The tools you will be asked about, and how they actually work.

Palo Alto Networks (open source, Apache-2.0)

Checkov

How the open-source Checkov scanner parses infrastructure as code into a graph and checks it against policies, how to run it locally and in CI, how to suppress with a reason, how to write a YAML custom policy, and what static IaC scanning cannot see.

How Palo Alto Networks merged Prisma Cloud with Cortex CDR into Cortex Cloud, how onboarding, Outposts, agentless disk scanning and the Kubernetes Connector work, how Issues, Findings and Cases differ, and how cortexcli replaces Checkov and twistcli in pipelines.

How GitHub's security features work after the 2025 split into Secret Protection and Code Security: CodeQL default and advanced setup, push protection and delegated bypass, Dependabot, dependency review, Copilot Autofix and AI Scan, with a rollout plan.

GitHub Advanced Security

GitHub (Microsoft)

How Semgrep's pattern-based static analysis works, how to write and run rules, the difference between Community Edition and the paid AppSec Platform, how suppressions and CI gating work, and why Opengrep forked in 2025.

Semgrep

Semgrep, Inc.

What Snyk Open Source, Snyk Code, Snyk Container and Snyk IaC each test, how reachability and fix pull requests work, the CLI commands and exit codes for CI, and the limits to state in an interview.

Snyk

How Aqua Security's open-source Trivy scanner finds vulnerabilities, misconfigurations, secrets and licences, the commands and flags for CI gates and SBOMs, how ignores and VEX work, and what the March 2026 trivy-action compromise means for every pipeline.

How Wiz connects to AWS, Azure and Google Cloud, scans workloads without agents, builds the Security Graph and turns it into Issues and toxic combinations, plus a day-one, week-one and daily workflow for Wiz Cloud, Wiz Code and Wiz Defend.

Secret scanning

Catch credentials in commits, history and build output, and get them revoked.

ASPM platforms: Apiiro, OX Security and Cycode

Apiiro, OX Security, Cycode (each independent)

What application security posture management platforms actually do, how Apiiro, OX Security and Cycode connect to source control, CI/CD, registries and cloud, how to run an ASPM rollout, and how to test a vendor's 'code to runtime' claims.

How GitGuardian finds leaked secrets in repositories and public GitHub, how the ggshield CLI blocks them in pre-commit hooks, CI and AI coding assistants, how validity checks prioritise incidents, and what honeytokens add.

GitGuardian

How GitHub's security features work after the 2025 split into Secret Protection and Code Security: CodeQL default and advanced setup, push protection and delegated bypass, Dependabot, dependency review, Copilot Autofix and AI Scan, with a rollout plan.

GitHub Advanced Security

GitHub (Microsoft)

How Semgrep's pattern-based static analysis works, how to write and run rules, the difference between Community Edition and the paid AppSec Platform, how suppressions and CI gating work, and why Opengrep forked in 2025.

Semgrep

Semgrep, Inc.

What Snyk Open Source, Snyk Code, Snyk Container and Snyk IaC each test, how reachability and fix pull requests work, the CLI commands and exit codes for CI, and the limits to state in an interview.

Snyk

How Aqua Security's open-source Trivy scanner finds vulnerabilities, misconfigurations, secrets and licences, the commands and flags for CI gates and SBOMs, how ignores and VEX work, and what the March 2026 trivy-action compromise means for every pipeline.

Application security posture management (ASPM)

Join code, pipeline and runtime findings so teams fix what matters first.

ASPM platforms: Apiiro, OX Security and Cycode

Apiiro, OX Security, Cycode (each independent)

What application security posture management platforms actually do, how Apiiro, OX Security and Cycode connect to source control, CI/CD, registries and cloud, how to run an ASPM rollout, and how to test a vendor's 'code to runtime' claims.

How Palo Alto Networks merged Prisma Cloud with Cortex CDR into Cortex Cloud, how onboarding, Outposts, agentless disk scanning and the Kubernetes Connector work, how Issues, Findings and Cases differ, and how cortexcli replaces Checkov and twistcli in pipelines.

Cloud security platforms: CSPM and CNAPP

Read cloud configuration, permissions and workloads to find exploitable combinations.

