foyl | Security Intelligence Platform

Explore

Open a drawer. Poke the contents.

A closer look at the parts of foyl that escaped into production.

Daily Briefing

Five minutes of reading instead of twelve advisory tabs.

A real SOC briefing used by working analysts. Exact readership remains unavailable by design.

CVSS scores, affected products, and plain language summaries per threat

Severity triage, with critical and high separated from medium and below

No engagement analytics. Everyone will cope.

CISA KEV

Known exploited. Tracked daily.

The CISA Known Exploited Vulnerabilities catalog is monitored continuously. New KEV additions are surfaced immediately with remediation due dates and patching priority.

New KEV entries called out separately from standard threats

CISA remediation deadlines shown inline

Compared with Patch Tuesday and vendor advisories

Patch Tuesday

12 vendors. One read.

Monthly vendor security updates tracked across Microsoft, Cisco, Apple, Oracle, Fortinet, Ivanti, VMware, Palo Alto, Juniper, F5, Google, and Adobe, with an AI summary for each vendor.

Patch counts for each vendor, severity breakdowns, and zero day flags

Top CVEs per vendor with CVSS and exploitation status

CEO ready executive summary alongside SOC detail

Threat Actors

Named groups. Real context.

Active threat actor profiles tracked with motivations, TTPs, target sectors, and recent campaign activity. Updated when groups resurface in credible reporting.

State backed, criminal, and hacktivist groups profiled

MITRE ATT&CK technique mappings per actor

Recent campaigns and IOC associations linked inline

Detection Queries

Ready to deploy. Same day.

Detection logic for Rapid7 InsightIDR and SentinelOne generated from each day's threats. Copy, paste, deploy. Translation was declined.

Rapid7 InsightIDR LEQL queries per threat

SentinelOne Deep Visibility queries per threat

Tied directly to CVEs in the same briefing, with no second scavenger hunt

Week in Review

Friday wrapup

A Friday summary of the week's most significant threats, CISA activity, and emerging trends. It includes a two sentence CEO briefing ready for escalation.

Top 5 threats of the week ranked by severity and exploitation risk

CISA activity summary for the week

Executive summary written for nontechnical stakeholders

Where The Brief pulls from

CISA KEV

NVD / NIST

Microsoft MSRC

Cisco PSIRT

Apple Security

Oracle CPU

Fortinet PSIRT

Ivanti Advisories

VMware Security

Palo Alto Networks

Juniper Networks

F5 Networks

Google Chrome

Adobe Security

OSINT Aggregators

Ten working mock consoles share the same incidents and evidence. Learn with labs, prove it with drills, then sit the analyst desk and see what you missed.

SIEM

Security Info & Event Mgmt

Log correlation, alert triage, dashboards and threat hunting across a mock event stream.

NGFW

Next Generation Firewall

Policy management, traffic analysis, threat prevention rules and network segmentation.

EDR

Endpoint Detection & Response

Endpoint telemetry, process trees, threat isolation and guided incident investigation.

Email Security

Phishing & Threat Filter

Phishing detection, quarantine management, header analysis and URL sandboxing.

Identity

IAM / Directory Services

User provisioning, MFA, role based access control and anomalous login detection.

Vulnerability Management

Asset scanning, CVE prioritization, remediation tracking and risk scoring.

SOAR

Security Orchestration

Playbook automation, orchestration across tools, and incident response workflows.

TIP

Threat Intelligence Platform

IOC management, actor profiles, campaign tracking and threat feed integration.

CASB

Cloud App Security Broker

Shadow IT discovery, DLP policies, cloud app risk scoring and access governance.

Ticketing

Incident & Case Queue

Case management, SLA tracking, kanban boards and sprint based analyst workflows.

Find the room

Browse the map

Click a state or choose virtual. The calendar handles conferences, CTFs, training, webinars, and meetups without asking you to remember which site hid the useful filter.

Filter the damage

Narrow by type, cost, format, month, or location. It is a calendar with working filters, which apparently counts as a feature now.

