A full-stack AI SOC analyst for SentinelOne: seven Claude skills, three bundled MCP servers, and an operating persona (CLAUDE.md) that hunt threats, triage alerts, author detections/dashboards/parsers, and build Hyperautomation workflows from natural language.

Given a CVE or vuln name, reports an exploit-maturity tier and in-the-wild status from CISA KEV, EPSS, Metasploit, Nuclei, Exploit-DB, and GitHub PoC trackers.

Structures an authorized web app pentest around the OWASP Web Security Testing Guide (WSTG) methodology as a checklist, and turns tester-supplied evidence into a WSTG-numbered findings report — backseat mode only, it never sends payloads or runs scanners.

Static-only malware analysis: deobfuscate files, extract IOCs, and write variant-agnostic detection signatures.

Prioritizes daily vulnerability fixes using Tenable exposure data, CISA KEV exploitation, MITRE ATT&CK and attack paths

A Claude Code skill that guides you through submitting agents, MCP servers, and playbooks to the Tenable CyberAgents Exchange

Proactive, hypothesis-driven threat hunting using the LOCK pattern across SIEM, EDR, VM, CSPM, CASB, and code search

Generate & upload Tenable SC dashboards, PDF reports, and CSV exports via tested XML builders.

Export scans and policies from Nessus, Tenable.io, or Tenable.sc to Tenable.io, preserving configurations, targets, and schedules

Comprehensive cyber threat intelligence briefings for any CVE, advisory, threat actor, or product — in minutes.

Executive dashboard that prioritizes remediation to cut Tenable One Exposure Score by 10-50% in phases.

Adversarial pre-submission quality and security gate for cybersecurity agents, skills, and MCP servers — especially those bound for the CyberAgents Exchange. Hunts the failure classes that hurt a customer across 19 dimensions, reports findings as rejection gates, defects, and informational notes, and mirrors the live Exchange reviewer checklist so you clear review with fewer round-trips.

Generate weekly/monthly Fixed Vulnerability Trend reports directly from Tenable Security Center — no dependencies, works offline.

A daily, fully-sourced cyber threat intelligence briefing for CISOs, correlated against your Tenable environment.

Audits Tenable user activity, authentication security, and maps findings to compliance frameworks

Post-Quantum Cryptography readiness skill and dashboard for Tenable Vulnerability Management — type /pqc-posture in Claude Code for an instant fleet posture summary

Triages Tenable Identity Exposure IoA alerts as false positive, true positive, or false negative with a 1–10 confidence score.

A token-optimized knowledge pack that makes AI coding assistants expert in the Tenable One exposure management platform API.

Turns live Tenable exposure and remediation data into a quick-scan snapshot plus ready-to-use trust-center copy, RFP answers, and proof points.

Diagnoses Tenable Nessus authentication failures by analyzing plugin output from scan results or live MCP lookups, identifying root causes and providing actionable remediation steps.

Generate competitive company intelligence briefs with live HTML dashboards and polished PDFs.

Build a leadership-ready security intelligence brief (PDF) for selected vendors and software products, down to specific versions

Query and triage Tenable Cloud Security posture findings in Splunk via the official Splunk MCP Server.

A Claude Code skill that turns open Tenable Cloud Security IaC findings into reviewed, mergeable GitHub fix PRs

Determines whether a CVE affects an environment using existing software inventory data from prior scans — no new scan required.

Discover, extract, and analyze Tenable INFO-severity plugin data — processes, software, accounts, hardware, and forensic artifacts — from Tenable VM for inventory, forensics, and threat hunting.

A 13-skill Claude skill set for driving the Tenable navi CLI and the navi_* MCP tools.

Turns Tenable One Attack Path Analysis data into a prioritized, self-contained HTML remediation dashboard with native Tenable scoring and a CISA KEV cross-reference for actively-exploited findings on choke points

Drives Tenable CVE findings through KRI risk scoring, approval-gated remediation, containment, and verified evidence.

AI facilitator that runs a tailored incident response tabletop from your exposure data and scores it the same day

Reports PHP2Shell (CVE-2026-109618, CVE-2026-109619) exposure from Tenable data via Hexa AI MCP as HTML, PDF and CSV.

Multi-layered static analysis and sanitization for suspicious PDFs with threat intelligence integration.

Evidence-first application-security review skill that sends every candidate finding to an independent verifier whose job is to disprove it before it is reported.

Auto-classifies Tenable credentialed scan auth failures by root cause and tracks remediation cases.

Multi-layered phishing email analysis skill for static analysis, threat intel, blast radius, and IOC extraction. Nothing is executed.

Report Nessus agent coverage by correlating AWS EC2, the Nessus Manager agent list, and Tenable Security Center scan data. Read-only.

Scans authorized web apps for exposed AI and cloud API keys in client-delivered HTML and JavaScript.

SSL/TLS compliance dashboard from Tenable Hexa MCP: flags deprecated protocols, weak ciphers, and certificate issues.

Pulls your Recorded Future threat map, maps an APT group's MITRE ATT&CK techniques, and cross-references against live Tenable findings to identify which attack path nodes are actively exploitable.

AI-powered vulnerability strategist that analyzes Tenable scan data and recommends top 10 Exposure Response Initiatives with automated scoping

Tracks PHP2Shell and Node2Shell remediation from Tenable data with SLA tracking, VPR and run-to-run comparison.

