Free tool
Network and cyber attack diagram maker
Draw network and cyber attack diagrams in the browser. 100 objects in plain English, 76 with how they are attacked and what stops it. Open data.
Every diagramming tool hands you a palette of shapes and assumes you already know what they mean. That is fine for the person drawing and useless to the board, the auditor and the new starter who have to read the result. Here all 100 objects are named in plain English and the acronym is kept as a searchable alias, so a web application firewall is a web app shield and typing WAF still finds it. Select anything on the canvas and it tells you what it is, why it earns a place on a security diagram, how that kind of thing tends to be attacked, and what reduces it. Then it draws quickly, because positioning is the slow part of every comparable editor: press N, type a few letters, press Enter, and Tab adds the next object already connected to the last. Nothing is positioned by hand.
Nothing leaves your browser: A diagram of your own network is a map of where you are weakest, and every browser-based diagramming tool asks you to upload one. Nothing here is uploaded. The document and every export are produced in this browser, there is no account and no cloud save, and the page is served with a Content Security Policy that permits no third-party origin and forbids script from opening a network connection to anywhere, this site included. Open your developer tools and watch the network tab while you draw.
NetworkMap
Editing needs a bigger screen. This tool works from 768 pixels wide. The worked examples below can be read on any size.
Press N to add an object, Tab to add one connected to the selection, Enter to rename, arrow keys to move, Delete to remove, F to fit. Press Escape to release these keys, then Tab to leave the canvas.
Start typing to build
Press N, type a few letters of what you want, and press Enter. Then Tab to add the next thing, already connected. Nothing is positioned by hand.
NaddTabadd connectedEnterrenameBboundaryDelremoveFfitdrag a portconnectdrag from the paletteplace
0 objects, 0 links, 0 boundaries. Everything runs in your browser: open the network tab and watch nothing happen. Nothing is uploaded and nothing is stored.
Why the objects are not named with acronyms
A security diagram is almost never read only by the person who drew it. It goes to a board, to an auditor, to an insurer, to a new starter. Every one of those readers meets a picture full of terms that were never explained to them, and most of them nod rather than ask.
So the plain name leads and the technical term follows. A web application firewall is a Web app shield. Network attached storage is a Shared file store. A hypervisor is a Virtual machine host. Nothing is lost: every acronym survives as a searchable alias, so typing WAF finds the shield, and an expert names toggle puts the original labels back for anyone who prefers them.
Every attack, beside its defence
Selecting an object tells you what it is, why it earns a place on a security diagram, how it tends to be attacked, and what reduces that. The last part is a rule rather than a nicety: 76 of the 100 objects carry attack notes, and every one of them ships beside its defences. Where a control is only partial, it says so, because a control described as complete when it is not is worse than no advice at all.
Web app shield
WAF · web application firewallChecks visits to your website and blocks the ones that look like an attack.
It buys time against known attack shapes, but it is a filter in front of the flaw, not a fix for it.
How it gets attacked
- Requests reshaped until they no longer match a filter
- Origin server reachable directly, bypassing the shield entirely
What reduces it
- Fix the flaw behind it, because this is a filter in front of a weakness rather than a repair of it
- Make the origin server unreachable except through the shield, or it is simply bypassed
Backup vault
immutable backup · offline backupA copy of your data held so that it cannot be changed or deleted for a set period, including by an administrator, for as long as the retention lock is genuinely in force.
It is the control that decides whether operations can be restored without paying, because it is the copy the encryption could not reach. It does nothing about data already copied out, which is why recovery and disclosure are two separate problems.
How it gets attacked
- Retention locks not actually enabled
- The only copy sitting on the same network as the live data
What reduces it
- Confirm the retention lock is actually enabled, not merely available
- Keep the copy off the network and under different credentials from production
- Retain for longer than the time an intruder was present, or every surviving copy contains them
Second factor
MFA · 2FAA second proof of identity beyond the password.
It removes the value of a stolen password on its own, which is why the systems it does not cover are where intrusions tend to start. How much it removes depends entirely on which second factor: a hardware key resists the phishing that intercepts a code or a prompt.
