Selected builds
ICS Vendor CVE Dashboard
Tracks recently disclosed vulnerabilities for major ICS/OT vendors (Siemens, Schneider Electric, Rockwell, ABB, Honeywell, and more). A GitHub Action pulls fresh data from the National Vulnerability Database once a day and commits it as static JSON — no client-side API calls, so nothing to rate-limit or block.
Interactive Purdue Model Explainer
Click through all 7 layers of the Purdue Enterprise Reference Architecture — the backbone of how IEC 62443 defines security zones and conduits — on a live animated network-diagram background. Run any of 9 simulated attack paths, including 6 real documented incidents (Stuxnet, the 2015 Ukraine power grid attack, TRITON/TRISIS, Colonial Pipeline, Oldsmar, and Aliquippa), each cited to its public source.
ISMS Toolkit — ISO/IEC 27001:2022
A free, self-contained toolkit for building an Information Security Management System against ISO/IEC 27001:2022 — eleven documents covering the full Plan-Do-Check-Act cycle, from gap assessment through all 93 Annex A controls to management review. Available as an interactive single-file web app (data never leaves your browser), plain Markdown templates, or downloadable Excel/Word files — no account, no server required.
SOC Lab — Wazuh + DVWA Detection Engineering
A self-hosted SOC lab documented as a real build log, not just a dashboard screenshot: standing up Wazuh as a SIEM, attacking a deliberately vulnerable app (DVWA), and finding — then fixing — an actual detection gap (a successful SQL injection Wazuh's default ruleset never flagged) and an actual false positive in the custom rule written to close it. 14 custom rules, each tagged to MITRE ATT&CK.
OT Security Lab — Crude Storage Unit
A simulated PLC-controlled crude oil storage tank, attacked live via Metasploit over Modbus/TCP: a single unauthenticated register write silently disables the safety interlock while the tank overflows. The HMI cross-checks the PLC's own alarm state against an independent physical reading in real time — built to demonstrate exactly why that kind of independent verification matters.
// More projects (secure CI/CD pipeline template, ICS honeypot deployment) coming soon.