Check back monthly

The list is refreshed every month from event sources across the United States, plus virtual events you can attend without finding a hotel.

What is indexed

Format

In person, hybrid, virtual

Types

Conferences, CTFs, training

Location

United States and online

Refresh

Monthly

events.foyl.io Map view Free to browse

How it works

Five APIs, no auth required

I found five job boards that give free access without accounts: RemoteOK, Arbeitnow, Jobicy, The Muse, and Working Nomads. They supply a raw pool of about 200 listings every Monday.

Claude filters the noise

Haiku reads the pile and cuts it down to the 50 most relevant cyber and IT roles, with an entry and mid level bias. Anything requiring 15 years of experience or a clearance above SECRET gets dropped.

Fresh board every Monday

Cron fires, new jobs go up, old ones are gone. No reruns from last week, no duplicate postings. Check it Monday morning and apply somewhere instead of scrolling LinkedIn until morale improves.

What you get

Volume

50 listings per week

Refresh

Every Monday

Focus

Cyber & IT only

Level

Entry and mid level

Filter

AI selected, not keyword matched

Cost

Free. Obviously.

Data sources

RemoteOK Arbeitnow Jobicy The Muse Working Nomads

What it is

Curated OSINT tools

Sixty two hand picked open source intelligence tools across malware analysis, threat intel, DNS and domains, IP and networks, scanning, credentials, blockchain, proxy detection, and analysis.

Categories, filters, search

Filter by access tier, health status, or category. Search names, descriptions, and tags. Results are instant because pagination had its chance.

Tool categories

Malware

Analysis & Sandbox

Threat Intel

IOC & Reputation

DNS & Domain

WHOIS, Certs, DMARC

IP & Network

ASN, BGP, Geolocation

Scanning

Exposure & Attack Surface

Credentials

Breaches & Leaks

Stats

62 tools Free & account Checked every 2h osint.foyl.io

What it is

382

Certification sample tests

Five question previews for 382 cybersecurity certifications, from CompTIA A+ and Security+ through OSCP and CISSP. Get a genuine feel for the difficulty in under 60 seconds.

Difficulty tiers

Every cert is tagged Entry, Mid, Advanced, or Expert. Filter by tier and spend less time pretending the exam vendor explained the audience.

Career path guide

Twenty five cybersecurity career paths with collapsible cert trees for SOC analysts, penetration testers, cloud security, GRC, and more. See which certs stack toward a target role.

Cert categories

CompTIA

A+, Net+, Sec+, CySA+, CASP+

Offensive

OSCP, OSEP, CEH, GPEN

Cloud

AWS, Azure, GCP security certs

GRC

CISSP, CISM, CISA, CRISC

Forensics

GCFE, GCFA, EnCE

Vendor

Cisco, Palo Alto, Splunk

Stats

382 certs Entry → Expert 25 career paths learn.foyl.io/certs

What it is

Full MITRE ATT&CK® Enterprise matrix

All 14 ATT&CK® tactics and more than 200 techniques rendered as an interactive, scrollable matrix. Click any technique for its description, subtechniques, group usage, mitigations, and detection guidance.

20+

Real APT group profiles

More than 20 real threat actor groups mapped to known techniques, including APT28, APT29, Lazarus, Scattered Spider, LockBit, Conti, and Sandworm. Each profile includes aliases, country, sponsor, motivation, and key techniques.

Attack campaign walkthroughs

Four named attack campaigns with animated paths across the matrix. Move through each technique in sequence with context on what the attacker did and why.

Features

Coverage

200+ techniques, 14 tactics

Groups

20+ APT profiles mapped

Campaigns

4 walkthroughs with paths

Filter

Windows · Linux · macOS · Cloud

Technique ID, name, or group

Version

MITRE ATT&CK® Enterprise v14.1

Quick stats

learn.foyl.io/attack ATT&CK® v14.1 Free to use foyl Learn account

Security tooling without the ceremonial invoice.