Cybersecurity Field Guides

Choose the question you need to answer

Field guide 01 / Exposure & identity

Follow the path. Verify every connection.

Connect exposure, identity, and critical assets without mistaking a plausible route for a proven one.

Field guide 02 / Threat intelligence

Turn information into a reviewable judgment.

Evaluate origin, relevance, and uncertainty before a report becomes a security decision.

Field guide 03 / Security assurance

Ask what would prove the control works.

Separate documented intent, configuration, and observed behavior in a security assurance review.

Field guide 04 / Decision governance

Keep authority with the accountable person.

Give reviewers the evidence, alternatives, and authority needed to challenge a conclusion.

Use the guides with your own context

Start with a specific asset, control, incident, or decision. Record the scope before interpreting the evidence. A statement about one system or period should not silently become a claim about the whole organization.

The examples are educational and deliberately simple. They are not scans, operational assessments, or records of client results. Use them to identify missing information and prepare a better question for the team responsible for the environment.

For security practitioners

Use the input lists to check source coverage, permissions, timestamps, and the assumptions that connect findings.

For decision owners

Use the review questions to understand what is established, what could change the conclusion, and who owns the next step.

Use a shared language carefully

NIST’s Cybersecurity Framework helps organizations describe and manage cybersecurity risk. MITRE ATT&CK provides a structured vocabulary for adversary behavior. Both can help teams communicate; neither makes a local security claim true by itself.

For example, identifying an ATT&CK technique does not prove that it occurred in your environment. Mapping a control to a framework does not show that the control operated successfully. Preserve the local evidence behind the mapping.

Find the original references and plain-language terms in the resource library.

How the guides relate to Black Atlas

The guides develop practical questions around Black Atlas’s public emphasis on evidence and review. They are supporting editorial resources. They do not expand the product’s documented capabilities or establish availability in a particular environment.

Read what Black Atlas does for the capability overview and consult its main site for current service definitions.

Sources & context

NIST Cybersecurity Framework ↗Official risk-management reference.
MITRE ATT&CK resources ↗Official reference for adversary-behavior terminology.
Black Atlas services ↗Primary catalogue; includes maturity qualifications.

Sources reviewed 18 October 2026. First-party descriptions establish the source’s stated approach; they are not independent validation of security outcomes. About our sources.

Better questions. More defensible decisions.

Choose the question you need to answer

Follow the path. Verify every connection.

Turn information into a reviewable judgment.

Ask what would prove the control works.

Keep authority with the accountable person.

Use the guides with your own context

For security practitioners

For decision owners

Use a shared language carefully

How the guides relate to Black Atlas

Sources & context

A more useful security conversation starts here.

Better questions. More defensible decisions.

Choose the question you need to answer

Follow the path. Verify every connection.

Turn information into a reviewable judgment.

Ask what would prove the control works.

Keep authority with the accountable person.

Use the guides with your own context

For security practitioners

For decision owners

Use a shared language carefully

How the guides relate to Black Atlas

Sources & context

The next useful question.

A more useful security conversation starts here.