Skip to content
AI Security
29 HANDS-ON PLAYBOOKS

Learn the tools by using them, not by reading their brochures.

Each playbook goes past the free explainer: how the tool works underneath, a guided lab, recipes you can copy, a 90-day rollout runbook, the failures you will hit, and an interview drill. Code samples are tested, and facts are checked against the vendor's documentation or source on the date shown on each page.

See Premium Read a free playbook first

Code security: SAST, SCA and IaC scanning

ASPM PLATFORMS: APIIRO, OX SECURITY AND CYCODEPREMIUM · 50 MIN
ASPM Playbook: Cycode, OX Security and Apiiro in Practice, From Connectors and CI Gates to Deduplication and Ownership
A hands-on application security posture management guide built from the vendors' public CLIs and docs: least-privilege source control connectors, CI gates that fail the way you intend, reviewable exclusions, deduplication you can reason about, owner routing with fallbacks, and an evaluation checklist.
CHECKOVPREMIUM · 50 MIN
Checkov Playbook: Scan IaC, Baseline Legacy Debt, Write Custom Policies and Gate CI
A hands-on Checkov deep dive: scan a deliberately flawed Terraform project locally, read and fix results, baseline an existing repository, suppress with reasons, write YAML attribute and connection policies, gate pull requests and roll it out across many repositories.
CORTEX CLOUD (PRISMA CLOUD)PREMIUM · 50 MIN
Cortex Cloud Playbook: API Keys, Staged Onboarding, the Issues API, XQL and the Cortex CLI in Pipelines
A hands-on Cortex Cloud guide checked against Palo Alto Networks' public documentation and API schemas: Standard versus Advanced keys, onboarding in onboard-only mode without tripping its one-way switch, Issues API filters that validate, XQL within quota, CLI scans with the right key, and health alerts for silent gaps.
GITHUB ADVANCED SECURITYPREMIUM · 60 MIN
GitHub Advanced Security Playbook: Org Rollout, CodeQL Tuning, Custom Patterns and Alert Triage
A hands-on GitHub Advanced Security deep dive: roll out with security configurations, tune CodeQL with a config file and query filters, add third-party SARIF without overwriting results, publish custom secret patterns after a dry run, set up delegated bypass, gate dependencies, and triage alerts through the REST API.
SEMGREPPREMIUM · 60 MIN
Semgrep Playbook: Write, Test and Ship Your Own Security Rules
A hands-on Semgrep deep dive: turn a real bug into a pattern rule and a taint rule, test both with annotated files, add an autofix, control what gets scanned, gate pull requests with SARIF, and run a rule programme that developers trust. Every rule on this page was run with semgrep --test.
SNYKPREMIUM · 55 MIN
Snyk Playbook: Monorepo Scans, CI Gates, Exceptions That Expire and a Pinned Pipeline
A hands-on Snyk deep dive: authenticate to the right region, test a monorepo across open source, code, containers and IaC, write a gate that fails only on fixable issues, manage exceptions in .snyk without making them permanent, monitor releases with project attributes, and pin the CLI in GitHub Actions.
TRIVYFREE · 60 MIN
Trivy Playbook: Scan Images and Code, Gate CI, Manage Exceptions and Run It Safely
A hands-on Trivy deep dive: scan an image, a repository and a Kubernetes manifest locally, build a CI gate developers accept, manage exceptions with expiry and VEX, generate and rescan SBOMs, write a custom Rego check, run offline, and pin the action after the 2026 compromise.
WIZPREMIUM · 55 MIN
Wiz Playbook: Shift-Left Gates, Admission Control, Issue APIs and Running a CNAPP Day to Day
A hands-on Wiz deep dive built from Wiz's public charts, plugin and integration code: authenticate the Wiz CLI in CI, roll out the admission controller safely in audit mode, verify chart signatures, pull and triage Issues through the GraphQL API, split service accounts by job, and run a CNAPP programme people trust.

