Why this exists.

Christopher Lloyd built Cyber Toolbox because incidents, hunts and exposures don't fail for lack of tools — they fail in the coordination between them. Teams already have alerting, EDR, SIEM and ticketing. What they don't have is a single place where the work is coordinated: where a hunch becomes a hypothesis, a finding becomes an exposure or an incident, and an incident is walked to closure with the evidence, decisions and regulator clocks in one record.

That coordination usually lives in people's heads, spreadsheets and a dozen chat threads — and that's where things get dropped. Cyber Toolbox is the coordination layer. It doesn't replace your EDR or your SIEM; it sits above them and runs the operation — the playbook, the walk, the handoff, the case, the audit trail. Three security lifecycles, one platform, one record.

It's operator-first by design: built by responders, for responders — keyboard-driven walks, runbooks inline, vendor-neutral, no fluff. Founded and built in New Zealand. Cyber Toolbox is in active development ahead of launch; we are building with founding customers and shipping quickly.