Palo Alto Networks (open source, Apache-2.0)

Checkov

How the open-source Checkov scanner parses infrastructure as code into a graph and checks it against policies, how to run it locally and in CI, how to suppress with a reason, how to write a YAML custom policy, and what static IaC scanning cannot see.

How Palo Alto Networks merged Prisma Cloud with Cortex CDR into Cortex Cloud, how onboarding, Outposts, agentless disk scanning and the Kubernetes Connector work, how Issues, Findings and Cases differ, and how cortexcli replaces Checkov and twistcli in pipelines.

How Microsoft Defender for Cloud works in 2026: the free Foundational CSPM tier and the paid Defender CSPM and workload plans, the two different secure scores, attack path analysis and cloud security explorer, agentless scanning, and onboarding AWS and Google Cloud.

How Orca Security reads workload disks without agents through SideScanning, its SaaS, In-Account and Bring Your Own Cloud deployment modes, how attack paths are scored, and a practical onboarding and triage workflow.

How Qualys VMDR discovers assets and detects vulnerabilities with Cloud Agents, scanners and passive sensors, how the TruRisk score combines detection scores and asset criticality, how remediation and TruRisk Eliminate work, and what TotalCloud adds for cloud.

Qualys VMDR

Qualys

How SentinelOne's Singularity platform makes verdicts on the endpoint, groups activity into Storylines, hunts with Purple AI and PowerQuery over its data lake, and responds with kill, quarantine, network isolation and Windows rollback, plus the 2025 Prompt Security acquisition.

SentinelOne Singularity

SentinelOne

How Tenable's vulnerability management works: Nessus credentialed and non-credentialed scans, agents, discovery versus assessment scans, VPR and the 2026 move to unified risk scoring, remediation projects and goals, and how Tenable One adds exposure management and cloud security.

How Wiz connects to AWS, Azure and Google Cloud, scans workloads without agents, builds the Security Graph and turns it into Issues and toxic combinations, plus a day-one, week-one and daily workflow for Wiz Cloud, Wiz Code and Wiz Defend.

Cloud identity and entitlements (CIEM)

Work out who can actually do what in the cloud, and remove what nobody uses.

How Palo Alto Networks merged Prisma Cloud with Cortex CDR into Cortex Cloud, how onboarding, Outposts, agentless disk scanning and the Kubernetes Connector work, how Issues, Findings and Cases differ, and how cortexcli replaces Checkov and twistcli in pipelines.

How Cyera's agentless data security posture management discovers and classifies data across cloud, SaaS and on-premises stores, its SaaS and outpost deployment models, how risk and remediation work, its 2024 to 2026 expansion into DLP, AI and identity, and how Sentra's in-account scanning differs.

Cyera

How Orca Security reads workload disks without agents through SideScanning, its SaaS, In-Account and Bring Your Own Cloud deployment modes, how attack paths are scored, and a practical onboarding and triage workflow.

How Sonrai's Cloud Permissions Firewall turns observed permission use into organisation-level deny policies you deploy yourself, how Permissions on Demand handles exceptions, the limits of SCP-based controls, and what happened to Microsoft Entra Permissions Management (CloudKnox).

Sonrai Security

How Tenable's vulnerability management works: Nessus credentialed and non-credentialed scans, agents, discovery versus assessment scans, VPR and the 2026 move to unified risk scoring, remediation projects and goals, and how Tenable One adds exposure management and cloud security.

How Wiz connects to AWS, Azure and Google Cloud, scans workloads without agents, builds the Security Graph and turns it into Issues and toxic combinations, plus a day-one, week-one and daily workflow for Wiz Cloud, Wiz Code and Wiz Defend.

Data security posture management (DSPM)

Discover and classify sensitive data, then see who and what can reach it.

How Palo Alto Networks merged Prisma Cloud with Cortex CDR into Cortex Cloud, how onboarding, Outposts, agentless disk scanning and the Kubernetes Connector work, how Issues, Findings and Cases differ, and how cortexcli replaces Checkov and twistcli in pipelines.

How Cyera's agentless data security posture management discovers and classifies data across cloud, SaaS and on-premises stores, its SaaS and outpost deployment models, how risk and remediation work, its 2024 to 2026 expansion into DLP, AI and identity, and how Sentra's in-account scanning differs.

