The security guidebook
A complete cybersecurity education, taught the way the work actually happens: you run the commands, reproduce the findings, fix the flaws, and write the reports — every walkthrough executed and dated, every claim checked against its source. One hundred ten lessons are live now: the Stage A foundations, the Stage A remainder (Python, reading code, Windows, OSINT), the pilots, the Stage B mechanics wave (authorization, methodology, toolbench, practice targets), the Stage B web-vulnerability wave, the Stage B second wave (API abuse, SSTI, XXE, deserialization, GraphQL, race conditions, JWT/OAuth), the Stage C detection-and-operations wave, the Stage C disclosure wave, the Stage E CISSP-domain wave, the Stage D specialist wave (red team, malware, cloud, AppSec), the Stage D wave 2 (exploit concepts, DFIR deep), the Stage C remainder (public track record, AI tooling), the AI security track, and the CISSP coverage wave (all 62 objectives, 1.1 to 8.5, each with its lesson); the full program builds out from here, stage by stage.
Published 2026-10-09 · walkthroughs run 2026-10-09
Every lesson follows the same ten parts: where it shows up, what you need first, how it works, a guided walkthrough, work on your own, where it goes wrong, the primary sources, check-yourself questions, a proof-of-skill artifact, and where it leads next. If a step could not be run, the lesson says so on the page.
The lessons
HTTP in depth
Stage A · Foundations
Everything above this lesson assumes HTTP and almost nothing below it explains it. Web vulnerability work (Stage B) is the art of sending requests a developer did not expect and reading responses the developer did not…
IDOR: Insecure Direct Object References
Stage B · Practitioner
IDOR is the single highest-yield vulnerability class for a beginning bounty hunter: it is common, it is usually simple to prove, and its impact writes itself ("one user reads another user's data"). It sits inside…
Risk assessment as a worked case
Stage E · Expert
Risk assessment is the decision-making engine of every security program: it is how an organization decides what to fix first, what to accept, and what to explain to its leadership. In the CISSP it anchors Domain 1…
Prompt injection, the #1 LLM risk
AI track
Prompt injection is the risk at the top of the OWASP Top 10 for LLM Applications — LLM01 in both the 2025 and 2026 editions — because it is the failure mode from which the others follow: if an attacker…
DNS in depth
Stage A · Foundations
Nothing on a network happens before DNS. The login flow this whole stage builds toward starts with a name typed into a client, and the first question the machine asks is "what address is that?" — answered by DNS, before…
TCP/IP and ports
Stage A · Foundations
Every connection you will ever investigate or exploit is TCP (or UDP) to an IP address and a port. The SOC analyst triaging "suspicious outbound connection" is reading exactly the states this lesson teaches: who…
Linux command line for security work
Stage A · Foundations
Every tool in this program runs on Linux, and every one of them is driven from the command line. The walkthroughs in a-dns-depth and
Git and GitHub
Stage A · Foundations
Every artifact this program asks you to produce — lab notebooks, Bandit notes, tools, reports, disclosures — lives in a git repository, and the public ones live on GitHub. That is not administrative overhead; it is the…
SQL injection: when your input becomes the query
Stage B · Practitioner
SQL injection is the oldest injection class on the web and still one of the most damaging: it sits inside OWASP Top 10:2025 A05 — Injection and carries its own weakness ID, CWE-89. You…
OS command injection: when your input reaches a shell
Stage B · Practitioner
OS command injection is SQL injection's sibling one layer down: instead of the database executing your input as code, the operating system does. It sits inside OWASP Top 10:2025 A05 —…
SSRF: when the server fetches what you tell it to
Stage B · Practitioner
Server-side request forgery is the vulnerability where the attacker doesn't make the request — the server does, on the attacker's behalf, to a destination the attacker chose. It sits in…
CSRF: when the victim's browser does the attacker's work
Stage B · Practitioner
Cross-site request forgery is the attack where the victim's own browser issues the malicious request — authenticated, cookie-attached, indistinguishable from legitimate traffic. It sits in OWASP Top 10:2025…
Cross-site scripting: when the browser can't tell your code from the attacker's
Stage B · Practitioner
Every application that renders user input in a page can carry XSS, which makes it the most common web vulnerability class you will meet in bounty programs and penetration tests. It sits in OWASP Top 10:2025 A05…
Business-logic flaws: when the code works and the rules don't
Stage B · Practitioner
Business-logic flaws are the highest-creativity class in bounty work: no injection, no misconfiguration, just the application's own rules failing when a user deviates from the expected path. They sit in OWASP…
Broken authentication and session management: proving who you are, and staying proven
Stage B · Practitioner
