Skip to content
Visual overview first · Then the module · Then the lab

Learn defensive security
without a SOC job first.

Follow one small application from design review to incident response. You do not need prior cybersecurity or SOC experience — this course starts with ideas you already know as a software engineer (requests, processes, identities, databases, logs) and adds one security question at a time: what does this component trust, how could that assumption fail, and what evidence would the failure leave?

Start module 1 Read onboarding first ☕ Support this course

17 modules across 4 parts · 1 capstone project · runs entirely on 127.0.0.1, no cloud bill

learn-security / roadmap

01 Security foundations — trust boundaries

08 MITRE ATT&CK — name the behavior

11 Detection and incident response

13 Security architecture — narrower boundaries

Acme Notes lab, one system throughout
17Modules across 4 parts
1Capstone platform
$0Cloud spend (local lab)
127.0.0.1Everything stays on loopback

Authorized lab use only

Run offensive-looking exercises only against this repository's local, intentionally vulnerable lab. Never reuse them against systems you do not own and have explicit permission to test.

Pick your part

  • Part I — Understand the System

    6 modules. Foundations, network and OS, identity, application/API, cloud/containers, cryptography.

    The trust boundaries every later module refers back to.

    Start module 1 →

  • Part II — See and Defend the System

    5 modules. Monitoring, MITRE ATT&CK, red/blue/purple, SOC, detection and incident response.

    How you'd actually notice and respond.

    Start module 7 →

  • :material-drafting-compass: Part III — Design What Comes Next

    3 modules. Agentic SOC, security architecture, future directions.

    Move from reacting to designing the system that resists the failure.

    Start module 12 →

  • Part IV — Extended Lenses

    3 modules. ML/AI system security, availability and DoS, human-factor attacks.

    Apply the same trust-and-evidence frame beyond the core stack.

    Start module 15 →

Start in three steps

  1. Read Onboarding. It translates the course vocabulary into software-engineering language and tells you what you can safely skip.
  2. Skim How defenders think. That page is how you invent a control, a detection, or a quarantine switch — not another glossary.
  3. Complete Setup and first lab. It includes a no-Docker preview, so setup is not a gate to understanding the system.
  4. Begin Module 1. Each module opens with a Visual overview — read that first, then the module text.

What you will build

flowchart LR
    application --> events["security events"] --> store["searchable store"] --> detections --> alerts
    alerts --> ir["investigation and response"] --> assistant["approval-gated assistant"]

By the capstone, you will be able to explain the complete chain from software behavior to vulnerability, attacker action, telemetry, detection, investigation, response, and architectural repair.

Capstone brief → Full course guide →

Choose your next page

If you are... Go to...
New to security terminology Onboarding
Want the thinking layer, not more terms How defenders think
Ready to install and test the lab Setup
Short on time Learning paths
Looking for a practical task Exercise index
Returning to the course Modules overview