Cyera

How Microsoft Defender for Cloud works in 2026: the free Foundational CSPM tier and the paid Defender CSPM and workload plans, the two different secure scores, attack path analysis and cloud security explorer, agentless scanning, and onboarding AWS and Google Cloud.

How Orca Security reads workload disks without agents through SideScanning, its SaaS, In-Account and Bring Your Own Cloud deployment modes, how attack paths are scored, and a practical onboarding and triage workflow.

How Wiz connects to AWS, Azure and Google Cloud, scans workloads without agents, builds the Security Graph and turns it into Issues and toxic combinations, plus a day-one, week-one and daily workflow for Wiz Cloud, Wiz Code and Wiz Defend.

Container and Kubernetes runtime security

Watch processes, syscalls and cluster changes in running workloads.

How Amazon GuardDuty reads CloudTrail, VPC Flow Logs and DNS logs, what each protection plan adds, how Extended Threat Detection builds attack sequences, how to enable it across an AWS Organization with a delegated administrator, and how to tune it without blinding it.

Amazon GuardDuty

Amazon Web Services

How Palo Alto Networks merged Prisma Cloud with Cortex CDR into Cortex Cloud, how onboarding, Outposts, agentless disk scanning and the Kubernetes Connector work, how Issues, Findings and Cases differ, and how cortexcli replaces Checkov and twistcli in pipelines.

How the CrowdStrike Falcon sensor collects endpoint telemetry, what changed in content update controls after the July 2024 Channel File 291 outage, how analysts triage alerts, hunt with CrowdStrike Query Language and contain hosts, and the limits to state in an interview.

CrowdStrike Falcon

CrowdStrike

CNCF project created by Sysdig; Sysdig, Inc. (Sysdig Secure)

Falco and Sysdig Secure

How the CNCF-graduated Falco project watches Linux system calls with eBPF and matches them against YAML rules, how to deploy it with Helm, read and route alerts with Falcosidekick, write and tune rules, and what Sysdig Secure adds commercially.

How Microsoft Defender for Cloud works in 2026: the free Foundational CSPM tier and the paid Defender CSPM and workload plans, the two different secure scores, attack path analysis and cloud security explorer, agentless scanning, and onboarding AWS and Google Cloud.

How Orca Security reads workload disks without agents through SideScanning, its SaaS, In-Account and Bring Your Own Cloud deployment modes, how attack paths are scored, and a practical onboarding and triage workflow.

How Aqua Security's open-source Trivy scanner finds vulnerabilities, misconfigurations, secrets and licences, the commands and flags for CI gates and SBOMs, how ignores and VEX work, and what the March 2026 trivy-action compromise means for every pipeline.

How Wiz connects to AWS, Azure and Google Cloud, scans workloads without agents, builds the Security Graph and turns it into Issues and toxic combinations, plus a day-one, week-one and daily workflow for Wiz Cloud, Wiz Code and Wiz Defend.

Cloud detection and response (CDR)

Detect attacker behaviour in cloud logs and respond before it spreads.

How Amazon GuardDuty reads CloudTrail, VPC Flow Logs and DNS logs, what each protection plan adds, how Extended Threat Detection builds attack sequences, how to enable it across an AWS Organization with a delegated administrator, and how to tune it without blinding it.

Amazon GuardDuty

Amazon Web Services

How Palo Alto Networks merged Prisma Cloud with Cortex CDR into Cortex Cloud, how onboarding, Outposts, agentless disk scanning and the Kubernetes Connector work, how Issues, Findings and Cases differ, and how cortexcli replaces Checkov and twistcli in pipelines.

How the CrowdStrike Falcon sensor collects endpoint telemetry, what changed in content update controls after the July 2024 Channel File 291 outage, how analysts triage alerts, hunt with CrowdStrike Query Language and contain hosts, and the limits to state in an interview.

CrowdStrike Falcon

CrowdStrike

CNCF project created by Sysdig; Sysdig, Inc. (Sysdig Secure)

Falco and Sysdig Secure

How the CNCF-graduated Falco project watches Linux system calls with eBPF and matches them against YAML rules, how to deploy it with Helm, read and route alerts with Falcosidekick, write and tune rules, and what Sysdig Secure adds commercially.

