PumaSkills

PumaSkills assesses what a security team can actually do. You record a proficiency level for each person against each competency, compare that to what their role requires, and read out the gaps — per person, per role, per shift, and across the team.

The matrix is the app. People down the side, competencies across the top, one click per cell to cycle 0–4. A corner wedge appears when someone is short of what their role needs, so the gaps surface while you type rather than in a report afterwards.
Requirements come from roles, not opinions. A role carries a required level per competency. The same level 2 is a pass for a Tier 1 analyst and a gap for a Tier 3, and the app scores it accordingly.
Skills decay, and the app says so. Every rating can carry a last used date. A level 4 nobody has exercised in two years is flagged stale — it is the difference between a team that can do the work and a team that could, once.
Single points of failure. The Gaps view finds competencies where exactly one person is capable, and competencies where nobody is. On a 24/7 team that second list is the on-call risk register.
Coverage answers the rota question. Define shifts, say what each one must be able to do unaided, and the app tells you which shift has nobody who can do it.
Development plans, not wishes. Each gap can become a plan item with a target level, a method, hours and cost, so the training budget is derived from the gap list rather than argued for.
Hiring falls out of the gaps. Open a requisition against a role and PumaSkills drafts the job spec from that role's requirement profile and builds an interview scorecard weighted to the competencies you are actually missing.
Two bundled catalogues. A practical IR / SOC / threat-hunting taxonomy for day-to-day work, and a NICE-aligned work-role set for formal deliverables. Add your own domains, competencies and roles at any time.
Assessments are workspaces. Each tab is one team snapshot — a client engagement, or your own team this quarter. They share nothing, so a client's data never mixes with yours.

Competency assessment goes wrong in predictable ways. This is the method the app is shaped around.

1. Fix the scale before you rate anybody. Five levels, and they describe evidence, not confidence:

0 — None. No exposure. This is a legitimate answer, not a failure.
1 — Awareness. Can describe it and follow a runbook with supervision.
2 — Working. Handles routine cases unaided. This is the bar for most shift work.
3 — Practitioner. Handles novel and complex cases, and reviews other people's work.
4 — Authority. Sets the standard, teaches it, and represents the organisation on it.

2. Require levels per role, then measure against them. A gap is not "below 4" — it is "below what this role needs". Requiring level 4 everywhere produces a red matrix that tells you nothing. Most roles need a small number of 3s and a lot of 2s.

3. Rate against evidence, and record whose judgement it is. Self-assessment alone is unreliable in both directions: the strongest people under-rate and the least experienced over-rate. Mark each rating with its method — self, manager, peer, observed in an incident, or tested — so a reader can weigh it. Ratings that came from watching someone work a real case are worth more than any of the others.

4. Treat currency as part of the score. Memory forensics, on-call command, packet analysis: all decay within a year of disuse. Record when a skill was last exercised, and read a stale 3 as closer to a 2.

5. Look for depth, not average. A team average hides the thing that hurts. Two questions matter more: what can nobody do, and what can only one person do. Both are single points of failure, and the second one takes holidays.

6. Close gaps in the cheapest order. For each gap the options are develop, hire, contract, or accept — in roughly that order of cost. Development plans and requisitions live in the same app as the gap list so the choice is explicit and recorded rather than defaulting to "put it in next year's budget".

7. Re-assess on a cadence, not after an incident. Quarterly or half-yearly, as a fresh assessment tab. Comparing two snapshots shows whether the training actually moved anything, which is the only evidence that the programme works.

Frameworks: the bundled NICE-aligned catalogue follows the categories and work roles of the NIST Workforce Framework for Cybersecurity (SP 800-181r1). The competency wording and the role requirement profiles are PumaWorx's, not NIST's — check the current NICE release if you need to cite it directly.

Everything lives in this browser's localStorage under the pumaskills. prefix. No network, no server, no account.

Export writes a .pumapack — every assessment, person, rating, plan and requisition in one JSON file. ⌘S / Ctrl+S does the same.
Import accepts that file back, or you can drag it onto the window.
An assessment can also be exported on its own as Markdown (the client-facing report) or .xlsx (the matrix as a live workbook).
Clearing site data, private windows, and switching browsers all lose the lot. Export before anything you would not want to redo.

Personnel data. This app stores names alongside judgements about competence. That is exactly the kind of record that should not be in a SaaS tool you have not reviewed, which is much of why it is built this way — but staying local does not make it exempt. Know your obligations, tell people they are being assessed, and delete assessments you no longer need.

Clear all local data

Danger zone. This erases every PumaSkills assessment in this browser — every person, rating, plan and requisition. Export a backup first.

⌘/Ctrl + K

Command palette — jump to any view, person, role, or action

?

Open this help

⌘/Ctrl + S

Save a quick backup

1–8

Switch view

P

Add a person

/

Focus the filter box

0–4

Set the focused matrix cell's level

← → ↑ ↓

Move around the matrix

Esc

Close drawer / dialog / menu

PumaSkills is a lightweight, portable, offline competency assessment tool for security teams. It records what each person can do, compares it to what their role requires, and turns the difference into gap analysis, development plans, shift-coverage checks and hiring specs.

It is part of PumaWorx, a set of single-file offline tools for security and consulting work. Everything runs from one HTML file with no dependencies and no network.

Provided as-is, with no warranty. Competency assessment is a judgement exercise: the app records and computes on judgements you supply, and does not validate them. Nothing here is employment, legal or HR advice.

About PumaWorx

PumaWorx is a suite of offline, single-HTML productivity apps that run entirely in your local browser. The entire suite is a personal, open source vibecoding project.

Dev build

Built by greykit.com

PumaSkills — security team competency assessment

Clear all local data

About PumaWorx