Learning Tracks
Four tracks, dozens of sub-tracks, and every lesson available self-paced or live, 1-on-1, with a volunteer tutor.
From curious to capable defender.
A single free lesson covering all nine cybersecurity domains. Required before unlocking any sub-track.
Passwords, MFA, RBAC, SSO, Privileged Access Management, hands-on Entra ID / AWS IAM / OAuth flows / Zero Trust.
CVEs, CVSS, Nmap scanning, hands-on OpenVAS, enterprise patch management, and continuous vulnerability programs.
OWASP Top 10 (hands-on in DVWA and WebGoat), injection, XSS, secure code review, bug bounty, and WAFs.
NIST IR lifecycle, detection, containment, eradication, recovery, SIEM with Splunk, and tabletop exercises.
Data classification, encryption, DLP tools, insider threats, and compliance regulations.
Ethics-first legal frame, full PTES methodology, exploitation, web app testing, post-exploit, HTB Starting Point passion project, and professional reporting.
Risk assessment, security policies, compliance frameworks, and business continuity.
OS hardening, endpoint protection platforms, MDM, patch management, and IoT security.
Threat actors, IoCs vs IoAs, OSINT toolkit (Shodan, Censys, VirusTotal, URLscan), MITRE ATT&CK Navigator, threat-report writing, and ISACs.
An in-depth study of the NIST CSF. Understand how each function maps to real controls and other frameworks.
AI-powered threat detection, SOC automation, vulnerability assessment, pen testing augmentation, and securing AI systems. Optional sub-track within Cybersecurity.
The networking foundation for the whole Cybersecurity track: OSI and TCP/IP, TCP vs UDP, Wireshark, ARP spoofing, man-in-the-middle, SYN floods and DDoS, DNS attacks, and wireless attacks. Hands-on labs in isolated environments. Prerequisite knowledge for Penetration Testing and Incident Response.
How attackers brute force, crack, and stuff credentials (Hydra, hashcat, John), the online-vs-offline distinction, and the defensive side: password managers, passkeys, and credential hygiene for users and developers. Hands-on DVWA lab.
The practical foundation for every hands-on lab: install VirtualBox and Kali Linux, configure isolated networking, use snapshots, add a vulnerable target VM, and learn the Kali tool categories you will use throughout the track. Take this before any lab that requires Kali.
Symmetric and asymmetric encryption, hash functions and HMAC, key exchange and digital signatures, TLS 1.3 in depth, and practical cryptography for developers (which primitive to use, which library, and what never to implement yourself).
Android and iOS security models, the OWASP Mobile Top 10, static analysis (jadx, APK decompilation), dynamic analysis (Frida, Burp proxy), and common mobile vulnerabilities. Hands-on with a deliberately vulnerable app.
The shared responsibility model, IAM misconfigurations and least privilege, cloud attack techniques (metadata SSRF, privilege escalation), cloud security tooling (Prowler, ScoutSuite, Trivy), and secrets management. Hands-on with CloudGoat.
An advanced subtrack: static analysis (file formats, PE/ELF), disassembly and decompilation with Ghidra, dynamic analysis and safe handling, malware categories, sandbox analysis, and YARA rules. No real malware is ever used in labs.
Active Directory structure, Kerberos and NTLM authentication, common AD attacks (Pass-the-Hash, Kerberoasting, AS-REP Roasting, Golden Ticket), BloodHound attack-path mapping, and AD defense and monitoring. Hands-on with a lab AD environment.
The industry-standard web application security testing tool, from never having opened it to working as a professional tester. Four mini-tracks (Setup and Core Concepts, Repeater and Manual Testing, Intruder and Automated Attacks, Advanced Techniques) plus a portfolio passion project and job readiness. Labs use the free PortSwigger Web Security Academy. Prerequisite: Networking and Protocol Security.