
Endpoint Security
The agent on the box. XDR is the console job.
Web Security
A WAF is the edge. The sink still lives in Application Security.
API Security
REST fuzz on one list. GraphQL bounds on the other.
Cryptography
Name the library you actually link.
Data Security
Find the row you forgot. Privacy fulfills the person.
Email Security
Refuse the lookalike. A gateway is a different door.
GRC and Compliance
Pull evidence again. A policy PDF is not a control.
Network Security
Open one app. A full-tunnel VPN is a flat network.
Supply Chain
Name what you installed. SAST is still your code.
Vulnerability and exposure
List what the internet already sees. Not a pentest.
Privacy
Find the person, then delete. Legal owns the statute.
OT and IoT
Watch a protocol the laptop agent cannot take.
Platform security
Gate the cluster. Cloud is still the account.
