Knowledge map

Caretakers for each category WANTED! Do you find yourself particularly interested in maintaing whole category? Or your expertise rather more defined and you want to be author of particular sections or topics?

Let me know in DMs!

Haven of Thought is a thorough compendium of security related knowledge, with following structure:

• Category - Highest level of structure, defines whole areas (e.g. Offensive Security)
• Section - Subcategory, breaks down each Category into various approaches to the subject (e.g. Domains),
• Topic - Topics are separate chapters for each Section, they may introduce their own structure if described concept is complex but can be also simple one-pagers,
• Caretakers - Core maintainers of Categories and Sections, they not only share their knowledge but also manage whole structure to ensure Wiki is transparent and logical,
• Authors - Essential members, who may contribute to the Wiki by creating new topics and sharing their expertise.

Offensive Security (Red Team)

This category covers offensive operations: penetration testing, adversary emulation, red teaming, and all tradecraft for breaching security controls, staying undetected, and maintaining target control.

Following sections have been identified for Offensive Security Overview:

• Tactics Inspired by MITRE ATT&CK, organized by attack stages and objectives (tactics): reconnaissance, initial access, stealthy exploitation, lateral movement, persistence, and beyond.
• Domains Domain-centric approach for each platform (e.g.OS, mobile, web, cloud) including quirks, mechanisms, and unique TTPs that are most efficient for particular environment.
• Resources Practical practical toolkit: wikis, payloads, wordlists, docs, repositories and training platforms.

Current Caretakers: Bezimek Current Authors: Etherior Halgawar Gal

---

Defensive Operations (Blue Team)

This category covers defensive operations: threat detection, incident response, vulnerability management, and hardening to protect systems, networks, and data from attacks.

Following sections have been identified for Defensive Operations:

• Methods Inspired by MITRE D3FEND and organized by response stages: detection, analysis, containment, eradication, recovery, and hardening.
• Domains Domain-centric approach for each platform (e.g. OS, mobile, web, cloud) including monitoring setups, hardening configs and detection rules tailored to environment-specific threats.
• Resources Practical defensive toolkit: SIEM/EDR docs, threat intel feeds, vuln scanners, IR playbooks, repos and training platforms for monitoring, hunting, and response.

Current Caretakers: Bezimek Current Authors:

---

Governance, Risk and Compliance (GRC)

This category covers the organizational and regulatory side of cybersecurity: asset and risk management, process governanc and compliance obligations that keep things structured and audit-ready.

Following sections have been identified for Governance, Risk and Compliance:

• Concepts Core standards and practices for asset classification, process governance and control frameworks, including data protection, incident response, risk management and compliance fundamentals.
• Sectors Sector-centric approach for each regulated industry (e.g. FinTech, Healthcare, TelCom/ICT) this section breaks down the specific assets, requirements and know-how that apply to particular organization.
• Resources Practical regulatory toolkit: key regulations, standards, control frameworks and tools used to assess, track, and maintain compliance.

Current Caretakers: Bezimek Current Authors:

---

Engineering & Architecture

This category covers building and designing secure systems: from architecture and security-by-design principles to proper design patterns and infrastructure choices across the full development lifecycle.

Following sections have been identified for Engineering & Architecture:

• Domains Domain-centric approach for each technology area (e.g. Apps, Network, IaM) focuses on know-how and procedures specific to designing and operating it properly.
• Resources Practical engineering toolkit: tools, frameworks, documentations, design pattern and methodologies, everything useful to architect, build and maintain systems/services.

Current Caretakers: Bezimek Current Authors:

---

Automation

This category covers getting things up and running fast: automation, scripting, ready-to-go tooling, and integrations (plus AI helpers) so you can launch an environment in minutes.

Following sections have been identified for Automation:

• Quick Deploy Spin things up fast: serverless functions, managed services, containers and quick-spin services, deployment options where the infra overhead is either minimal or abstracted away entirely.
• DevTools The dev toolkit: programming environments, environment setup & redistribution, day-to-day utilities and tooling that keep the workflow efficient.
• AI AI for automation: core concepts, hosted vs managed LLM setups, agents, prompt engineering, and MCP (Model Context Protocol) for integrating LLM tools into external systems and workflows.
• Workflow & Integrations System glue: orchestration patterns, APIs, and webhooks for building reliable, event-driven pipelines and service-to-service integrations.

Current Caretakers: Bezimek Current Authors: