Practice alert triage, detection engineering, network and endpoint analysis, incident response and evidence-led handoffs.
Self-paced reading, explanatory diagrams and evidence-led learning. Build a foundation, then explore a specialist topic.
Read the lessons freely. Create an account to save completed lessons and resume learning. Reading estimates include an allowance for diagrams; reflection, exercises and optional resources take additional time.
You do not need to know the right security terminology. Pick a route and we will narrow the catalogue.
Build a practical foundation in security, intelligence, networks and safer digital decision-making with courses designed for new learners.
10 courses Investigate and explain Turn evidence into threat intelligenceLearn to collect, evaluate, analyze and communicate cyber threat intelligence and open-source evidence for defensible decisions.
8 courses Detect and respond Build sharper security operationsPractice alert triage, detection engineering, network and endpoint analysis, incident response and evidence-led handoffs.
21 courses Design for trust Secure the systems modern teams depend onConnect cloud architecture, identity controls and software supply-chain assurance to the operational decisions that keep services trustworthy.
3 courses Protect people Make safer decisions under pressureRecognize manipulation, interrupt social-engineering scripts and build security habits that work in realistic, high-pressure moments.
4 coursesLearning focus Trace delegated authority through identities, tokens and SaaS application permissions.
Best for Analysts investigating cloud identities, SaaS applications and high-impact business requests.
Explore course : Cloud, Identity, SaaS, and Business Workflow DetectionLearning focus Explain the designed security claim behind a decoy trigger.
Best for Detection practitioners evaluating decoys and high-confidence signals.
Explore course : Deception Engineering and High-Confidence SignalsLearning focus Distinguish query tests from validation of the complete telemetry-to-alert chain.
Best for Detection engineers and security operations leads maintaining detection coverage.
Explore course : Detection Assurance and OperationsLearning focus Map an AI agent's delegated authority and data-access boundaries.
Best for Security practitioners assessing AI assistants and agent workflows.
Explore course : Detection Engineering for AI and Agentic SystemsLearning focus Correlate endpoint activity and network observations without assuming they establish motive.
Best for Analysts connecting host observations with network and data-movement evidence.
Explore course : Endpoint, Network, and Exfiltration ReasoningLearning focus Explain how physical consequence and operating mode change an OT detection claim.
Best for Security practitioners learning how detection decisions change in operational technology.
Explore course : OT and Cyber-Physical Detection EngineeringLearning focus Identify field and semantic assumptions that can change a translated Sigma rule.
Best for Practitioners moving detection logic between platforms or into controlled delivery workflows.
Explore course : Portable Detection Content and Its DeliveryLearning focus Compare matches, thresholds and sequences by the claim each can support.
Best for Analysts choosing an analytical approach for an explicit detection question.
Explore course : Reasoning with Detection AnalyticsLearning focus Trace authority across repository, runner, artifact, registry and deployment boundaries.
Best for Detection practitioners with basic CI/CD and security knowledge.
Explore course : Software Supply Chain Detection Reasoning