Authentication is the gate every other control stands behind: if an attacker can become the victim, authorization checks are answering the wrong question. It sits in OWASP Top 10:2025 A07 — Authentication…
Security headers and browser defenses: telling the browser what "safe" means
Stage B · Practitioner
Security headers are the cheapest defense-in-depth in web security: a handful of response headers that change how the browser treats your pages — blocking inline scripts, upgrading connections to HTTPS, refusing to be…
Bug bounty mechanics: how authorized testing is actually offered to beginners
Stage B · Practitioner
Every vulnerability class you have learned to find and fix has to be found somewhere legal before any of it matters. Bug bounty programs are the market where that happens: an organization publishes what you may…
SOC Triage: From Alert to Decision
Stage C · Professional
Every alert a security operations center produces lands on a human who has minutes — not hours — to decide what it means. That decision is triage: turning a detection's hypothesis into a classification and a routing…
Log Sources That Matter
Stage C · Professional
Triage told you what to decide; this lesson tells you where to look. Every investigation is a question aimed at a log source: "who logged in where" goes to identity logs, "what did the process do" goes…
Writing Detections with Sigma
Stage C · Professional
Every alert triage ever performed started as a detection someone wrote. Detection engineering is the discipline of turning "we should notice when X happens" into a tested, tuned rule that fires on X and stays quiet on…
Incident Response Basics
Stage C · Professional
Triage ends with "confirmed incident" — and then a different discipline takes over. Incident response is the structured work of containing, eradicating, and recovering from a security incident without making it worse:…
Coordinated vulnerability disclosure
Stage C · Professional
Everything before this lesson taught you to find flaws on targets you are allowed to touch. The moment you find a real flaw in software you do not own, you have a second problem: telling the people who can fix it…
The CVE Program
Stage C · Professional
A CVE ID is the closest thing the security field has to a permanent public record of a vulnerability — and of who found it. When a hiring manager, a bounty platform, or a program like Anthropic's Cyber Verification…
CVSS v3.1 and v4.0, scored by hand
Stage C · Professional
Every prioritization decision in security runs through a CVSS score: the scanner output you triage, the KEV catalog's urgency, the vendor advisory's headline number, the risk register's "High." Most practitioners treat…
The surrounding catalogs: CWE, CAPEC, KEV, EPSS — and where enrichment comes from now
Stage C · Professional
A CVE record tells you a flaw exists. It does not tell you what to do first. Every security team on earth faces the same queue — thousands of CVEs, finite patching windows — and the industry built four catalogs to…
Identity and access management: who gets in, and to what
Stage E · Expert
Every security incident is, at its core, an identity question: somebody (or something) did something, and the system decided — correctly or not — that they were allowed to. IAM is the discipline that makes those…
Applied cryptography: what the primitives do, and how they break
Stage E · Expert
Cryptography is the one part of security where the math is essentially never the problem and the use of the math is almost always the problem. Nobody breaks AES; they store the key next to the data, or use ECB…
Secure SDLC: catching the vulnerability before it ships
Stage E · Expert
Every vulnerability in Stage B was a decision somebody made under schedule pressure — and a secure SDLC is the organizational machinery for making those decisions differently. It shows up in the AppSec engineer's…
Business continuity and disaster recovery: deciding what survives the outage
Stage E · Expert
Risk assessment asks "what could go wrong"; business continuity answers "when it does, what do we do Monday morning." It is the discipline behind every RTO/RPO pair in a vendor questionnaire, every tabletop exercise…
Professional ethics in security work: the Code is the floor, not the ceiling
Stage E · Expert
Ethics in security work is not a graduation speech; it is a Tuesday-afternoon decision. A client asks you to soften a critical finding so a deal closes — while their largest prospect is doing vendor due diligence (the…
Core security concepts: the CIA triad and the properties around it
Stage E · Expert
Every security conversation you will ever have is secretly a conversation about three properties: is the data secret from the wrong people, is it unaltered by the wrong people, and is it there when the right people need…
Security governance: aligning security with business strategy
Stage E · Expert
Governance is the reason security has a budget, a mandate, and someone to answer to. It shows up in the board meeting where the CISO explains why the security program costs what it costs; in the audit finding that says…
Legal, regulatory, and compliance: mapping obligations to evidence
Stage E · Expert
This is the compliance-program view of the law — not "what is a crime" (that is b-authorization-scope: the CFAA and the UK Computer Misuse Act as the authorization…
