// free resources
Take these. Free.
Practical checklists and private browser tools for internal use. When you need an evidence-backed review, ABZSECURE can turn the starting point into an owned remediation plan.
Understand. Plan. Then verify.
Start with an original self-check, explore a synthetic authorization scenario, or build a current-to-target programme. These free browser tools organize thinking; they do not test your systems, validate evidence or certify compliance.
Before your penetration test
Scope defined in writing · test accounts for every role · staging parity confirmed · emergency contact named · logging enabled so you can watch the test · backup taken · legal authorisation signed. Arrive prepared, get more value per testing day.
Read the scoping checklistIncident: first 24 hours
Activate the incident lead · document decisions · preserve relevant evidence where safe · choose containment with operational impact in mind · coordinate recovery and notifications with responsible advisers. The guide is not an emergency response service.
Read the playbook →Vetting any security vendor
Ask who performs and reviews the work, how evidence is protected, which methods apply, what the sample report demonstrates and whether retesting is included. Compare written answers against your scope rather than relying on badges.
Discuss a vendor reviewCompliance: where to begin
Clarify the buyer, contract, jurisdiction and system boundary first. Select applicable requirements, review the available evidence and record gaps, owners and next decisions. SOC 2 and ISO 27001 are different assurance routes, not interchangeable certificates.
SOC 2 guide →LLM app pre-launch
Prompt injection (direct + indirect) · cross-tenant data leakage · tool-call authorisation · output sanitisation · guardrail bypass testing. Agree release criteria, test the relevant abuse cases and record residual risk; one checklist or test cannot establish safety.
Full checklist →security.txt
This site publishes RFC 9116 vulnerability disclosure info at /.well-known/security.txt — a discovery route for vulnerability reports, not permission to test. Follow the published scope and reporting policy.
Download security.txtA self-check identifies questions to investigate. A scoped, paid readiness review adds evidence review, named owners and a practical remediation plan.
Discuss a readiness diagnostic →