Explore practical, self-paced cybersecurity courses in threat intelligence, OSINT, security operations, cloud security and human risk.
Self-paced reading, explanatory diagrams and evidence-led learning. Build a foundation, then explore a specialist topic.
Read the lessons freely. Create an account to save completed lessons and resume learning. Reading estimates include an allowance for diagrams; reflection, exercises and optional resources take additional time.
You do not need to know the right security terminology. Pick a route and we will narrow the catalogue.
Build a practical foundation in security, intelligence, networks and safer digital decision-making with courses designed for new learners.
10 courses Investigate and explain Turn evidence into threat intelligenceLearn to collect, evaluate, analyze and communicate cyber threat intelligence and open-source evidence for defensible decisions.
8 courses Detect and respond Build sharper security operationsPractice alert triage, detection engineering, network and endpoint analysis, incident response and evidence-led handoffs.
21 courses Design for trust Secure the systems modern teams depend onConnect cloud architecture, identity controls and software supply-chain assurance to the operational decisions that keep services trustworthy.
3 courses Protect people Make safer decisions under pressureRecognize manipulation, interrupt social-engineering scripts and build security habits that work in realistic, high-pressure moments.
4 coursesLearning focus Distinguish an observed record from an inference about hostile behavior.
Best for Learners who know basic security concepts and want a clear detection reasoning method.
Explore course : Detection Engineering as a Way of ReasoningLearning focus Explain how collection and transformation can change the meaning of an event.
Best for Analysts and detection engineers evaluating the reliability of event data.
Explore course : Security Telemetry as EvidenceLearning focus Explain shared responsibility and map the provider, customer, and application-owner controls for a cloud workload.
Best for Learners moving from basic security concepts into cloud environments.
Explore course : Cloud Security Foundations: Design, Operate, and RecoverLearning focus Explain the CVE ecosystem, including identifiers, records, disclosure processes, and the roles of organizations involved in vulnerability tracking.
Best for Security analysts and vulnerability-management learners evaluating vulnerability information.
Explore course : CVE Intelligence: Vulnerability Lifecycle, Analysis, and Defensive DecisionsLearning focus Distinguish a threat feed from finished intelligence and explain the value and limits of common feed data.
Best for Learners and analysts deciding how threat feeds can support security work.
Explore course : Cyber Threat Intelligence FeedsLearning focus Trace a DNS answer through client, recursive, cache, delegation, and authoritative roles.
Best for Analysts who understand basic networks and want to investigate DNS evidence.
Explore course : DNS Investigations: Resolution, Telemetry, and Threat DecisionsLearning focus Reconstruct process lineage using host-scoped identifiers, time, image paths, users, and command lines.
Best for Analysts investigating endpoint alerts and process relationships.
Explore course : Endpoint Process-Tree Analysis: From Alert to BehaviorLearning focus Map an end-to-end access path and distinguish identity proofing, authentication, authorization, session management, and governance responsibilities.
Best for Learners building the identity knowledge needed for cloud and security investigations.
Explore course : Identity and Access Management Foundations: From Sign-In to Accountable AccessLearning focus Establish incident roles, authority, playbooks, evidence access, and decision thresholds before an incident begins.
Best for Security learners and analysts developing an incident-response foundation.
Explore course : Incident Response Foundations: From First Signal to Durable RecoveryLearning focus Explain the purpose, scope, and limitations of OSINT and distinguish publicly available information from intelligence produced through analysis.
Best for Learners and analysts investigating publicly available information responsibly.
Explore course : Open Source Intelligence (OSINT) Foundations: From Public Data to Defensible IntelligenceLearning focus Translate an operational security decision into scoped intelligence requirements, priority information needs, collection tasks, and explicit review triggers.
Best for Practitioners familiar with CTI foundations who support investigations and security operations.
Explore course : Operational Cyber Threat Intelligence: Investigations, Campaigns, and Defensive ActionLearning focus Preserve and inspect a suspicious message without activating links, attachments, or remote content.
Best for Analysts learning to investigate suspicious messages and explain a defensible disposition.
Explore course : Phishing Email Triage: From Message Evidence to Containment