How Microsoft Defender for Cloud works in 2026: the free Foundational CSPM tier and the paid Defender CSPM and workload plans, the two different secure scores, attack path analysis and cloud security explorer, agentless scanning, and onboarding AWS and Google Cloud.

How Wiz connects to AWS, Azure and Google Cloud, scans workloads without agents, builds the Security Graph and turns it into Issues and toxic combinations, plus a day-one, week-one and daily workflow for Wiz Cloud, Wiz Code and Wiz Defend.

Endpoint detection and response (EDR / XDR)

Record endpoint activity, detect intrusions and contain hosts.

How the CrowdStrike Falcon sensor collects endpoint telemetry, what changed in content update controls after the July 2024 Channel File 291 outage, how analysts triage alerts, hunt with CrowdStrike Query Language and contain hosts, and the limits to state in an interview.

CrowdStrike Falcon

CrowdStrike

Microsoft Defender for Endpoint

How Microsoft Defender for Endpoint onboards devices in rings, how analysts hunt with KQL in advanced hunting, isolate or contain devices and use live response, and what changed for automated investigation and response in September 2026.

How Rapid7's vulnerability management works now that InsightVM is part of Exposure Command: Scan Engine and Rapid7 Agent coverage, authenticated scanning, Remediation Hub prioritisation, Surface Command for attack surface, and where Incident Command fits.

Rapid7

How SentinelOne's Singularity platform makes verdicts on the endpoint, groups activity into Storylines, hunts with Purple AI and PowerQuery over its data lake, and responds with kill, quarantine, network isolation and Windows rollback, plus the 2025 Prompt Security acquisition.

SentinelOne Singularity

SentinelOne

Vulnerability management

Scan hosts and images, prioritise with exploit evidence and track the fix.

How Microsoft Defender for Cloud works in 2026: the free Foundational CSPM tier and the paid Defender CSPM and workload plans, the two different secure scores, attack path analysis and cloud security explorer, agentless scanning, and onboarding AWS and Google Cloud.

How Orca Security reads workload disks without agents through SideScanning, its SaaS, In-Account and Bring Your Own Cloud deployment modes, how attack paths are scored, and a practical onboarding and triage workflow.

How Qualys VMDR discovers assets and detects vulnerabilities with Cloud Agents, scanners and passive sensors, how the TruRisk score combines detection scores and asset criticality, how remediation and TruRisk Eliminate work, and what TotalCloud adds for cloud.

Qualys VMDR

Qualys

How Rapid7's vulnerability management works now that InsightVM is part of Exposure Command: Scan Engine and Rapid7 Agent coverage, authenticated scanning, Remediation Hub prioritisation, Surface Command for attack surface, and where Incident Command fits.

Rapid7

How Tenable's vulnerability management works: Nessus credentialed and non-credentialed scans, agents, discovery versus assessment scans, VPR and the 2026 move to unified risk scoring, remediation projects and goals, and how Tenable One adds exposure management and cloud security.

How Aqua Security's open-source Trivy scanner finds vulnerabilities, misconfigurations, secrets and licences, the commands and flags for CI gates and SBOMs, how ignores and VEX work, and what the March 2026 trivy-action compromise means for every pipeline.

How Wiz connects to AWS, Azure and Google Cloud, scans workloads without agents, builds the Security Graph and turns it into Issues and toxic combinations, plus a day-one, week-one and daily workflow for Wiz Cloud, Wiz Code and Wiz Defend.

Exposure and attack surface management

See what the internet sees of you, and which exposures attackers can use.

How Censys scans the internet and attributes internet-facing assets to an organisation, how attack surface management grows from seeds with a visible discovery path, how defenders use it to find their own exposed services, and what changed with the Censys Platform and CenQL in 2026.

Censys

How Qualys VMDR discovers assets and detects vulnerabilities with Cloud Agents, scanners and passive sensors, how the TruRisk score combines detection scores and asset criticality, how remediation and TruRisk Eliminate work, and what TotalCloud adds for cloud.

Qualys VMDR

Qualys

How Rapid7's vulnerability management works now that InsightVM is part of Exposure Command: Scan Engine and Rapid7 Agent coverage, authenticated scanning, Remediation Hub prioritisation, Surface Command for attack surface, and where Incident Command fits.

