Startup Security Guide & LLM CISO

An open-source security guide, compliance checklist, and LLM-based virtual CISO persona for startups -- with specialized coverage for foreign companies entering the Korean market.

Startups are vulnerable. Limited resources, no dedicated CISO, and security always deferred to "later." But customer data and intellectual property accumulate from day one -- and legal obligations apply regardless of company size.

Three incidents from Korea in the first half of 2026 demonstrate that one misconfiguration can cascade into existential damage:

The common thread: All three began with a single misconfiguration or a single overlooked vulnerability. None required sophisticated zero-days. The damage was inversely proportional to organizational maturity.

What startups need is not a $100K security suite. It is knowing what to do first, and a system to check it regularly.

An LLM can serve as a startup's first CISO.

As of mid-2026, Claude 4, GPT-4o, and DeepSeek V3 -- alongside locally-run models via Ollama -- can:

A hybrid model -- where proprietary data stays on-premise with local LLMs (Ollama) and general policy assessment uses public LLMs -- makes this production-ready today.

This project implements that hypothesis in code and prompts.

Korea is Asia's fourth-largest economy and a strategic launch market for SaaS, fintech, AI, and consumer platforms. But its data protection regime presents unique challenges that differ significantly from GDPR and CCPA:

Key Insight: A GDPR-compliant EU startup is not automatically PIPA-compliant in Korea. The Korean law has stricter encryption mandates, mandatory access logging, and a universal CPO requirement that has no equivalent in GDPR or CCPA. Violations carry criminal penalties, not just civil fines.

This project's LLM CISO persona includes jurisdiction-aware compliance modules that flag these gaps automatically.

Startup_Security_Guide/
├── README.md                        # Korean README
├── README_EN.md                     # This document: English README
├── STARTUP_SECURITY_GUIDE_KR.md     # Phase 1: Korean guide & checklist
├── STARTUP_SECURITY_GUIDE_EN.md     # Phase 1: English guide (with jurisdiction comparison)
├── LLM_CISO_PROMPT_KR.md            # Phase 2: Korean CISO prompt system
├── LLM_CISO_PROMPT_EN.md            # Phase 2: English CISO prompt system (cross-jurisdiction)
├── LLM_CISO_DASHBOARD.md            # Phase 3: Dashboard design (Korean)
├── LLM_CISO_DASHBOARD_EN.md         # Phase 3: Dashboard design (English)
└── llms.txt                         # LLM-friendly index

A comprehensive, stage-gated security guide covering the startup lifecycle from pre-seed to Series A. Based on KISA guidelines and the MINARC framework (startup-security.netlify.app), extended with:

Usage: Open in a browser to follow the checklist, or provide the full document as context to an LLM and ask: "Evaluate our company against this checklist."

A persona prompt system that transforms any LLM into a virtual CISO with explicit cross-jurisdictional expertise. Includes:

Usage -- Public LLM:

1. Copy the "Base CISO Persona" section from LLM_CISO_PROMPT_EN.md as System Prompt
2. Copy the desired domain assessment prompt as User Message
3. Provide specific company context (jurisdiction, data types, stage)

Usage -- Local LLM (Ollama):

brew install ollama            # macOS

ollama pull llama3:8b          # or gemma3:12b, qwen2.5:14b

cat > Modelfile << 'EOF'
FROM llama3:8b
SYSTEM """You are a Virtual CISO for startups, specializing in cross-jurisdictional
compliance (GDPR, CCPA, PIPA/Korea). You identify gaps where compliance in one
jurisdiction does not satisfy another..."""
PARAMETER temperature 0.3
EOF

ollama create ciso-global -f Modelfile

ollama run ciso-global "We are a US-based SaaS startup (Series A, 25 employees, AWS + Google Workspace)
expanding into Korea. We comply with CCPA. What additional measures do we need for PIPA?"

Usage -- TypeScript/Node.js (Vercel deployment):

git clone https://github.com/gameworkerkim/CYBER-THREAT-INTELLIGENCE-REPORT.git
cd CYBER-THREAT-INTELLIGENCE-REPORT/Startup_Security_Guide

npm install

export ANTHROPIC_API_KEY="sk-ant-..."
export CISO_MODE="public"   # or "local" for Ollama

npm run assess -- --domain cross-jurisdiction \
  --context '{"homeCountry":"us","targetCountry":"kr","stage":"series-a","teamSize":25}'

Web-based CISO dashboard design document. Planned implementation with Next.js + Vercel + TypeScript:

Phase 1 (Done)     Phase 2 (Done)      Phase 3 (Planned)    Phase 4 (Planned)
     |                   |                     |                    |
     v                   v                     v                    v
Security Guide     LLM CISO Persona      Web Dashboard        Unified Monitoring
& Checklist        & Prompt System                             Framework
                                           |                    |
                                           +-- CLI MVP          +-- Wazuh/XDR integration
                                           +-- Web UI           +-- Real-time alerts
                                           +-- Cron automation  +-- SIEM integration
                                           +-- Multi-LLM        +-- Team dashboard

The end goal is a self-hosted dashboard that startups access daily. Not merely a checklist viewer, but an integrated monitoring system where the LLM periodically scans infrastructure, detects anomalies, and prioritizes remediation actions -- functioning as an always-on virtual CISO.

Curated evaluation of open-source and research projects relevant to AI-assisted security governance. Current as of June 2026.

This project is open-source and welcomes contributions:

Contribute via GitHub Issues or Pull Requests. All contributions follow the CC BY-NC-SA 4.0 license.

This guide and prompt system are provided for educational and defensive purposes. Actual security architecture and regulatory compliance depend on each company's specific circumstances. Critical legal decisions require professional review. LLM assessments are assistive tools; automated evaluation results should not be relied upon as sole grounds for compliance decisions.

Maintained by

[Dennis Kim]| (c) 2026 |[CC BY-NC-SA 4.0]