Cybersecurity
From zero to job-ready security engineer — 40 modules, no prerequisites
40 Modules. Zero to Job-Ready.
Follow in order. Each module builds on the last. Attack patterns before defence. Concepts before tools. Every idea earned before the next one.
What is Cybersecurity?
The threat landscape, the roles, and why this field exists. What attackers actually want and how defenders think. The clearest possible starting point.
How the Internet Works — A Security Engineer's View
TCP/IP, DNS, HTTP, TLS — explained from the security angle. Every layer hides attack surfaces. This module shows you where they are and why they exist.
Linux for Security Engineers
The operating system every hacker and every defender lives in. File permissions, processes, users, logs, and the commands you will use every single day.
Cryptography From Scratch
How encryption actually works — symmetric, asymmetric, hashing, digital signatures. Not math proofs — practical understanding of what protects data and what breaks it.
The CIA Triad and Security Models
The three properties every security decision protects or trades off: Confidentiality, Integrity, Availability. The frameworks built around them.
Cybersecurity Career Paths and the US Job Market (2026)
Every security role mapped — SOC analyst to CISO. Real US salary data, top hiring companies, the certifications that actually matter, and how to break in.
How Attackers Think — The Kill Chain and MITRE ATT&CK
The attacker's playbook from first reconnaissance to full compromise. MITRE ATT&CK explained. Understanding this framework is what makes defenders effective.
Social Engineering and Phishing
The most successful attack vector in history requires zero technical skill. How social engineering works, why humans are the hardest vulnerability to patch.
Web Application Attacks — OWASP Top 10 From First Principles
SQL injection, XSS, SSRF, IDOR, broken auth — every OWASP Top 10 vulnerability explained from scratch with real attack examples and why they exist.
Network Attacks — MITM, Sniffing, ARP Poisoning, DNS Hijacking
How attackers position themselves between you and the internet. The mechanics of interception, spoofing, and protocol-level abuse at the network layer.
Malware — Types, Behavior, and How It Spreads
Viruses, worms, ransomware, rootkits, spyware, RATs — what each one does differently, how they spread, and what defenders look for to detect them.
Authentication Attacks — Credential Theft, Brute Force, Pass-the-Hash
How attackers steal, crack, and replay credentials. Password hashing, rainbow tables, credential stuffing, and pass-the-hash — from the attacker's perspective.
Vulnerabilities and Exploits — CVEs, Zero-Days, and Patch Management
What a vulnerability is, how exploits are built, how CVEs work, and what zero-days mean in practice. The lifecycle from discovery to patch to exploitation.
Python for Security Engineers
Not Python basics — Python for security. Port scanners, log parsers, hash crackers, API fuzzers, and the scripts every security engineer actually runs.
Networking Deep Dive — Subnets, Routing, Firewalls, VPNs
The networking knowledge that separates a security professional from someone who just ran a tool. Subnetting, routing tables, firewall rules, and VPN internals.
Linux Hardening — From Default to Secure
A default Linux install is full of attack surface. This module covers every hardening step — from SSH configuration to file permissions to service minimisation.
Windows Security and Active Directory
Most enterprise environments run on Windows and Active Directory. How AD works, how it is attacked (Kerberoasting, DCSync, Pass-the-Ticket), and how to defend it.
Cloud Security — Shared Responsibility and IAM Misconfiguration
The shared responsibility model, the most common cloud attack patterns (S3 buckets, overpermissioned IAM roles, metadata service abuse), and how to fix them.
API Security and Container Security
Modern applications live in containers and communicate via APIs. Both are full of attack surface. Authentication, authorisation, and isolation for both.
Secure Coding — Building Software That Does Not Break Under Attack
Input validation, parameterised queries, output encoding, secure defaults. The patterns that prevent the OWASP Top 10 from ever reaching a running application.
Penetration Testing — Methodology, Scoping, and Legal Framework
How professional pentesting works. The rules of engagement, scoping a test, the phases of an engagement, and the report that comes at the end.