Secret scanning

ASPM PLATFORMS: APIIRO, OX SECURITY AND CYCODEPREMIUM · 50 MIN
ASPM Playbook: Cycode, OX Security and Apiiro in Practice, From Connectors and CI Gates to Deduplication and Ownership
A hands-on application security posture management guide built from the vendors' public CLIs and docs: least-privilege source control connectors, CI gates that fail the way you intend, reviewable exclusions, deduplication you can reason about, owner routing with fallbacks, and an evaluation checklist.
GITGUARDIANPREMIUM · 50 MIN
GitGuardian Playbook: ggshield in Hooks and CI, Config as Code, the Incident API and Running Secret Remediation
A hands-on GitGuardian guide checked against ggshield 1.56.1 source and the public API spec: layer hooks, CI and pre-receive checks, know the exit codes and coverage gaps, write a reviewed .gitguardian.yaml, pull and triage incidents by validity, and run revocation-first remediation.
GITHUB ADVANCED SECURITYPREMIUM · 60 MIN
GitHub Advanced Security Playbook: Org Rollout, CodeQL Tuning, Custom Patterns and Alert Triage
A hands-on GitHub Advanced Security deep dive: roll out with security configurations, tune CodeQL with a config file and query filters, add third-party SARIF without overwriting results, publish custom secret patterns after a dry run, set up delegated bypass, gate dependencies, and triage alerts through the REST API.
SEMGREPPREMIUM · 60 MIN
Semgrep Playbook: Write, Test and Ship Your Own Security Rules
A hands-on Semgrep deep dive: turn a real bug into a pattern rule and a taint rule, test both with annotated files, add an autofix, control what gets scanned, gate pull requests with SARIF, and run a rule programme that developers trust. Every rule on this page was run with semgrep --test.
SNYKPREMIUM · 55 MIN
Snyk Playbook: Monorepo Scans, CI Gates, Exceptions That Expire and a Pinned Pipeline
A hands-on Snyk deep dive: authenticate to the right region, test a monorepo across open source, code, containers and IaC, write a gate that fails only on fixable issues, manage exceptions in .snyk without making them permanent, monitor releases with project attributes, and pin the CLI in GitHub Actions.
TRIVYFREE · 60 MIN
Trivy Playbook: Scan Images and Code, Gate CI, Manage Exceptions and Run It Safely
A hands-on Trivy deep dive: scan an image, a repository and a Kubernetes manifest locally, build a CI gate developers accept, manage exceptions with expiry and VEX, generate and rescan SBOMs, write a custom Rego check, run offline, and pin the action after the 2026 compromise.

Application security posture management (ASPM)

ASPM PLATFORMS: APIIRO, OX SECURITY AND CYCODEPREMIUM · 50 MIN
ASPM Playbook: Cycode, OX Security and Apiiro in Practice, From Connectors and CI Gates to Deduplication and Ownership
A hands-on application security posture management guide built from the vendors' public CLIs and docs: least-privilege source control connectors, CI gates that fail the way you intend, reviewable exclusions, deduplication you can reason about, owner routing with fallbacks, and an evaluation checklist.
CORTEX CLOUD (PRISMA CLOUD)PREMIUM · 50 MIN
Cortex Cloud Playbook: API Keys, Staged Onboarding, the Issues API, XQL and the Cortex CLI in Pipelines
A hands-on Cortex Cloud guide checked against Palo Alto Networks' public documentation and API schemas: Standard versus Advanced keys, onboarding in onboard-only mode without tripping its one-way switch, Issues API filters that validate, XQL within quota, CLI scans with the right key, and health alerts for silent gaps.

