Built by Operators. Built for Those Who Defend.
SIRT.org is a practitioner-led platform for sharing operational security knowledge, methodologies, frameworks, and field experience. Its purpose is to help security professionals make better decisions and turn information into action.
The Operational Force Behind Security Response
A Security Incident Response Team protects business assets from security threats. It identifies risk, responds to attacks, investigates compromise, and helps the organization maintain business continuity. It brings together practitioners, specialist knowledge, and repeatable processes to turn security information into action.
Practical Knowledge for Operational Security
Cybersecurity has more technology, data, and alerts than ever, yet organizations still struggle to prevent attacks, understand active threats, and respond to compromise. Better outcomes require more than information: they require judgment, shared methods, and the ability to act.
Operational Knowledge
Publish practical methods, frameworks, research, and lessons that security professionals can use in real situations.
Defensive Capability
Help practitioners move from knowing security concepts to making sound decisions and taking effective action.
The Security Community
Give defenders a place to contribute ideas, present work, compare experience, and improve the field together.
From the Security Operator to SIRT.org
Security as an Operational Discipline
SIRT.org was founded by Lior Rotkovitch, a defensive security researcher, incident response practitioner, author, and framework developer whose career spans product security, vulnerability management, WAF technology, and incident response.
The platform follows the ideas developed in his book The Security Operator: A Field Manual for Cyber Defenders: defensive security is not merely a collection of products or alerts. It is an operational discipline built on judgment, responsibility, readiness, and action.
SIRT.org extends that idea into a growing body of frameworks, practical guidance, learning programs, projects, and community contributions.
Explore The Security Operator →From Vulnerability to Attack to Compromise
SIRT.org organizes defensive security around the three questions of AMI3A and the specialized functions responsible for turning each answer into action.
PSIRT
Handles vulnerabilities, evaluates exposure and business impact, and drives remediation before weakness becomes an incident.
Explore PSIRT →CSIRT
Handles active threats, analyzes attacker behavior, coordinates mitigation, and supports containment and recovery.
Explore CSIRT →TA-SIRT
Provides research, specialized expertise, technical guidance, architecture review, and evaluation to ensure the defensive system works.
Explore TA-SIRT →The SIRT.org Knowledge Areas
The platform covers the technical, operational, and human dimensions of defensive security.
Bring Your Experience Into the Work.
Cybersecurity improves when practitioners share what they have learned. If you have an idea, method, research project, AI use case, tool, case study, or field experience that can help defenders, SIRT.org would like to hear from you.