Skip to content
Visual overview first · Then the module · Then the lab

Learn defensive security
without a SOC job first.

Follow one small application from design review to incident response. You do not need prior cybersecurity or SOC experience — this course starts with ideas you already know as a software engineer (requests, processes, identities, databases, logs) and adds one security question at a time: what does this component trust, how could that assumption fail, and what evidence would the failure leave?

Start module 1 Read onboarding first ☕ Support this course

Core = modules 1–13 + one capstone · modules 14–17 are extended lenses · 17 modules across 4 parts · runs entirely on 127.0.0.1

learn-security / roadmap

01 Security foundations — trust boundaries

08 MITRE ATT&CK — name the behavior

11 Detection and incident response

13 Security architecture — narrower boundaries

Acme Notes lab, one system throughout
17Modules across 4 parts
2Capstone options
$0Cloud spend (local lab)
127.0.0.1Everything stays on loopback

Authorized lab use only

Run offensive-looking exercises only against this repository's local, intentionally vulnerable lab. Never reuse them against systems you do not own and have explicit permission to test.

Pick your part

  • Part I — Understand the System

    6 modules. Foundations, network and OS, identity, application/API, cloud/containers, cryptography.

    The trust boundaries every later module refers back to.

    Start module 1 →

  • Part II — See and Defend the System

    5 modules. Monitoring, MITRE ATT&CK, red/blue/purple, SOC, detection and incident response.

    How you'd actually notice and respond.

    Start module 7 →

  • :material-drafting-compass: Part III — Design What Comes Next

    3 modules. Agentic SOC, security architecture, future directions.

    Move from reacting to designing the system that resists the failure.

    Start module 12 →

  • Part IV — Extended Lenses

    3 modules. ML/AI system security, availability and DoS, human-factor attacks.

    Apply the same trust-and-evidence frame beyond the core stack.

    Start module 15 →

Start in four steps

  1. Read Onboarding. It translates the course vocabulary into software-engineering language and tells you what you can safely skip.
  2. Skim How defenders think. That page is how you invent a control, a detection, or a quarantine switch — not another glossary.
  3. Complete Setup and first lab. It includes a no-Docker preview, so setup is not a gate to understanding the system.
  4. Begin Module 1. Each module opens with a Visual overview — read that first, then the module text.

Time

One budget. A path’s hours include the modules and the capstone in that row. A 13-week cohort follows the standard row (about 8 hours a week); the capstone is week 13. The condensed plan is that same 100 hours, block by block.

Path Hours Modules Capstone
Preview 8–12 Visual overview, summary, and knowledge check of each module. No labs. None
Architecture focus 35–45 1, 3–9, 11–13 Platform threat model and architecture review
Detection / SOC focus 40–50 1–4, 7–12, and 16 before 17 Platform incident artifacts
Standard engineer 100 1–17, in order Platform. 12 of these hours if you kept module work (low end of 12–20). A cold start is 25–30 and replaces that 12.
Guided beginner 100–120 Onboarding, then modules 1–17. Optional labs (kind, packet capture, scanners, LLM) are skipped. Same capstone as standard

The Python vulnerability scanner is the other capstone: 25–35 hours. That range replaces the platform slice above. Doing both adds 25–35 hours. The platform’s cold-start 25–30 hours is a different project.

Core = modules 1–13 + one capstone. Modules 14–17 are extended lenses. The platform capstone does not score them. The scanner’s own optional list (10, 12, 14, 15, 17) is on that page.

What you will build

flowchart LR
    application --> events["security events"] --> store["searchable store"] --> detections --> alerts
    alerts --> ir["investigation and response"] --> assistant["approval-gated assistant"]

By the capstone, you will be able to explain the complete chain from software behavior to vulnerability, attacker action, telemetry, detection, investigation, response, and architectural repair.

Platform capstone → Python scanner capstone → Full course guide →

Choose your next page

If you are... Go to...
New to security terminology Onboarding
Want the thinking layer, not more terms How defenders think
Ready to install and test the lab Setup
Short on time Learning paths
Looking for a practical task Exercise index
Returning to the course Modules overview