Cloud security platforms: CSPM and CNAPP

CHECKOVPREMIUM · 50 MIN
Checkov Playbook: Scan IaC, Baseline Legacy Debt, Write Custom Policies and Gate CI
A hands-on Checkov deep dive: scan a deliberately flawed Terraform project locally, read and fix results, baseline an existing repository, suppress with reasons, write YAML attribute and connection policies, gate pull requests and roll it out across many repositories.
CORTEX CLOUD (PRISMA CLOUD)PREMIUM · 50 MIN
Cortex Cloud Playbook: API Keys, Staged Onboarding, the Issues API, XQL and the Cortex CLI in Pipelines
A hands-on Cortex Cloud guide checked against Palo Alto Networks' public documentation and API schemas: Standard versus Advanced keys, onboarding in onboard-only mode without tripping its one-way switch, Issues API filters that validate, XQL within quota, CLI scans with the right key, and health alerts for silent gaps.
MICROSOFT DEFENDER FOR CLOUDPREMIUM · 55 MIN
Microsoft Defender for Cloud Playbook: Posture Reporting, Exposure Graph Hunts and Governance at Scale
A hands-on Defender for Cloud deep dive: report secure score, plan coverage, recommendations and alerts across subscriptions with Azure Resource Graph, hunt attack paths in the exposure graph across Azure, AWS and Google Cloud, assign owners and deadlines with governance rules, and survive the 2026 API changes.
ORCA SECURITYPREMIUM · 45 MIN
Orca Security Playbook: Shift-Left Scans in CI, Sonar Queries, Alert Automation and In-Account Scanning Permissions
A hands-on Orca guide built from Orca's own public code: orca-cli and the IaC action in CI with exit codes and warn mode, Sonar JSON queries that the serving layer accepts, alert lifecycle by API, policy and admission control as Terraform, and a review of the in-account scanner's AWS permissions.
QUALYS VMDRPREMIUM · 50 MIN
Qualys Playbook: Platform URLs, Token Auth, Detection APIs That Page Correctly, QQL and Cloud Agent at Scale
A hands-on Qualys guide checked against Qualys's own documentation: find your platform's API server, authenticate with client credentials, pull detections with the XML and new JSON APIs without silently losing hosts, respect API limits, write QQL that matches what you mean, and roll out Cloud Agent safely.
SENTINELONE SINGULARITYPREMIUM · 50 MIN
SentinelOne Playbook: API Response Actions, Deep Visibility and PowerQuery Hunts, Detection as Code and Safe Exclusions
A hands-on SentinelOne guide built from SentinelOne's own public code: service-user tokens and the v2.1 API, response actions with their exact payloads, asynchronous Deep Visibility and PowerQuery hunts, custom rules as code, exclusions that do not blind the agent, and Kubernetes and Linux agent rollout.
TENABLEPREMIUM · 50 MIN
Tenable Playbook: Export APIs, Agents, Differential Sync and a Fix-First Queue That Survives Rate Limits
A hands-on Tenable guide checked against Tenable's developer reference: least-privilege API users, the three-step export API and its limits, differential exports that close tickets, a KEV and EPSS fix-first queue, agent linking and golden-image hygiene, and a lab you can run with Nessus Essentials.
WIZPREMIUM · 55 MIN
Wiz Playbook: Shift-Left Gates, Admission Control, Issue APIs and Running a CNAPP Day to Day
A hands-on Wiz deep dive built from Wiz's public charts, plugin and integration code: authenticate the Wiz CLI in CI, roll out the admission controller safely in audit mode, verify chart signatures, pull and triage Issues through the GraphQL API, split service accounts by job, and run a CNAPP programme people trust.

Cloud identity and entitlements (CIEM)

CORTEX CLOUD (PRISMA CLOUD)PREMIUM · 50 MIN
Cortex Cloud Playbook: API Keys, Staged Onboarding, the Issues API, XQL and the Cortex CLI in Pipelines
A hands-on Cortex Cloud guide checked against Palo Alto Networks' public documentation and API schemas: Standard versus Advanced keys, onboarding in onboard-only mode without tripping its one-way switch, Issues API filters that validate, XQL within quota, CLI scans with the right key, and health alerts for silent gaps.
CYERAPREMIUM · 40 MIN
Cyera Playbook: DSPM Data Into Your SIEM, Issue Triage by Exposure, and Running a Data Security Programme
A hands-on Cyera guide built from Cyera's own Microsoft Sentinel connector: authentication, the four API objects and their versions, polling limits, a tested de-duplication and triage pipeline, Sentinel hunting queries, and a DSPM rollout that turns findings into owned fixes, honest about what stays behind a login.
ORCA SECURITYPREMIUM · 45 MIN
Orca Security Playbook: Shift-Left Scans in CI, Sonar Queries, Alert Automation and In-Account Scanning Permissions
A hands-on Orca guide built from Orca's own public code: orca-cli and the IaC action in CI with exit codes and warn mode, Sonar JSON queries that the serving layer accepts, alert lifecycle by API, policy and admission control as Terraform, and a review of the in-account scanner's AWS permissions.
SONRAI SECURITYPREMIUM · 45 MIN
Sonrai Playbook: Cloud Permissions Firewall Baselines, SCP Budgets, Permissions on Demand and an Emergency Stop
A hands-on Sonrai Cloud Permissions Firewall guide checked against Sonrai's public documentation and AWS Organizations limits: the documented baseline order, how Protect decides who keeps access, SCP space and the management-account gap, GraphQL reporting, on-demand approvals, and a rehearsed emergency stop.
TENABLEPREMIUM · 50 MIN
Tenable Playbook: Export APIs, Agents, Differential Sync and a Fix-First Queue That Survives Rate Limits
A hands-on Tenable guide checked against Tenable's developer reference: least-privilege API users, the three-step export API and its limits, differential exports that close tickets, a KEV and EPSS fix-first queue, agent linking and golden-image hygiene, and a lab you can run with Nessus Essentials.
WIZPREMIUM · 55 MIN
Wiz Playbook: Shift-Left Gates, Admission Control, Issue APIs and Running a CNAPP Day to Day
A hands-on Wiz deep dive built from Wiz's public charts, plugin and integration code: authenticate the Wiz CLI in CI, roll out the admission controller safely in audit mode, verify chart signatures, pull and triage Issues through the GraphQL API, split service accounts by job, and run a CNAPP programme people trust.

