Built by security professionals
Cyber Affinity builds practical tools that solve real business, IT, and security problems — turning the work that lives in spreadsheets, inboxes, and meetings into clear answers and next steps.
Built around the problems leaders run into every week — costs nobody has calculated, vendors nobody has vetted, renewals nobody saw coming. Our tools run in your browser, so nothing you type is sent to us unless you turn on a feature that needs it, such as encrypted sync, and even then we can't read it. Tools in the same group pass data to each other in your browser, so you rarely type anything twice. Tools marked Early access need an access code, which you can request below.
Map what you have, measure it, track the risks, and report to leadership.
How they connect: Defense Stack Map NIST CSF Assessment Risk Register Board Update
Type or paste the security tools and processes you run and see them placed on your layers of protection, on-prem and cloud, scored against the CIS Controls minimum baseline. Export a slide for your next leadership meeting.
A plain-English NIST CSF 2.0 self-assessment: 22 categories in 15 minutes, or all 106 subcategories in detail. Target profiles, tiers, a 30/60/90-day action plan, progress snapshots and a printable report.
Drop in a Tenable, Rapid7, or Qualys scan export and see which findings attackers actually exploit, using CISA KEV and EPSS, plus how long each one has been open. Up to 1,000 assets per analysis. Your scan data never leaves your browser.
Skip the blank spreadsheet: pick your industry for a starter list of common business, IT, and security risks, then score them, assign owners, and see your heat map.
Turn your security metrics, top risks, and asks into a one-page update your board will actually read — with trends and status against targets calculated for you.
Plain-English starter policies — acceptable use, passwords and MFA, remote work, incident reporting, data handling, and more — tailored to how your organization works.
Estimate how much log data your SIEM will take in each hour, day, week and month. Start from typical numbers, or measure your own machines with free read-only scripts, then see peaks, storage, cost, and what filtering saves.
Watch for threats, plan your response, practise it, and run it when it's real.
How they connect: IR Plan Tabletop Incident Log
A security analyst's daily workspace: a morning briefing of exploited vulnerabilities in the products you run, patch triage, email and phishing analysis, file checks, and IOC lookups. Emails and files never leave your browser.
Build a practical, printable incident response plan — who does what, who to call, first steps and playbooks — with a one-page quick-reference card.
Run an incident response drill without hiring a consultant: pick a scenario and audience, and get timed scenario updates, role-based questions, a live facilitator mode, and an after-action template.
Document a security or IT incident from first report to closure — timeline, phase checklists, evidence, notifications, and costs — then print a finished incident report.
Put a dollar figure on an outage — revenue at risk plus lost productivity — to justify resilience spend in terms finance understands.
Choose vendors well, check their risk, and keep renewals and expiring items from surprising you.
How they connect: Requirements Vendor Scorecard Vendor Risk Renewal Radar Software Overlap
Compare vendors against weighted criteria and must-haves, see how clear the winner really is, and print a decision record with your rationale.
Answer eight questions about a new vendor and get a risk tier, the evidence to ask for, and how often to review them — before you sign.
See every subscription's renewal date, notice deadline, and annual cost in one view, send the deadlines to your calendar, and stop paying for auto-renewals nobody wanted.
Find duplicate and overlapping software subscriptions, choose what to keep, and see estimated savings lined up with your renewals.
Track every certificate, secret, and key that can expire and break something — with an owner, a backup, and a renew-by date — and send the reminders to your calendar.
Keep approved answers in one library, then paste a customer's questionnaire and get the best match for every question — so sales stops waiting on IT for the same 200 answers.
Capture what's needed, plan it, staff it, report on it, and decide what to do today.
How they connect: Requirements PM Lite Status Report
More to do than hours in the day? Drop in your tasks, tickets, and requests, and FirstUp ranks what to work on first, fits it to the time you actually have, and shows why. Nothing is saved or uploaded.
Capture what's actually needed before anyone builds or buys anything — for an app, a business problem, a project, a process change, or a vendor decision. Get quality checks, an interview kit, and a clean document, then turn it into a project plan.
Plan a project end to end — scope, tasks, phases, and a timeline — with health and progress calculated for you. Free, no account, and it upgrades straight into the full Affinity PM.
A clear weekly update in five minutes: overall status with a reason, accomplishments, next steps, risks, and asks — or pull it straight from your Affinity PM Lite project.
See who's over- or under-allocated across your projects week by week, and try changes before you commit to them.
Turn an idea or purchase into a one-page business case with the numbers finance asks for: total cost, benefits, ROI, payback, and NPV — risk-adjusted.
From hiring to a person's last day: onboarding, goals, one-on-ones, coverage, on-call and offboarding.
How they connect: Hiring Kit Onboarding SMART Goals 1:1 Prep Offboarding
Write a clear, inclusive job description and give every interviewer the same questions and scorecard, then compare candidates on evidence.
Give new hires a clear first 90 days: a prep checklist, goals for each phase, scheduled check-ins, and a printable welcome handout.
Turn "improve security awareness" into a goal someone can actually finish. Guided prompts, a letter-by-letter check, examples by role, and a printable goal sheet.
Run better one-on-ones and write reviews that don't depend on memory: carry action items forward, pick good questions, and pull evidence from your notes at review time.
Map who owns each system and who backs them up, rate skills, and assess retention risk — then print a report that shows leadership your single points of failure.
Build a fair on-call schedule around time off and holidays, see who's carrying the load, and put a number on what on-call costs.
When someone leaves, get the right ordered checklist for their systems, exit type, and risk, track every account and device until access is gone, and print a signed-off record.
See what a recurring meeting really costs per year, test what-ifs like a shorter slot or a smaller invite list, or run a live cost meter while it happens.
For anyone who's been phished, scammed or had their identity stolen: a step-by-step plan, the official contacts, a contact log and dispute letters. Share them with family, friends and staff.
How they connect: Scam & Phishing Recovery Identity Theft Recovery
Clicked a link, gave away a password, let a "support" caller onto your computer, or sent money? Tick what happened and get an ordered plan: what to do in the next hour, today and this week.
Someone opened accounts, filed taxes or used your benefits in your name? Freeze your credit, file the FTC report, fix your credit reports, and send ready-made dispute letters, with a log of every call.
For problems that span a whole security program, operations, project portfolio, or team.
Procedures, playbooks & operational documents
Write, approve and run the procedures your team depends on, with a professional, branded result every time and an auditable record of each run.
Security posture & program management
Assess your security program against the NIST Cybersecurity Framework (CSF) 2.0, back it with evidence, and turn gaps into tracked findings and remediation.
Portfolio, program & project management
Run every project in one place: group them into programs and portfolios, see health across all of them, and send status reports that fill themselves in.
Team leadership for technical managers
One workspace for what managers track outside the tickets: goals, performance notes, career growth, tools, budget, and the quarterly leadership report.
Cyber Affinity is built by security and IT leaders with hands-on experience running security programs, leading architecture and engineering teams, and taking organizations through PCI DSS, SOC 2, SSAE 16, and CMMC audits.
Every tool starts with a real problem we've had to solve ourselves — and ends with something you can act on, or take straight to a decision-maker.
Be first to try new tools and platforms. Tell us what you're interested in and we'll be in touch.