How it gets attacked
- Repeated approval prompts until somebody accepts one
- Sign-in paths that were never covered by it
What reduces it
- Prefer a hardware key or passkey, which is bound to the site and resists relay; a code or prompt is not
- Cover every sign-in path, because the one that was missed is the one that gets used
- Alert on a factor being registered through account recovery, which is how a real one gets replaced
Typing, not dragging
Nothing on the canvas is positioned by hand. Press N, type a few letters of what you want, press Enter, and the object is placed and connected to whatever was selected. Then Tab commits the label, creates the next object already joined to the last, and puts the cursor back in the search box. A ten-object diagram is one unbroken run of typing with no trip to the palette.
Search runs over all 100 names and every alias behind them, so four characters usually resolve an object unambiguously. A Keystroke-Level Model estimate of that flow, compared with select from palette, drag, position and then draw a connector, puts it at roughly two and a half times faster on a ten-object diagram. That is a model of the interaction rather than a measured user study, and no user study has been run. Treat it as an argument about where the time goes in a drawing tool.
What you can put on a diagram
100 objects across 12 groups, written against the standard sources for each domain and reviewed for accuracy across network engineering, infrastructure, cloud, wireless, threat intelligence and security architecture. Each group has a page of its own carrying every object in it: what it is, why it earns a place on a security diagram, how it tends to be attacked and what reduces that.
Network paths on a network diagram
The paths traffic travels along.
The internet, Router, Switch, Remote access gateway, Address range, Internet network operator.
Wireless and radio on a network diagram
The parts of the network that travel through the air, and how far they reach.
Wi-Fi access point, Wireless network name, Wireless controller, Mobile broadband router, Satellite terminal, Satellite time and location receiver, Bluetooth device, Low-power radio device, Radio gateway, Contactless reader, Wireless monitoring sensor.
Cloud and subscribed services on a network diagram
Things that only exist because somebody else runs the platform underneath them.
Cloud platform, AI model endpoint, Cloud account, Cloud account group, Cloud control panel, Supplier-run application, Connected app, Managed database, On-demand function, Container platform, Container image store, Infrastructure blueprint.
Security and edge on a network diagram
The things that sit in front of something else and check what is trying to reach it.
Firewall, Web app shield, Outbound web filter, Traffic splitter, Global content cache, API front door, Endpoint protection, Log collector, Secrets store, Encryption key service, Cloud activity record.
Servers on a network diagram
Machines that run something for other machines.
Server, Web server, Application server, Database, Mail server, Name server, File server, Virtual machine host, Jump host, Backup server, Update server, Build pipeline, Phone system.
Storage on a network diagram
Where data sits still.
Shared file store, Storage network, Cloud storage, Backup vault.
Endpoints and devices on a network diagram
The things people and processes touch directly.
Desktop computer, Laptop, Mobile phone, Printer, Smart device, Plant equipment, Machine controller, Door access reader.
Identity on a network diagram
Who something claims to be, and what proves it.
Sign-in service, Directory service, Second factor, Machine account, Certificate, Access badge.
People and organisations on a network diagram
The humans and the entities they belong to.
Person, Supplier, Organisation, Customer.
Process flow on a process diagram
Shapes for describing a procedure rather than a network.
Start or end, Step, Decision, Data, Document, Subprocess, Note.
Threats on a network diagram
The adversary and the things they bring.
Attacker, Insider, Malicious software, Ransomware, Phishing lure, Stolen credentials, Attacker control server, Look-alike wireless network, Fake mobile mast, Signal jammer, Counterfeit location signal, Cloned badge, Planted device, Hijacked device network, Attacker's data store.
Use the data
The catalogue behind this tool is published as open JSON under CC BY 4.0, currently version 2, reviewed . It carries the plain-English definitions, the acronyms as aliases, 174 attack notes and the 215 defence notes paired with them. Every attack note describes a mechanism and contains no procedure.