Data security posture management (DSPM)

CORTEX CLOUD (PRISMA CLOUD)PREMIUM · 50 MIN
Cortex Cloud Playbook: API Keys, Staged Onboarding, the Issues API, XQL and the Cortex CLI in Pipelines
A hands-on Cortex Cloud guide checked against Palo Alto Networks' public documentation and API schemas: Standard versus Advanced keys, onboarding in onboard-only mode without tripping its one-way switch, Issues API filters that validate, XQL within quota, CLI scans with the right key, and health alerts for silent gaps.
CYERAPREMIUM · 40 MIN
Cyera Playbook: DSPM Data Into Your SIEM, Issue Triage by Exposure, and Running a Data Security Programme
A hands-on Cyera guide built from Cyera's own Microsoft Sentinel connector: authentication, the four API objects and their versions, polling limits, a tested de-duplication and triage pipeline, Sentinel hunting queries, and a DSPM rollout that turns findings into owned fixes, honest about what stays behind a login.
MICROSOFT DEFENDER FOR CLOUDPREMIUM · 55 MIN
Microsoft Defender for Cloud Playbook: Posture Reporting, Exposure Graph Hunts and Governance at Scale
A hands-on Defender for Cloud deep dive: report secure score, plan coverage, recommendations and alerts across subscriptions with Azure Resource Graph, hunt attack paths in the exposure graph across Azure, AWS and Google Cloud, assign owners and deadlines with governance rules, and survive the 2026 API changes.
ORCA SECURITYPREMIUM · 45 MIN
Orca Security Playbook: Shift-Left Scans in CI, Sonar Queries, Alert Automation and In-Account Scanning Permissions
A hands-on Orca guide built from Orca's own public code: orca-cli and the IaC action in CI with exit codes and warn mode, Sonar JSON queries that the serving layer accepts, alert lifecycle by API, policy and admission control as Terraform, and a review of the in-account scanner's AWS permissions.
WIZPREMIUM · 55 MIN
Wiz Playbook: Shift-Left Gates, Admission Control, Issue APIs and Running a CNAPP Day to Day
A hands-on Wiz deep dive built from Wiz's public charts, plugin and integration code: authenticate the Wiz CLI in CI, roll out the admission controller safely in audit mode, verify chart signatures, pull and triage Issues through the GraphQL API, split service accounts by job, and run a CNAPP programme people trust.

