Security Program Pillars Templates
The CISO Marketplace AI Security Department pillars, rebuilt as open-source DIY guides — the real architecture we run, written so you can build it on your own estate, with the managed version available if you would rather not
Phase 0 — The Enterprise AI Risk Assessment
The front-door methodology: map the whole AI and security footprint — sanctioned and shadow — against the frameworks that matter, then produce a current-state map, a future-state design, and a sequenced six-pillar build plan. Scoped assessment, not a build guide.
The Operator's Manual — C2 Command Layer
The capstone above all six pillars: one seat that conducts the whole department. Intake from four employee doorways, visible approval gates, one living risk register, and observability into every AI channel — with the agent layer and MCP wiring that runs it.
Pillar 05 — The Incident Response Operating System
An operating system for the worst day — the right people in one room, on one clock, with 90% of the hardest choices already made. Built on NIST 800-61 Rev. 3, with the offline runbook, the notification clocks and a ready-to-run tabletop.
Pillar 04 — The AI-SOC Operating System
Read every alert, resolve the routine, escalate only what needs a human. A reducer that overlays your existing SIEM, EDR, identity and cloud — human-gated, auditable, and capped at an autonomy level you can defend.
Pillar 01 — The Compliance Operating System
Map controls once, satisfy every framework. A continuous, registry-driven compliance program across SOC 2, ISO 27001, HIPAA, PCI, CMMC, DORA and NIS2 — plus the ISO 42001 and EU AI Act layer most guides still omit.
Pillar 01 Companion — The Living ISMS
The database behind the control register. A homegrown ISMS with automatic evidence decay, an eleven-prompt agent layer and an MCP interface — the engineered companion to Pillar 01. Ships with the schema, the prompt library and all eleven JSON Schemas.
Pillar 06 — The Fractional CISO Operating System
The capstone hub: a human-owned register that aggregates every security stream into board-legible, quantified risk. The 2026 pricing ladder, the first 90 days, the five-page board deck, and the layer the AI vCISO platforms structurally cannot replace.
Pillar 06 Companion — The 2026 AI Risk Register
The register that inventories every AI system, model and agent in your business, classifies it against the 2026 regulatory map, scores it on autonomy and blast radius, and routes remediation to real suppliers. Full schema, five classification rule tables, 41 build prompts.
Pillar 06 Companion — The Enterprise Risk Register
Seed to sale for risk: from the engagement that found it to the purchase order that closes it. Offensive scoping, a coverage matrix that knows what has gone stale, treatment as a budgeted project, and priced solutions with the ROI attached.
Pillar 02 — AI-Augmented DevSecOps Risk Register
Run a continuous, AI-triaged security program across 100+ apps as a solo engineer. Platform-first discovery, SAST/SCA/secrets/DAST, a self-healing risk register, and tiered Claude triage — on free and near-free parts.
Pillar 03 — AI-Augmented PTaaS Lane
An authorized, sandboxed autonomous offense lane that proves bugs — a crashing proof-of-vulnerability or live exploit chain, paired with a candidate patch, under the same register and human gate as Pillar 02. Design-stage guide, published before the build.
Bug-Hunter Automation
The continuous discovery layer between Pillars 02 and 03 — shift-left source analysis, autonomous runtime testing, and a validation gate in the middle that files findings instead of noise. Ten sections, eight working appendices.
C2 Companion — The Operator Node DIY Build
The box the security department runs on. Self-host the living risk register, the ISMS and the evidence vault on one hardened machine — zero inbound, hardware-rooted, on your keys, severable in one step. Ships with the scoping module and the AI data-handling annex as editable templates.
Pillar 04 Companion — The Open SOC Reference Architecture
The open-source SOC diagram everyone shares has two commercial products on it. This is the corrected version — six planes, 24 components with verified licenses and named replacements, an AI analyst plane with a defensible autonomy ceiling, and three sized builds with honest hour counts.
Pillar 04 Companion — SOC in a Box
The Open SOC reference architecture landed on one machine you can hold — a coreboot NUC with the Management Engine disabled, Nitrokey as the root of trust, three disks mapped to three storage tiers, and a 14-test acceptance suite you run before pointing a single agent at it.