The material you'll keep coming back to

The shared vocabulary for adversary behaviour. Map coverage, find the gaps.

A programme-level structure that translates security work into business language.

The baseline web risk list every application security conversation starts from.

Practical, opinionated guidance for the controls developers actually implement.

A starting structure for detection, triage, comms and post-incident review.

Canonical vulnerability identifiers, and the place to check before you panic.