Free vCISO skills, MIT licensed.

Security work is increasingly sitting next to engineering work in AI agent contexts. Engineering teams that have a SOC 2 audit on the calendar are already using Claude Code or Cursor to draft architecture changes, refactor terraform, and review pull requests. The same agents can answer security questionnaire fields, draft policy edits, and surface compliance evidence if you give them the right tools. Most do not have those tools yet.

We build these skills because we use them on real engagements. The Scorecard came out of a pattern we ran on every Sprint kickoff: 20 questions across the Trust Services Criteria, scored, with a prioritized remediation list. Productizing it as a free tool was the obvious move. The same is true of the policy template kit, the threat-informed baseline generator, and the questionnaire responder. Each one solves a specific problem we have hit on dozens of engagements.

Everything ships MIT licensed. No registration, no email gate, no telemetry. The retainer business does not depend on artificial scarcity around tools. It depends on senior practitioners doing the work that automation cannot. The tools amplify the human work; they do not replace the call.