Tech Tree · Security
Security & Compliance Maturity
Advance your security posture from basic hygiene to a verified zero-trust architecture with continuous compliance. Each node represents a concrete security capability with cross-track dependencies that mirror how real organisations layer defences.
Maturity tiers
Basic
Minimum hygiene in place. Known critical vulnerabilities are patched. Credentials are not committed to git.
Hardened
Active defences deployed. Attack surface reduced. Security gates in the delivery pipeline.
Compliant
Formal certification achieved or in progress. Evidence collected continuously. Auditors can be answered confidently.
Zero Trust
No implicit trust. Every request authenticated, authorised, and logged. Blast radius of any breach is contained by policy.
Tracks
AppSec
Security embedded in the software development lifecycle — scanning, testing, and secure coding.
InfraSec
Cloud and on-premise infrastructure hardening, network segmentation, and runtime protection.
Governance
Policies, risk management, certifications, and executive accountability for security.
Identity
Authentication, authorisation, access control, and credential lifecycle management.
All capabilities (17)
Basic
Basic Access Control
All user accounts use strong passwords. Shared credentials are eliminated. Production access is limited to named individuals with a documented need.
access-control · iam · credentials
Dependency Scanning
All third-party libraries are scanned for known CVEs on every pull request. Critical and high vulnerabilities block merge. A remediation SLA is defined and tracked.
dependencies · cve · sca · supply-chain
Infrastructure Hardening Baseline
Cloud accounts are configured to a security baseline. Public S3 buckets and open security groups are eliminated. Logging is enabled across all cloud services.
cloud-security · hardening · logging · cspm
Secrets Management
No secrets in source code, environment variables checked into git, or Slack. All credentials are rotated on a schedule and retrieved from a secrets manager at runtime.
secrets · credentials · vault
Security Policy
A written information security policy exists, is approved by leadership, and is communicated to all employees annually. It defines acceptable use, incident response, and data classification.
policy · governance · compliance · training
Hardened
MFA Everywhere
Multi-factor authentication is mandatory for all user-facing systems, cloud consoles, VPN, and privileged accounts. Phishing-resistant MFA (FIDO2) is required for administrative access.
mfa · identity · authentication · phishing-resistant
Network Segmentation
Production, staging, and development environments are in separate VPCs with no lateral connectivity. Databases are in private subnets with no internet-accessible endpoints.
network-segmentation · vpc · isolation
Risk Register
A maintained risk register captures known security risks with likelihood, impact, owner, and treatment plan. The register is reviewed quarterly by the CISO or CTO.
risk-management · threat-modelling · governance
Static Application Security Testing
SAST tools analyse source code on every pull request, surfacing injection vulnerabilities, insecure patterns, and misconfigurations before code reaches production.
sast · code-scanning · appsec · devsecops
Compliant
GDPR Compliance
Data protection impact assessments, a data processing register, and privacy-by-design practices are in place. Subject access request and right-to-erasure workflows are tested and operational.
gdpr · privacy · data-protection · compliance
Penetration Testing
Annual third-party penetration tests cover external attack surface, application layer, and internal network. Critical findings are remediated within 30 days and re-tested.
pen-testing · external-testing · appsec
Privileged Access Management
Privileged access to production is time-limited, just-in-time, and fully audited. No standing admin privileges exist in production environments.
pam · privileged-access · identity · jit
SOC 2 Certification
SOC 2 Type II report obtained, covering Security, Availability, and Confidentiality trust service criteria. Evidence is collected continuously, not scrambled at audit time.
soc2 · certification · audit · compliance
Zero Trust
Continuous Compliance
Compliance posture is monitored in real time. Policy violations trigger automated alerts and, where possible, automated remediation. Auditors can be given a dashboard instead of a spreadsheet.
continuous-compliance · policy-as-code · governance · automation
DevSecOps Pipeline
Security is embedded at every stage of the delivery pipeline. SAST, DAST, SCA, IaC scanning, and container image scanning all gate production deployments automatically.
devsecops · pipeline · dast · container-security
Identity Governance & Administration
The full lifecycle of every human and machine identity is managed and audited — from joiners and movers to leavers. Access is reviewed quarterly and certifications are automated.
iga · identity-governance · lifecycle · provisioning
Zero Trust Architecture
Network perimeter is eliminated as a trust boundary. Every request — internal or external — is verified, least-privileged, and logged. Lateral movement after compromise is contained.
zero-trust · micro-segmentation · spiffe · policy