Rapid7

How Tenable's vulnerability management works: Nessus credentialed and non-credentialed scans, agents, discovery versus assessment scans, VPR and the 2026 move to unified risk scoring, remediation projects and goals, and how Tenable One adds exposure management and cloud security.

AI red teaming and evaluation tools

Probe models and LLM apps for unsafe behaviour, repeatably and in CI.

AI security vendors in 2026

Several (see the table)

A dated map of the AI security vendor market as of November 2026: which start-ups were bought by Palo Alto Networks, Check Point, Cisco, SentinelOne, F5 and Cato Networks, which remain independent, what each product does, and how to evaluate an AI security platform.

NVIDIA (open source, Apache-2.0)

garak

How the open-source garak scanner tests an LLM or LLM application with probes and detectors, how to select tests with the --spec flag that replaced --probes, how to read the JSONL report, hit log and calibrated Z-scores, and what a clean scan does and does not prove.

promptfoo (agreed acquisition by OpenAI, announced March 2026; open source, MIT)

promptfoo

How promptfoo runs LLM evaluations and red-team tests from promptfooconfig.yaml, how plugins and strategies generate adversarial tests, how to gate pull requests with the GitHub Action, and what OpenAI's 2026 agreement to acquire it means for users.

Microsoft AI Red Team (open source, MIT)

PyRIT

How Microsoft's open-source PyRIT framework structures AI red teaming with targets, converters, scorers, attacks, scenarios and memory, what broke in the July 2026 1.0 release, how to run pyrit_scan, and how the Microsoft Foundry AI Red Teaming Agent builds on it.

AI guardrails and runtime protection

Classify and filter prompts, retrieved content and outputs at run time.

AI security vendors in 2026

Several (see the table)

A dated map of the AI security vendor market as of November 2026: which start-ups were bought by Palo Alto Networks, Check Point, Cisco, SentinelOne, F5 and Cato Networks, which remain independent, what each product does, and how to evaluate an AI security platform.

Cloud AI guardrails: Bedrock Guardrails, Prompt Shields and Model Armor

Amazon Web Services, Microsoft, Google Cloud

How the three big clouds' managed guardrail services work and how to call them: Bedrock Guardrails policies and the ApplyGuardrail API, Azure AI Content Safety Prompt Shields for user and document attacks, and Google Cloud Model Armor templates, with the documented gaps each one has.

How Cyera's agentless data security posture management discovers and classifies data across cloud, SaaS and on-premises stores, its SaaS and outpost deployment models, how risk and remediation work, its 2024 to 2026 expansion into DLP, AI and identity, and how Sentra's in-account scanning differs.

Cyera

Guardrail libraries: NeMo Guardrails, Llama Guard and LlamaFirewall

NVIDIA (NeMo Guardrails); Meta (Llama Guard, Prompt Guard, LlamaFirewall); Protect AI (LLM Guard, archived)

How the main open-source guardrail tools work and how to wire them around an LLM app: NVIDIA NeMo Guardrails rails and Colang, Meta's Llama Guard 4 and Prompt Guard 2 classifiers, LlamaFirewall for agents, and the archived LLM Guard scanner library, with the limits each one documents.

How SentinelOne's Singularity platform makes verdicts on the endpoint, groups activity into Storylines, hunts with Purple AI and PowerQuery over its data lake, and responds with kill, quarantine, network isolation and Windows rollback, plus the 2025 Prompt Security acquisition.

SentinelOne Singularity

SentinelOne

Model and AI supply chain scanning

Inspect model files and AI dependencies before they are loaded.

AI security vendors in 2026

Several (see the table)

A dated map of the AI security vendor market as of November 2026: which start-ups were bought by Palo Alto Networks, Check Point, Cisco, SentinelOne, F5 and Cato Networks, which remain independent, what each product does, and how to evaluate an AI security platform.

Model scanners: ModelScan and picklescan

Protect AI, now Palo Alto Networks (ModelScan); community (picklescan)

How ModelScan, picklescan and ModelAudit inspect model files for code that runs on load without loading them, how to use them in CI and before downloading third-party models, what Hugging Face scans, and why 2025's picklescan bypasses mean safetensors still matters most.