PROJECTS

Selected builds

LIVE TOOL ACTIVE

ICS Vendor CVE Dashboard

Tracks recently disclosed vulnerabilities for major ICS/OT vendors (Siemens, Schneider Electric, Rockwell, ABB, Honeywell, and more). A GitHub Action pulls fresh data from the National Vulnerability Database once a day and commits it as static JSON — no client-side API calls, so nothing to rate-limit or block.

NVD APIPythonGitHub ActionsChart.js
INTERACTIVE / TEACHING ACTIVE

Interactive Purdue Model Explainer

Click through all 7 layers of the Purdue Enterprise Reference Architecture — the backbone of how IEC 62443 defines security zones and conduits — on a live animated network-diagram background. Run any of 9 simulated attack paths, including 6 real documented incidents (Stuxnet, the 2015 Ukraine power grid attack, TRITON/TRISIS, Colonial Pipeline, Oldsmar, and Aliquippa), each cited to its public source.

Vanilla JSCanvasNo dependenciesIEC 62443
LIVE TOOL / TEMPLATES ACTIVE

ISMS Toolkit — ISO/IEC 27001:2022

A free, self-contained toolkit for building an Information Security Management System against ISO/IEC 27001:2022 — eleven documents covering the full Plan-Do-Check-Act cycle, from gap assessment through all 93 Annex A controls to management review. Available as an interactive single-file web app (data never leaves your browser), plain Markdown templates, or downloadable Excel/Word files — no account, no server required.

Vanilla JSNo backendISO/IEC 27001Excel · Word · Markdown
HANDS-ON LAB / WRITE-UP ACTIVE

SOC Lab — Wazuh + DVWA Detection Engineering

A self-hosted SOC lab documented as a real build log, not just a dashboard screenshot: standing up Wazuh as a SIEM, attacking a deliberately vulnerable app (DVWA), and finding — then fixing — an actual detection gap (a successful SQL injection Wazuh's default ruleset never flagged) and an actual false positive in the custom rule written to close it. 14 custom rules, each tagged to MITRE ATT&CK.

WazuhDockerDVWAMITRE ATT&CK
HANDS-ON LAB IN PROGRESS

OT Security Lab — Crude Storage Unit

A simulated PLC-controlled crude oil storage tank, attacked live via Metasploit over Modbus/TCP: a single unauthenticated register write silently disables the safety interlock while the tank overflows. The HMI cross-checks the PLC's own alarm state against an independent physical reading in real time — built to demonstrate exactly why that kind of independent verification matters.

Modbus/TCPMetasploitPLC SimulationHMI

// More projects (secure CI/CD pipeline template, ICS honeypot deployment) coming soon.