Container and Kubernetes runtime security

AMAZON GUARDDUTYPREMIUM · 65 MIN
Amazon GuardDuty Playbook: Org-Wide Setup, Routing, Safe Tuning and Investigations
A hands-on GuardDuty deep dive: delegate an administrator in every Region, auto-enable protection plans, route findings with EventBridge, export to S3 with KMS, tune with suppression rules that keep attack sequences intact, watch Runtime Monitoring health, and work a credential exfiltration finding end to end.
CORTEX CLOUD (PRISMA CLOUD)PREMIUM · 50 MIN
Cortex Cloud Playbook: API Keys, Staged Onboarding, the Issues API, XQL and the Cortex CLI in Pipelines
A hands-on Cortex Cloud guide checked against Palo Alto Networks' public documentation and API schemas: Standard versus Advanced keys, onboarding in onboard-only mode without tripping its one-way switch, Issues API filters that validate, XQL within quota, CLI scans with the right key, and health alerts for silent gaps.
CROWDSTRIKE FALCONPREMIUM · 60 MIN
CrowdStrike Falcon Playbook: Safe Sensor Rollout, Content Rings, CQL Hunting and Automated Response
A hands-on Falcon deep dive: install and verify the Linux and Kubernetes sensor with least-privilege API clients, design content and sensor update rings after the July 2024 outage, hunt with CrowdStrike Query Language, and automate alerts, containment and Real Time Response through the API.
FALCO AND SYSDIG SECUREPREMIUM · 55 MIN
Falco Playbook: Deploy, Write Rules, Tune with Exceptions and Route Alerts
A hands-on Falco deep dive: deploy it on a local Kubernetes cluster, trigger and read your first alerts, write rules for your own workloads, tune noise with exceptions and overrides, route alerts with Falcosidekick, and run a 90-day rollout.
MICROSOFT DEFENDER FOR CLOUDPREMIUM · 55 MIN
Microsoft Defender for Cloud Playbook: Posture Reporting, Exposure Graph Hunts and Governance at Scale
A hands-on Defender for Cloud deep dive: report secure score, plan coverage, recommendations and alerts across subscriptions with Azure Resource Graph, hunt attack paths in the exposure graph across Azure, AWS and Google Cloud, assign owners and deadlines with governance rules, and survive the 2026 API changes.
ORCA SECURITYPREMIUM · 45 MIN
Orca Security Playbook: Shift-Left Scans in CI, Sonar Queries, Alert Automation and In-Account Scanning Permissions
A hands-on Orca guide built from Orca's own public code: orca-cli and the IaC action in CI with exit codes and warn mode, Sonar JSON queries that the serving layer accepts, alert lifecycle by API, policy and admission control as Terraform, and a review of the in-account scanner's AWS permissions.
TRIVYFREE · 60 MIN
Trivy Playbook: Scan Images and Code, Gate CI, Manage Exceptions and Run It Safely
A hands-on Trivy deep dive: scan an image, a repository and a Kubernetes manifest locally, build a CI gate developers accept, manage exceptions with expiry and VEX, generate and rescan SBOMs, write a custom Rego check, run offline, and pin the action after the 2026 compromise.
WIZPREMIUM · 55 MIN
Wiz Playbook: Shift-Left Gates, Admission Control, Issue APIs and Running a CNAPP Day to Day
A hands-on Wiz deep dive built from Wiz's public charts, plugin and integration code: authenticate the Wiz CLI in CI, roll out the admission controller safely in audit mode, verify chart signatures, pull and triage Issues through the GraphQL API, split service accounts by job, and run a CNAPP programme people trust.

Cloud detection and response (CDR)

AMAZON GUARDDUTYPREMIUM · 65 MIN
Amazon GuardDuty Playbook: Org-Wide Setup, Routing, Safe Tuning and Investigations
A hands-on GuardDuty deep dive: delegate an administrator in every Region, auto-enable protection plans, route findings with EventBridge, export to S3 with KMS, tune with suppression rules that keep attack sequences intact, watch Runtime Monitoring health, and work a credential exfiltration finding end to end.
CORTEX CLOUD (PRISMA CLOUD)PREMIUM · 50 MIN
Cortex Cloud Playbook: API Keys, Staged Onboarding, the Issues API, XQL and the Cortex CLI in Pipelines
A hands-on Cortex Cloud guide checked against Palo Alto Networks' public documentation and API schemas: Standard versus Advanced keys, onboarding in onboard-only mode without tripping its one-way switch, Issues API filters that validate, XQL within quota, CLI scans with the right key, and health alerts for silent gaps.
CROWDSTRIKE FALCONPREMIUM · 60 MIN
CrowdStrike Falcon Playbook: Safe Sensor Rollout, Content Rings, CQL Hunting and Automated Response
A hands-on Falcon deep dive: install and verify the Linux and Kubernetes sensor with least-privilege API clients, design content and sensor update rings after the July 2024 outage, hunt with CrowdStrike Query Language, and automate alerts, containment and Real Time Response through the API.
FALCO AND SYSDIG SECUREPREMIUM · 55 MIN
Falco Playbook: Deploy, Write Rules, Tune with Exceptions and Route Alerts
A hands-on Falco deep dive: deploy it on a local Kubernetes cluster, trigger and read your first alerts, write rules for your own workloads, tune noise with exceptions and overrides, route alerts with Falcosidekick, and run a 90-day rollout.
MICROSOFT DEFENDER FOR CLOUDPREMIUM · 55 MIN
Microsoft Defender for Cloud Playbook: Posture Reporting, Exposure Graph Hunts and Governance at Scale
A hands-on Defender for Cloud deep dive: report secure score, plan coverage, recommendations and alerts across subscriptions with Azure Resource Graph, hunt attack paths in the exposure graph across Azure, AWS and Google Cloud, assign owners and deadlines with governance rules, and survive the 2026 API changes.
WIZPREMIUM · 55 MIN
Wiz Playbook: Shift-Left Gates, Admission Control, Issue APIs and Running a CNAPP Day to Day
A hands-on Wiz deep dive built from Wiz's public charts, plugin and integration code: authenticate the Wiz CLI in CI, roll out the admission controller safely in audit mode, verify chart signatures, pull and triage Issues through the GraphQL API, split service accounts by job, and run a CNAPP programme people trust.