Reconnaissance — OSINT and Footprinting
Everything an attacker can learn before touching the target — from public sources alone. OSINT tools, WHOIS, certificate transparency, and passive recon.
Scanning and Enumeration
Active discovery — finding open ports, running services, and version numbers. nmap from basics to advanced, banner grabbing, and service fingerprinting.
Exploitation — Techniques, Payloads, and Common Vulnerabilities
How exploitation actually works — from identifying a vulnerable service to executing code. Buffer overflows, command injection, and exploitation frameworks.
Web Application Pentesting — SQL Injection to IDOR
Finding and exploiting web vulnerabilities in a structured way. Manual testing methodology, Burp Suite workflow, and the most impactful vulns to hunt first.
Post-Exploitation — Privilege Escalation, Persistence, Lateral Movement
Getting in is only the start. What attackers do after initial access — escalating privileges, maintaining persistence, and moving across the network.
CTF Skills — Problem Types, Approach, and Getting Your First Flag
Capture the Flag competitions are how security people learn hands-on. The categories, the mindset, the tools, and a structured approach to your first CTF.
Security Architecture — Defense in Depth and Zero Trust
How to design systems that are hard to attack. Defense in depth, network segmentation, Zero Trust architecture, and the principles behind every secure design.
Identity and Access Management — MFA, RBAC, Privileged Access
Identity is the new perimeter. MFA, RBAC, PAM, SSO, OAuth 2.0, and SAML — the controls that determine who gets access to what, and how they are abused.
Firewalls, IDS, and IPS — How Detection Actually Works
The three layers of network-based defence. How firewalls decide to block, how IDS detects, how IPS responds, and how attackers evade all three.
SIEM and Log Analysis — Finding Attacks in the Noise
Security Information and Event Management — how logs from hundreds of systems become actionable alerts. Correlation rules, baseline behaviour, and hunting for anomalies.
Vulnerability Management — Scanning, Prioritisation, Remediation
Finding vulnerabilities before attackers do. The scanning lifecycle, CVSS scoring, prioritisation by risk, and the remediation workflow that actually gets things fixed.
Incident Response — From Alert to Recovery
What happens when the breach has happened. The six phases of incident response, evidence preservation, containment strategies, and the post-incident review.
Threat Intelligence and Threat Hunting
Going from reactive to proactive. Threat intelligence feeds, IOCs, TTPs, and how threat hunters actively look for attackers who have not triggered any alert.
DevSecOps — Security Embedded in the Pipeline
Shifting security left — integrating SAST, DAST, dependency scanning, secrets detection, and container scanning into CI/CD pipelines before code reaches production.
Compliance Frameworks — NIST, SOC 2, ISO 27001, PCI-DSS
The frameworks every US security team operates under. What each one requires, how they relate to each other, and what an audit actually looks like from the inside.
Security Certifications — Which One to Get First
CompTIA Security+, CEH, OSCP, CISSP, CISM, AWS Security — ranked by value for each career stage. What each cert covers, costs, and what doors it actually opens.
Bug Bounty Hunting — From Beginner to First Valid Report
How to find and report real vulnerabilities in real systems — legally and for money. Platform selection, methodology, the reports that get paid, and the ones that get closed.
Building a Home Lab for Cybersecurity Practice
A complete, free practice environment — virtualisation, intentionally vulnerable machines, network setup, and the practice path from beginner to intermediate.
Interview Prep — 60 Complete Answers for Security Roles
60 complete interview answers across networking, cryptography, web security, pentesting, incident response, compliance, and behavioural — written at senior depth.
Start with Module 01. Build from zero.
No security background needed. Each module assumes only the previous one. The attacker perspective comes first — because defenders who understand attacks are the ones who actually stop them.
Start Module 01 →Discussion
0Have a better approach? Found something outdated? Share it — your knowledge helps everyone learning here.