Answers which scans target an IP, range, hostname, tag, agent group, asset list, scanner or credential across every scan in Tenable Vulnerability Management or Tenable Security Center, and audits scan configurations for duplicates, missing credentials and unparsable targets, from a read-only local snapshot.

Guided IEC 62443 zones-and-conduits onboarding for Tenable OT: validate, plan, approve, then create policies.

Reviews firewall changes against required and forbidden access policy using exact local range evaluation.

Migrate Tenable Enclave Security / Tenable.sc to standalone RHEL 8 with external PostgreSQL, preserving data and runtime.

Joins Tenable pentest/attack-path findings against Blue Team remediation to compute residual risk and an ATT&CK coverage heatmap.

Bridges a Tenable-detected vulnerability to any third-party patch management tool's MCP server via a small, vendor-neutral contract, polls the resulting job to a pass/fail signal, and — only on an explicit pass, with confirmation — calls SentinelOne's REST API to release containment on the patched host.

Classifies a Tenable One tenant across the five CTEM maturity stages and delivers a three-quarter roadmap

Cross-references Tenable's asset inventory against SentinelOne's agent inventory to find protection gaps and exposure blind spots — matches on hostname/IP, classifies each host, and can tag unprotected assets in Tenable for follow-up.

Cross-references a live Tenable One Attack Path Analysis toxic path against SentinelOne's real-time alert stream, and — with explicit confirmation — triggers SentinelOne network isolation on a path host showing active lateral-movement behavior.

Walks a PCI ASV user through the full three-month external scan cycle for network and web application targets — scan setup, launch and monitoring, finding review grouped by PCI DSS v4.0.1 requirement, dispute candidate identification, and a preliminary attestation readiness check.

Analyzes a completed PCI ASV scan and produces plain-English failure explanations, PCI DSS v4.0 requirement cross-references, a remediation leverage table (ranked by findings cleared per action), dispute-or-fix recommendations with evidence checklists, scan age validation, and an optional HTML report by asset.

Turns a Tenable CIS/STIG/PCI compliance scan into a remediation runbook, exception register, and POA&M. Read-only.

Report Tenable Security Center license utilization — licensed IPs, active IPs, expiration, and rolled-up utilization %.

Puts upcoming Tenable VM scan jobs on Google Calendar and flags any scan whose last run aborted or failed, so broken scan configs get noticed instead of quietly re-running unattended.

Download latest completed Tenable Security Center scans and emit filtered-column CSVs.

Build the FedRAMP Integrated Inventory Workbook (IIW) by reconciling a cloud fleet, Tenable Security Center, and Nessus Manager. Read-only, review-by-default.

Build FedRAMP POA&M workbooks from Tenable.sc — a vulnerability POA&M enriched with team attribution and remediation context, plus STIG/CIS Configuration Findings.

Query Tenable Security Center by plugin ID — deep per-host lookup for one plugin, or bulk present/not-found check across many plugins. Read-only.

Reconcile Nessus agents against a live AWS EC2 fleet and safely remove only the agents whose host is truly gone.

On-demand Nessus vulnerability and compliance/audit scans of specific hosts, one combined Excel report, and agent-profile assignment.

A dependency-free Claude skill that groups vulnerability findings by the fix they share and ranks the shortest set of actions that retires the most weighted risk.

Clusters Tenable vulnerability findings into prioritized, trend-aware remediation campaigns for analysts, managers, and executives.

Guided audit and cleanup of Claude Code standing permissions — works standalone, and drives the Reins MCP Server for deterministic classification and safe revocation when connected.

Passive, read-only pre-launch attack-surface review of a marketing campaign that outputs an executive launch verdict.

Externally verify Supabase RLS and Firebase Realtime Database security in Flutter apps.

AWS Lambda harness that injects test prompts into M365 Copilot for Tenable AI Exposure security testing

A reference guide explaining major security audits and compliance frameworks — what they are, who needs them, and what they cover.

A Claude Code skill that coaches CyberAgents Exchange contributors to promote a published agent, skill, MCP server, or playbook — on-brand copy, video scripts, and leaderboard optimization.

An Agent Skill that analyzes a Tenable Security Center instance for remediation SLA compliance and produces a VPR-prioritized remediation queue with CISA KEV cross-referencing. Use when working with Tenable.sc vulnerability data, SLA aging, or remediation prioritization.

Computes CISA BOD 26-04 remediation tiers for Tenable vulnerability findings using the directive's 4-variable model.

Walks a new Tenable Vulnerability Management user through onboarding — connectivity, scanner/agent linkage, first scan, the scan-to-findings milestone bridge, and tagging — by checking real account state instead of pointing at generic docs.

AI-powered risk-based prioritization for Tenable VM compliance benchmark failures

AI-powered daily audit log analyzer for Tenable that detects anomalies, classifies user behavior, and generates compliance-ready reports

Customizable email notification skill for Tenable VM with SMTPS security and professional HTML alert templates

What-if analysis engine for Tenable AES/CES remediation impact prediction with optimization algorithms

AI-powered tag recommendation skill that analyzes Tenable assets and creates intelligent, environment-specific tag taxonomies automatically