What we teach
A cybersecurity curriculum built around practical work. Every domain below carries lessons, labs and assessments, and every attack ships with the detection that catches it.
Domains
Foundations
What security actually defends, trust boundaries, adversary modelling, and the vocabulary the rest of the field assumes you already have.
Networking and traffic
Protocols as an investigator reads them. Find the channel in a packet capture, prove which machine it was, and show the segmentation does what the diagram claims.
Identity and access
Authentication, directory services, credential theft and privilege escalation paths, including the ones that exist because of how the directory was configured.
Detection and response
Alert triage, detection engineering, and the judgement of when a signal is worth escalating. Write the rule, then prove it fires.
Cloud and containers
Cloud identity, escalation through misconfigured roles, container and image security, and the audit trails that record all of it.
Digital forensics and malware
Memory triage, chain of custody, host artefacts, and reporting a finding in a form that survives being questioned.
How you practise
Reading is where a topic starts, not where it ends. Six kinds of practical work, each grading something different.
Simulation labs
A real incident, with the evidence it actually produced. You work the case in a console: search the logs, pivot on what you find, and submit a conclusion that gets graded on whether the evidence supports it.
Guided exercises
Short practical work inside a lesson. Identify the indicator, decide the disposition, construct the query, configure the control. Graded immediately, with the reasoning shown.
SOC triage drills
A shift of alerts to clear against the clock. Escalating everything fails the drill exactly as closing everything does, which is the actual skill.
Capture the flag
Analysis and decoding challenges, validated server-side. Hints cost points, so taking one is a trade rather than a penalty.
Team missions
Labs grouped by the stance they are run from, so a learner can work a red lane, a blue lane, or the purple lane that joins them.
Assessments
Course-level papers and module quizzes, graded server-side, recorded as evidence against a skill model rather than as a score.
Levels
Foundation
No prior security experience assumed. Starts at what a trust boundary is.
Practitioner
For people already working in or next to a security team.
Advanced
Detection engineering, adversary emulation, and forensic reporting.