Explore practical, self-paced cybersecurity courses in threat intelligence, OSINT, security operations, cloud security and human risk.
Self-paced reading, explanatory diagrams and evidence-led learning. Build a foundation, then explore a specialist topic.
Read the lessons freely. Create an account to save completed lessons and resume learning. Reading estimates include an allowance for diagrams; reflection, exercises and optional resources take additional time.
You do not need to know the right security terminology. Pick a route and we will narrow the catalogue.
Build a practical foundation in security, intelligence, networks and safer digital decision-making with courses designed for new learners.
10 courses Investigate and explain Turn evidence into threat intelligenceLearn to collect, evaluate, analyze and communicate cyber threat intelligence and open-source evidence for defensible decisions.
8 courses Detect and respond Build sharper security operationsPractice alert triage, detection engineering, network and endpoint analysis, incident response and evidence-led handoffs.
21 courses Design for trust Secure the systems modern teams depend onConnect cloud architecture, identity controls and software supply-chain assurance to the operational decisions that keep services trustworthy.
3 courses Protect people Make safer decisions under pressureRecognize manipulation, interrupt social-engineering scripts and build security habits that work in realistic, high-pressure moments.
4 coursesLearning focus Translate an unfamiliar alert into a precise claim, required evidence, and initial safety checks.
Best for SOC learners and analysts developing a repeatable alert-triage method.
Explore course : Security Alert Triage: Evidence, Scope, and HandoffLearning focus Map a software supply chain and identify the source, dependency, build, release, supplier, and deployment trust boundaries that require evidence.
Best for Security and software practitioners developing a foundation in supply-chain risk and controls.
Explore course : Software Supply Chain Security Foundations: From Components to Trusted ReleasesLearning focus Explain the complete traffic path from acquisition through TDS classification to decoy, scam, phishing, malware, or monetization outcomes.
Best for Threat analysts studying traffic-routing infrastructure and dated campaign evidence.
Explore course : Traffic Distribution Systems in the Cybercrime EcosystemLearning focus Explain the difference between credential validation, authentication, a Windows logon session, and later resource access.
Best for Analysts who understand basic identity concepts and want to reconstruct Windows authentication activity.
Explore course : Windows Sign-In Evidence: Investigating Authentication Across HostsLearning focus Trace delegated authority through identities, tokens and SaaS application permissions.
Best for Analysts investigating cloud identities, SaaS applications and high-impact business requests.
Explore course : Cloud, Identity, SaaS, and Business Workflow DetectionLearning focus Explain the designed security claim behind a decoy trigger.
Best for Detection practitioners evaluating decoys and high-confidence signals.
Explore course : Deception Engineering and High-Confidence SignalsLearning focus Distinguish query tests from validation of the complete telemetry-to-alert chain.
Best for Detection engineers and security operations leads maintaining detection coverage.
Explore course : Detection Assurance and OperationsLearning focus Map an AI agent's delegated authority and data-access boundaries.
Best for Security practitioners assessing AI assistants and agent workflows.
Explore course : Detection Engineering for AI and Agentic SystemsLearning focus Correlate endpoint activity and network observations without assuming they establish motive.
Best for Analysts connecting host observations with network and data-movement evidence.
Explore course : Endpoint, Network, and Exfiltration ReasoningLearning focus Explain how physical consequence and operating mode change an OT detection claim.
Best for Security practitioners learning how detection decisions change in operational technology.
Explore course : OT and Cyber-Physical Detection EngineeringLearning focus Identify field and semantic assumptions that can change a translated Sigma rule.
Best for Practitioners moving detection logic between platforms or into controlled delivery workflows.
Explore course : Portable Detection Content and Its DeliveryLearning focus Compare matches, thresholds and sequences by the claim each can support.
Best for Analysts choosing an analytical approach for an explicit detection question.
Explore course : Reasoning with Detection Analytics