Practice alert triage, detection engineering, network and endpoint analysis, incident response and evidence-led handoffs.
Self-paced reading, explanatory diagrams and evidence-led learning. Build a foundation, then explore a specialist topic.
Read the lessons freely. Create an account to save completed lessons and resume learning. Reading estimates include an allowance for diagrams; reflection, exercises and optional resources take additional time.
You do not need to know the right security terminology. Pick a route and we will narrow the catalogue.
Build a practical foundation in security, intelligence, networks and safer digital decision-making with courses designed for new learners.
10 courses Investigate and explain Turn evidence into threat intelligenceLearn to collect, evaluate, analyze and communicate cyber threat intelligence and open-source evidence for defensible decisions.
8 courses Detect and respond Build sharper security operationsPractice alert triage, detection engineering, network and endpoint analysis, incident response and evidence-led handoffs.
21 courses Design for trust Secure the systems modern teams depend onConnect cloud architecture, identity controls and software supply-chain assurance to the operational decisions that keep services trustworthy.
3 courses Protect people Make safer decisions under pressureRecognize manipulation, interrupt social-engineering scripts and build security habits that work in realistic, high-pressure moments.
4 coursesLearning focus Describe what cookies are, how they work, and why they are essential for modern web browsing.
Best for Beginners who want to understand browser state and everyday web-security risks.
Explore course : Cookies & Cyber Threats: A Beginner's Guide to Session SecurityLearning focus Define infostealers and explain why they have become the primary threat in the modern cybercriminal ecosystem.
Best for Security learners examining credential and session-theft threats.
Explore course : Infostealers: The Modern Key to Your Digital KingdomLearning focus By the end of this course, learners will be able to design, build, test, tune, and operate threat detections using modern telemetry sources, detection logic, MITRE ATT&CK mapping, and adversary emulation.
Best for Security learners and practitioners seeking an overview of the detection lifecycle.
Explore course : Detection Engineering: From Telemetry to Tuned DetectionsLearning focus Distinguish an observed record from an inference about hostile behavior.
Best for Learners who know basic security concepts and want a clear detection reasoning method.
Explore course : Detection Engineering as a Way of ReasoningLearning focus Explain how collection and transformation can change the meaning of an event.
Best for Analysts and detection engineers evaluating the reliability of event data.
Explore course : Security Telemetry as EvidenceLearning focus Distinguish a threat feed from finished intelligence and explain the value and limits of common feed data.
Best for Learners and analysts deciding how threat feeds can support security work.
Explore course : Cyber Threat Intelligence FeedsLearning focus Trace a DNS answer through client, recursive, cache, delegation, and authoritative roles.
Best for Analysts who understand basic networks and want to investigate DNS evidence.
Explore course : DNS Investigations: Resolution, Telemetry, and Threat DecisionsLearning focus Reconstruct process lineage using host-scoped identifiers, time, image paths, users, and command lines.
Best for Analysts investigating endpoint alerts and process relationships.
Explore course : Endpoint Process-Tree Analysis: From Alert to BehaviorLearning focus Establish incident roles, authority, playbooks, evidence access, and decision thresholds before an incident begins.
Best for Security learners and analysts developing an incident-response foundation.
Explore course : Incident Response Foundations: From First Signal to Durable RecoveryLearning focus Preserve and inspect a suspicious message without activating links, attachments, or remote content.
Best for Analysts learning to investigate suspicious messages and explain a defensible disposition.
Explore course : Phishing Email Triage: From Message Evidence to ContainmentLearning focus Translate an unfamiliar alert into a precise claim, required evidence, and initial safety checks.
Best for SOC learners and analysts developing a repeatable alert-triage method.
Explore course : Security Alert Triage: Evidence, Scope, and HandoffLearning focus Explain the difference between credential validation, authentication, a Windows logon session, and later resource access.
Best for Analysts who understand basic identity concepts and want to reconstruct Windows authentication activity.
Explore course : Windows Sign-In Evidence: Investigating Authentication Across Hosts