Where the idea came from
A diagram editor built for network and attack narratives is not a new idea, and this one was inspired by net_draw by mr-r3b00t. It was built clean-room, with no code, no icons and no data taken, and every definition here written from scratch.
What this deliberately will not do
It will not tell you whether you are secure. A diagram is an assertion by whoever drew it, not evidence, and a tool that scored it would be grading the drawing rather than the estate.
It also does not attempt to be a general drawing package. There are good ones, and they will always beat this on shapes and styling. What they will not do is tell you what the box you just placed actually is, or how it tends to be attacked, while you are still drawing it.
Common questions
›Is my diagram uploaded anywhere?
No. There is no account, no cloud save and no share link for a diagram, because there is no server holding one. The document is assembled in your browser and every export is written on your own machine: the PNG is drawn on a canvas, the SVG and the saved file are built as text, and all three are handed to the browser as a local download. Nothing is uploaded and nothing is stored, which is also why a refresh loses your work. The page is served with a Content Security Policy of connect-src 'none', which forbids fetch, XMLHttpRequest, WebSocket, EventSource and sendBeacon to every destination including this site's own server, so no script on the page can open a channel to send anything anywhere. No third-party origin is permitted by the policy at all, and the page loads no analytics, no tag manager and no font CDN. Open your developer tools, watch the network tab, and draw: nothing happens. Two honest limits. The policy stops script sending your diagram; it cannot stop you sending it, so the saved file is yours to protect once you email it. And sendBeacon returns true even when the policy blocks it, so trust the network tab rather than the return value if you are testing this yourself.
›Can I use the diagrams commercially?
Yes, with no permission and no attribution. What you draw is yours, and there is no copy of it here to license. The separate question is the object catalogue underneath, meaning the plain-English definitions, the attack notes and the defence notes, which is published under Creative Commons Attribution 4.0. If you reproduce that wording in a report, a course or a product, credit it as: NetworkMap object catalogue, P.K. Sharma, pk-sharma.com, CC BY 4.0. The icons are Lucide, under its own permissive open source licence. There is nothing to subscribe to, and nothing that stops working later.
›Why are the objects not called WAF, NAS and IdP?
Because an acronym is a private language and a security diagram has a mixed audience. A drawing that a board, an auditor, a new starter and an incident responder all have to read cannot assume everybody knows that a NAS is a shared file store. The acronyms are not deleted, they are demoted: every one survives as a searchable alias, so typing WAF, NGFW, IdP or SIEM finds the right object immediately while the label on the canvas still says what the thing does. A practitioner loses nothing, because they type the acronym they already know. Everyone else gains a diagram that does not need a glossary beside it.
›How is this different from draw.io or Visio?
Those are general diagramming tools. They will draw anything, and they understand nothing about what they are drawing: a rectangle labelled firewall is a rectangle. Here every object is an entry in a catalogue, so selecting one produces what it is, why it belongs on a security diagram, how that kind of thing is attacked and what reduces it, and the same data drives the search box, so four letters place the right object already connected to the last one. The trade is deliberate. This draws network diagrams, attack diagrams and process flows, and it will not draw an org chart, a floor plan or a wiring schematic. It also does not open .drawio or .vsdx files and does not write them, so it is a tool to draw the next diagram in rather than a place to migrate the old ones.
›What is the open JSON for?
Citing, checking and building on. The whole catalogue is served at /api/tools/network-map.json under Creative Commons Attribution 4.0, with a version number and the date it was last reviewed, so a reference can be pinned to a version rather than to whatever the page happened to say that day. It is the same data the editor runs on, so nothing shown in the interface is withheld from a machine reading it. Sensible uses: pull the plain-English names into your own stencil set, map the attack and defence notes into a control framework, generate a glossary for an induction pack, or let a language model answer what a jump host is without inventing an answer. Corrections are welcome and produce a version bump rather than a silent edit.
When you need more than a tool
vCISO Advisory
Embedded security leadership one to three days a week: board reporting, programme direction, and decisions taken with accountability, without a full-time hire.
Discuss vCISO support
