Methodologies for the security work a central team can't do alone.
Federated Cybersecurity™ is a family of methodologies for the parts of security that depend on people: assessments, risk decisions and plans. Each one divides that work among the teams best placed to do it.
- Shared principles.
- Local autonomy.
- A common language for cyber resilience.
Why federated
Technical controls scale with automation.
Administrative controls have mostly scaled by adding staff.
Assessments, security plans, reviews and risk decisions depend on people who know the system in question. In a decentralized organization, most of those people work outside the security office. A central team can do this work well for maybe a few hundred systems while thousands more go unexamined.
The risk in a system belongs to the people who run it. When a central team does every assessment, the rest of the organization starts to assume the security office owns that risk, including in systems it cannot control.
The Federated Cybersecurity methodologies take a different route. Each one places a piece of security work with the team that knows it best and gives that team a structured way to do it. The security office keeps the standards, the shared services and the view across the whole organization.
What the word means here
Federated describes how the work is organized: local teams act with real authority, inside a framework they all share.
How this site is organized
There are two layers: the methodology pages, and the articles.
The methodology pages are a foundation
One page sets out what the methodologies share, and each methodology has a page of its own. Together they give an overview of what each one is and how it works. Start here.
The articles build on them
Each article takes one idea further. Some show ways to apply the concepts in a working organization. Others cover advanced topics that the pages only introduce.
Plain language
The methodologies invite people into security work who are not security professionals: the people who run labs, clinics, business offices and applications. Writing that needs a glossary would turn them away at the door.
So this site avoids introducing a domain-specific vocabulary that is new to many participants. Where an ordinary word will do, it is used, and a reader is not asked to learn a system of terms before the ideas make sense.
The methodologies
One shared foundation, two methodologies for doing the work, and one for seeing it.
Federated Cybersecurity™
What the methodologies share: who owns the risk, who takes part, and the five principles of participation.
Federated Cyber Risk™
How an organization runs its cyber risk program as shared work. Each resource team assesses, decides and plans for the resources it owns.
Covers risk management, security planning, compliance tracking, remediation, and how to measure the practice.
Federated Third-Party Risk
How vendors and other outside parties are assessed, and how the gaps they leave are covered. Compensating work lands in the plan of each team that depends on the vendor, while the gap stays attributed to the vendor.
Covers vendor assessment, compensating controls, and the vendor's place in the dependency graph. The newest of the three, added in 2026.
Federated Practice Monitoring
How an organization reads its own security practice once the work is shared. Signals from the work show how the practice is running and where to step in first. It is federated too: teams monitor themselves, units monitor their teams, and the security office monitors the whole.
Covers the signals and what they indicate, rollup and drill-down, reading the scores, and playbooks.
Using the methodologies
In your own organization
Free. Any organization may use the methodologies to manage its own cybersecurity, adapt them to its own structure, and train its own people. It may also talk about that work at conferences and other events, and use the materials on this site there, with attribution. No permission is needed.
In a product or service
Building the methodologies into something you sell, or offering services under their names, requires a commercial license from Syzygy Technology Services.
To ask about a license, write to inquiries@federatedcybersecurity.com.
Who publishes this
The methodologies are developed and published by Syzygy Technology Services LLC, which holds their copyright and trademarks. They have been in development since 2018.
The lead researcher and primary author, Sonya Lowry, also founded SibylSoft, whose product Sibylity is a licensed commercial implementation of Federated Cybersecurity practices. More about the people and that relationship