ShieldsUP — Cyber Defense Readiness in the AI Era

Welcome / guided facilitation

ShieldsUP Cyber Defense Readiness in the AI Era

A live, sectioned workshop experience: capture the customer context, walk one domain at a time, then turn answers into an executive decision, roadmap, Cisco accelerator path, and source-backed practitioner library.

How to read this report

Executives →Start with the board summary, decision ask, prioritized actions, and Cisco funding path.

Practitioners →Go deeper into domain scores, ODM metrics, control evidence, and Further Reading sources.

Facilitator note

Run the assessment as an interview, not a form. Complete one domain at a time, mark non-applicable controls as N/A, capture evidence in notes, and use the Results section to align on funded remediation or explicit risk acceptance.

Progress: the top bar tracks answered controls out of 54. A domain check appears when all six controls are answered or marked N/A.

AI acceleration briefing

The patch cycle is no longer the control plane.

Project Glasswing is the frame; Mythos is the warning. The report treats AI-assisted vulnerability discovery as an operating-model problem, not as another tooling category.

Evidence used in this assessmentCisco Talos, “Patching in the Dark” (2026-06-18), is reflected in the threat model: Mythos and Fable compress disclosure-to-exploit toward minutes. The consequence is concrete: reachable infrastructure debt becomes exploitable before normal change windows can respond.

01What changed

Frontier models alter the economics of finding and chaining vulnerabilities. The assessment therefore scores current-state controls only, not intent or roadmap claims.

02Why it matters here

Unpatched, unsupported, over-exposed, or poorly segmented infrastructure stops being latent risk. It becomes a time-window problem.

03How this becomes work

Scores flow into a three-phase path: Exposure Assessment, Infrastructure Modernization, and Defense Resiliency.

An initiative to secure the world's software — Project GlasswingPrimary explainer: why Project Glasswing exists and why software security has to move closer to the speed of vulnerability discovery.

Audio

Speed

An initiative to secure the world's software — Project Glasswing
Video available in the interactive version.

Glasswing: Mythos demands a new model for infrastructureCompanion context: how AI-assisted exploitation changes the infrastructure operating model.

Audio

Speed

Glasswing: Mythos demands a new model for infrastructure
Video available in the interactive version.

Route to action

Use the assessment to decide what must be funded, owned, or explicitly accepted.

1 · Score the current state54 controls, evidence notes, confidence flags, and no credit for future intent.

2 · Map gaps to the lifecycleExposure Assessment → Infrastructure Modernization → Defense Resiliency.

3 · Convert results into a Cisco pathThe Cisco Accelerator maps scored gaps to architecture, services, and follow-up decisions.

01 / Guided assessment

Assessment — one domain at a time

Complete the engagement context, tune domain weights if needed, then facilitate each domain view in sequence.

Engagement header

Assessment context

Required. To start the assessment: a reference, a date, and scope or industry. Assessor and rosters are optional (they enrich the report cover).

Anonymous engagement — don't share identifying info

Customer or engagement reference *

Use the customer name or a non-identifying alias/code. Required to start.

Industry

Assessor

Date *

Scope scope or industry required *

Weighting model

Domain weight editor

Official scoring always uses the locked default domain weights. Scenario weighting is optional and must sum to 100; if it does not, the scenario score is withheld.

Advanced / Scenario weightingPresets:

Scenario sum100

Export & share Print / Save as PDF works offline. For a shareable live link or the official Word report, use Save to cloud → Finalize → Share with customer below.

Board page 1 / Executive summary

Decision-ready summary & The Ask

Auto-generated from the assessment and editable for board language. Narrative fields persist in autosave and JSON exports.

Score at a glance and analytical dashboardDomain radar, SAFE surfaces, CTEM strip, ODM, NIST CSF 2.0 and answer-quality views.

Live dashboard

Executive readiness view

Overall score, banding, domain breakdown, SAFE surface scores, CTEM strip and Protection-Level rollup.

Overall readiness

—

No answers yet

Cisco overall bands: Emerging · Developing · Established · Advanced

Domain radar

Readiness by domain

Ranked by score, sized by weight — longer is stronger; thicker bars carry more of your overall score.

SAFE attack-surface scores

CTEM phase strip

Domain heatmap

Protection-Level view — ODM current → target

Average current and target by Outcome-Driven Metric category. Current defaults to stage-derived proxy unless overridden.

NIST CSF 2.0 cross-map

Function heatmap (non-scoring)

Read-only mapping from ShieldsUP domains to CSF 2.0 Functions. Recover is indicative only; see Defense Resiliency phase.

Answer quality

Low-confidence answers to revisit

Confidence and evidence annotations never change score; they guide follow-up validation.

Recommendations and domain narrativePreserved advisory cards, pillar framing and lowest-domain expansion.

Full findings backlogSeverity, domain, owner, effort and expandable remediation detail for every sub-Optimal control.

Findings

Findings & recommendations

Automatically generated for answered controls below Optimal, severity-sorted using the catalog rule.

Prioritized action planningQuick wins versus strategic moves, derived from the existing findings pool.

Top actions

Quick wins vs strategic moves

Prioritized actions for execution planning, derived deterministically from severity, weight and remediation effort signals.

3-phase roadmapExposure Assessment, Infrastructure Modernization and Defense Resiliency mapped from findings.

Resilient Infrastructure

Roadmap

Sub-Optimal findings mapped into Exposure Assessment, Infrastructure Modernization and Defense Resiliency phases.

03 / Cisco recommended next step

Cisco Accelerator

The assessment body remains vendor-agnostic; this closing section converts the lowest-scoring domains into a fundable Cisco starting point.

04 / Evidence library

Assessment methodology & provenance

Reusable instrument anchored in Cisco and industry operating models.