Endpoint detection and response (EDR / XDR)

CROWDSTRIKE FALCONPREMIUM · 60 MIN
CrowdStrike Falcon Playbook: Safe Sensor Rollout, Content Rings, CQL Hunting and Automated Response
A hands-on Falcon deep dive: install and verify the Linux and Kubernetes sensor with least-privilege API clients, design content and sensor update rings after the July 2024 outage, hunt with CrowdStrike Query Language, and automate alerts, containment and Real Time Response through the API.
MICROSOFT DEFENDER FOR ENDPOINTPREMIUM · 55 MIN
Microsoft Defender for Endpoint Playbook: KQL Hunting, Custom Detections and Live Response
A hands-on Defender for Endpoint deep dive: verify onboarding, hunt with KQL, turn a hunt into a custom detection that meets every requirement, choose near-real-time or scheduled runs, attach response actions safely, run live response from a controlled script library, and check Linux sensors.
RAPID7PREMIUM · 50 MIN
Rapid7 Playbook: Platform Keys, the InsightVM v4 and v3 APIs, Agents That Connect, and LEQL Hunts
A hands-on Rapid7 guide checked against Rapid7's own API specifications and documentation: choose the right key and region, query InsightVM's v4 API without the asset-filter trap, page past 10,000 results with cursors, use v3 search filters, install and diagnose the Rapid7 Agent, and hunt with LEQL.
SENTINELONE SINGULARITYPREMIUM · 50 MIN
SentinelOne Playbook: API Response Actions, Deep Visibility and PowerQuery Hunts, Detection as Code and Safe Exclusions
A hands-on SentinelOne guide built from SentinelOne's own public code: service-user tokens and the v2.1 API, response actions with their exact payloads, asynchronous Deep Visibility and PowerQuery hunts, custom rules as code, exclusions that do not blind the agent, and Kubernetes and Linux agent rollout.

Vulnerability management

MICROSOFT DEFENDER FOR CLOUDPREMIUM · 55 MIN
Microsoft Defender for Cloud Playbook: Posture Reporting, Exposure Graph Hunts and Governance at Scale
A hands-on Defender for Cloud deep dive: report secure score, plan coverage, recommendations and alerts across subscriptions with Azure Resource Graph, hunt attack paths in the exposure graph across Azure, AWS and Google Cloud, assign owners and deadlines with governance rules, and survive the 2026 API changes.
ORCA SECURITYPREMIUM · 45 MIN
Orca Security Playbook: Shift-Left Scans in CI, Sonar Queries, Alert Automation and In-Account Scanning Permissions
A hands-on Orca guide built from Orca's own public code: orca-cli and the IaC action in CI with exit codes and warn mode, Sonar JSON queries that the serving layer accepts, alert lifecycle by API, policy and admission control as Terraform, and a review of the in-account scanner's AWS permissions.
QUALYS VMDRPREMIUM · 50 MIN
Qualys Playbook: Platform URLs, Token Auth, Detection APIs That Page Correctly, QQL and Cloud Agent at Scale
A hands-on Qualys guide checked against Qualys's own documentation: find your platform's API server, authenticate with client credentials, pull detections with the XML and new JSON APIs without silently losing hosts, respect API limits, write QQL that matches what you mean, and roll out Cloud Agent safely.
RAPID7PREMIUM · 50 MIN
Rapid7 Playbook: Platform Keys, the InsightVM v4 and v3 APIs, Agents That Connect, and LEQL Hunts
A hands-on Rapid7 guide checked against Rapid7's own API specifications and documentation: choose the right key and region, query InsightVM's v4 API without the asset-filter trap, page past 10,000 results with cursors, use v3 search filters, install and diagnose the Rapid7 Agent, and hunt with LEQL.
TENABLEPREMIUM · 50 MIN
Tenable Playbook: Export APIs, Agents, Differential Sync and a Fix-First Queue That Survives Rate Limits
A hands-on Tenable guide checked against Tenable's developer reference: least-privilege API users, the three-step export API and its limits, differential exports that close tickets, a KEV and EPSS fix-first queue, agent linking and golden-image hygiene, and a lab you can run with Nessus Essentials.
TRIVYFREE · 60 MIN
Trivy Playbook: Scan Images and Code, Gate CI, Manage Exceptions and Run It Safely
A hands-on Trivy deep dive: scan an image, a repository and a Kubernetes manifest locally, build a CI gate developers accept, manage exceptions with expiry and VEX, generate and rescan SBOMs, write a custom Rego check, run offline, and pin the action after the 2026 compromise.
WIZPREMIUM · 55 MIN
Wiz Playbook: Shift-Left Gates, Admission Control, Issue APIs and Running a CNAPP Day to Day
A hands-on Wiz deep dive built from Wiz's public charts, plugin and integration code: authenticate the Wiz CLI in CI, roll out the admission controller safely in audit mode, verify chart signatures, pull and triage Issues through the GraphQL API, split service accounts by job, and run a CNAPP programme people trust.

