Courses
Every course is built around practical work: lessons lead into labs, exercises and graded assessments. Sign in to start any of them.
The reasoning that underpins every other course: what security actually claims, against whom, and at what cost.
Networking taught as evidence: what an attacker does with each mechanism, and what it leaves in your logs.
Linux as an adversary and a responder both see it: what an account can become, and what the host will remember afterwards.
Windows as an identity system: where credentials and tokens live, who can take them, what the host records, and Active Directory as a reachability graph.
The web vulnerability classes as a handful of boundary failures, not ten things to memorise, and the judgement of filtering a symptom versus removing the boundary.
Turning alerts into decisions: triage as a base-rate problem, investigation as pivots and a timeline, detection engineering, and response as costed choices under pressure.
The proactive, cyclical half of defence: intelligence that outlasts indicators, hypothesis-driven hunting, coordinated incident response, and the loop that ties them together.
ATT&CK as an operational instrument, adversary emulation over vulnerability-hunting, and the purple loop that turns a red-team exercise into permanent blue-team improvement.
Sound acquisition, super-timelines, memory forensics, and the safe triage and analysis of malware. Turning the artefacts an intrusion leaves into evidence and intelligence.
The control plane is the new perimeter and identity is the boundary: cloud IAM as a reachability graph, the metadata pivot, and container/Kubernetes isolation at orchestration scale.
Cryptography as guarantees with preconditions, and identity as the boundary: what each primitive and each authentication factor actually promises, and how tokens and federation carry that promise across systems.