The first 72 hours of a vulnerability report — without inventing the playbook in real time.
A free 17-question readiness self-assessment, built for startups, founder-CISOs, and small product teams. With it comes a working toolkit: runbooks, communication templates, regulatory decision trees, and worked sample incidents. (PSIRT stands for Product Security Incident Response Team.) The assessment runs in your browser. Your answers never leave your device.
Three tiers — one for individuals, one for small product teams, one for enterprise PSIRT functions.
- 17-question assessment with expert annotations on every question
- Solo Practitioner Toolkit (10 reference PDFs)
- PSIRT Five Commandments poster
- Startup First-Report sample incident
- Customer Trust Page templates
- 17-question assessment with full remediation roadmap
- PSIRT Response Playbook and First-72-Hours Runbook
- Stakeholder Communication Template Library
- Regulatory Notification Decision Tree
- Coordinated-disclosure in-depth playbook
- Three worked sample incidents (~200 pages total)
- Everything in SMB
- Role-based assessment views for analysts, leads, engineering, legal, and executives
- Tabletop scenario generator and sector overlays
- Multi-country regulatory reference, plus a cyber-insurance and liability playbook
- Forensics and evidence preservation; bug-bounty operations manual
- PSIRT for AI systems, plus AI-assisted PSIRT operations
- Excel calculators for incident cost, review trends, and readiness tracking
- Quarterly board-briefing slide deck
- Single-organisation licence. A consultant licence is available on request.
Two paths into the toolkit.
1. Take the free assessment
17 questions across Governance, Technical, and Communication readiness. About five minutes. Returns a scored snapshot of how prepared you are to receive and handle a vulnerability report, before one arrives. Runs in your browser — no email required, no data transmitted.
Take the free assessment →2. Download the free Vulnerability Disclosure Policy template
A working policy you can customise and publish on your security page, including safe-harbor language, scope, and a stated response Service-Level Agreement. Have it reviewed by qualified legal counsel before you publish.
Get the free VDP template →