Exposure and attack surface management

CENSYSPREMIUM · 45 MIN
Censys Playbook: Outside-In Exposure Checks on Your Own Estate with CenQL, cencli, the Platform API and ASM
A hands-on Censys guide checked against Censys's own documentation: authenticate cencli and the Platform API, write CenQL queries for your own ranges, certificates and end-of-life software, paginate and budget credits, diff outside-in results against your inventory, and run attack surface management without noise.
QUALYS VMDRPREMIUM · 50 MIN
Qualys Playbook: Platform URLs, Token Auth, Detection APIs That Page Correctly, QQL and Cloud Agent at Scale
A hands-on Qualys guide checked against Qualys's own documentation: find your platform's API server, authenticate with client credentials, pull detections with the XML and new JSON APIs without silently losing hosts, respect API limits, write QQL that matches what you mean, and roll out Cloud Agent safely.
RAPID7PREMIUM · 50 MIN
Rapid7 Playbook: Platform Keys, the InsightVM v4 and v3 APIs, Agents That Connect, and LEQL Hunts
A hands-on Rapid7 guide checked against Rapid7's own API specifications and documentation: choose the right key and region, query InsightVM's v4 API without the asset-filter trap, page past 10,000 results with cursors, use v3 search filters, install and diagnose the Rapid7 Agent, and hunt with LEQL.
TENABLEPREMIUM · 50 MIN
Tenable Playbook: Export APIs, Agents, Differential Sync and a Fix-First Queue That Survives Rate Limits
A hands-on Tenable guide checked against Tenable's developer reference: least-privilege API users, the three-step export API and its limits, differential exports that close tickets, a KEV and EPSS fix-first queue, agent linking and golden-image hygiene, and a lab you can run with Nessus Essentials.

AI red teaming and evaluation tools

AI SECURITY VENDORS IN 2026PREMIUM · 50 MIN
AI Security Vendor Proof of Concept Playbook: Scoping, Corpora, Detect Mode, Confidence Intervals and a Scorecard
A vendor-neutral, hands-on guide to running an AI security proof of concept: map surfaces to OWASP, ATLAS and NIST, wire each vendor through its documented API, build benign and attack corpora, run in detect mode, measure with confidence intervals and failure behaviour, and decide with a scorecard.
GARAKPREMIUM · 55 MIN
garak Playbook: Scan an LLM Endpoint, Read the Results Honestly and Make It a Regression Test
A hands-on garak deep dive: point it at your own REST endpoint, select probes with the --spec grammar, keep runs fast and repeatable with a YAML config, read the report, hit log and hit@k correctly, triage hits with a script, and turn the scan into a baseline-and-regression check.
PROMPTFOOPREMIUM · 60 MIN
promptfoo Playbook: Security Regression Tests, Red Teaming Your Own Endpoint and CI Gates
A hands-on promptfoo deep dive: write security assertions that run offline, point the HTTP provider at your own endpoint safely, build a red team config from your product's purpose, control the grader and where data goes, and gate pull requests on exit codes. Every config was validated or run on promptfoo 0.125.1.
PYRITPREMIUM · 55 MIN
PyRIT Playbook: Attacks, Scorers and Scans on PyRIT 1.x, and Reporting Success Rates Honestly
A hands-on PyRIT deep dive for the post-1.0 API: configure targets and memory, run an offline attack to prove the wiring, point it at your own HTTP endpoint, choose and validate scorers, run packaged scans with pyrit_scan, keep evidence in memory, and report attack success rates with confidence intervals.

AI guardrails and runtime protection

AI SECURITY VENDORS IN 2026PREMIUM · 50 MIN
AI Security Vendor Proof of Concept Playbook: Scoping, Corpora, Detect Mode, Confidence Intervals and a Scorecard
A vendor-neutral, hands-on guide to running an AI security proof of concept: map surfaces to OWASP, ATLAS and NIST, wire each vendor through its documented API, build benign and attack corpora, run in detect mode, measure with confidence intervals and failure behaviour, and decide with a scorecard.
CLOUD AI GUARDRAILS: BEDROCK GUARDRAILS, PROMPT SHIELDS AND MODEL ARMORPREMIUM · 55 MIN
Cloud AI Guardrails Playbook: Bedrock Guardrails, Azure Prompt Shields and Model Armor in Detect Mode, Then Enforced
A hands-on guide to the three big clouds' guardrail services, checked against their documentation and AWS's API models: a Bedrock guardrail validated against the service model, ApplyGuardrail and grounding checks, Prompt Shields for documents, Model Armor templates and floor settings, and the gaps each leaves open.
CYERAPREMIUM · 40 MIN
Cyera Playbook: DSPM Data Into Your SIEM, Issue Triage by Exposure, and Running a Data Security Programme
A hands-on Cyera guide built from Cyera's own Microsoft Sentinel connector: authentication, the four API objects and their versions, polling limits, a tested de-duplication and triage pipeline, Sentinel hunting queries, and a DSPM rollout that turns findings into owned fixes, honest about what stays behind a login.
GUARDRAIL LIBRARIES: NEMO GUARDRAILS, LLAMA GUARD AND LLAMAFIREWALLPREMIUM · 55 MIN
Guardrail Libraries Playbook: NeMo Guardrails Tested, Llama Guard 4, Prompt Guard 2 and LlamaFirewall in an Agent
A tested, hands-on guide to open-source LLM guardrails: a NeMo Guardrails 0.24.1 configuration exercised offline, including what its jailbreak rail does when the detector returns 503 (it lets the request through), plus Prompt Guard 2's limits, LlamaFirewall's scanners for agents, and a fail-closed policy to defend.
SENTINELONE SINGULARITYPREMIUM · 50 MIN
SentinelOne Playbook: API Response Actions, Deep Visibility and PowerQuery Hunts, Detection as Code and Safe Exclusions
A hands-on SentinelOne guide built from SentinelOne's own public code: service-user tokens and the v2.1 API, response actions with their exact payloads, asynchronous Deep Visibility and PowerQuery hunts, custom rules as code, exclusions that do not blind the agent, and Kubernetes and Linux agent rollout.

Model and AI supply chain scanning

AI SECURITY VENDORS IN 2026PREMIUM · 50 MIN
AI Security Vendor Proof of Concept Playbook: Scoping, Corpora, Detect Mode, Confidence Intervals and a Scorecard
A vendor-neutral, hands-on guide to running an AI security proof of concept: map surfaces to OWASP, ATLAS and NIST, wire each vendor through its documented API, build benign and attack corpora, run in detect mode, measure with confidence intervals and failure behaviour, and decide with a scorecard.
MODEL SCANNERS: MODELSCAN AND PICKLESCANPREMIUM · 50 MIN
Model Scanner Playbook: Gating Model Files with ModelScan and picklescan, Exit Codes, Blind Spots and safetensors
A tested, hands-on guide to model file scanning: build safe test fixtures, read what ModelScan 0.8.8 and picklescan 1.0.5 really return, close the gaps we measured (silent skips, renamed pickles, unparsed files, a broken settings file), write a fail-closed CI gate, and move teams to safetensors.
PROMPTFOOPREMIUM · 60 MIN
promptfoo Playbook: Security Regression Tests, Red Teaming Your Own Endpoint and CI Gates
A hands-on promptfoo deep dive: write security assertions that run offline, point the HTTP provider at your own endpoint safely, build a red team config from your product's purpose, control the grader and where data goes, and gate pull requests on exit codes. Every config was validated or run on promptfoo 0.125.1.

Playbooks are independent guides for interview preparation and practice, not endorsements. AISecurityInterviews is not affiliated with any vendor listed, and product names are trademarks of their owners. Free explainers for every tool are on the security tools page.