Investigation types: which investigation you're in, and what it demands
Stage E · Expert
An incident becomes an investigation the moment someone asks "what happened, who did it, and what do we do about it" — and the answer depends entirely on which kind of investigation you are in. The same…
Security policy, standards, procedures, and guidelines: the document hierarchy
Stage E · Expert
Every organization runs on documents it may not have written down. The "policy" that lives in the CISO's head, the "standard" that is actually a Slack message from 2021, the "procedure" that one engineer knows and…
Personnel security: the human side of the employment lifecycle
Stage E · Expert
e-iam taught the technical lifecycle: provision, review, deprovision. This lesson teaches the human side of the same transitions — who decides what, who tells whom, and in what order,…
Threat modeling concepts and methodologies: choosing how to think about what can go wrong
Stage E · Expert
Threat modeling is the design-time discipline of asking "what can go wrong" before the system exists to go wrong in. It shows up in the architecture review where someone sketches the data flows and asks where the trust…
Supply chain risk management: trusting what you didn't build
Stage E · Expert
Modern systems are mostly other people's code, running on other people's infrastructure, maintained by people you will never meet. The application you deploy pulls hundreds of open-source packages; the SaaS you buy…
Security awareness, education, and training: building the learning program
Stage E · Expert
Every control in this guidebook assumes a human who knows what to do. The phishing email that the finance officer reports instead of clicking — or does not. The developer who recognizes a secret in a code review because…
Classifying information and assets: the scheme everything else hangs on
Stage E · Expert
Every security program eventually faces the question "protect what, from whom, how much?" — and every answer that skips classification is either uniform (everything gets the maximum, which nobody can afford) or…
Handling requirements: what each classification tier demands
Stage E · Expert
A classification scheme says "this is Confidential." Handling requirements say what that means on Monday morning: how it is labeled, where it may be stored, how it may be sent, how it is destroyed — and what…
Secure provisioning: ownership, inventory, and the CMDB
Stage E · Expert
Every asset the organization owns was acquired, configured, assigned, and — eventually — retired by some process, or by no process at all. Provisioning is the discipline that makes it a process: the workflow that brings…
The data lifecycle: from collection to destruction
Stage E · Expert
The data lifecycle is the discipline that follows data from the moment it is collected to the moment it is destroyed: who may collect it, where it may live, how long it is kept, what remains after deletion, and how it…
Retention schedules and end-of-life: when to let go, and how
Stage E · Expert
Every organization keeps things too long and retires things too carelessly. Retention is the discipline of keeping data exactly as long as required — by law, by contract, by operations — and not a day longer;…
Data security controls: protecting data at rest, in transit, and in use
Stage E · Expert
The primitives exist — encryption, hashing, access control — and the question is which to apply where. Data security controls are the selection discipline: given data in a particular state with a particular…
Secure design principles: engineering judgment before controls
Stage E · Expert
Controls are the end of an argument, not the beginning. A firewall rule, an encryption setting, a key rotation schedule — each answers a design question asked much earlier. Secure design principles are the questions…
Formal security models: what "secure" means, precisely
Stage E · Expert
Security policies are usually written in English, and English is where precision goes to die. "Only authorized users may see sensitive data" means something different to everyone who reads it — which is why the field…
Selecting controls: from requirements to a defensible set
Stage E · Expert
Every security program eventually faces the same audit question: "Why these controls?" A firewall here, encryption there, logging everywhere — each control costs money, attention, and operational friction, and…
Platform security: the ground your architecture stands on
Stage E · Expert
Every security architecture rests on a platform — firmware, bootloader, hypervisor, CPU — and every platform makes promises the layers above inherit, silently. When the platform keeps its promises, the architecture…
Assessing vulnerabilities across the architecture
Stage E · Expert
Vulnerability assessment usually means scanning: point the scanner at the network, collect the CVEs, argue about the criticals. That finds known bugs in known software. Architecture assessment asks the harder question —…
Cryptanalytic attacks: how ciphers fail, and what that teaches
Stage E · Expert
Cryptography fails in two places: in its use (e-crypto-applied — keys with the data, ECB mode, expired certificates) and in its math — this lesson's…
Site and facility design: security before the first brick
Stage E · Expert
Every control in this guidebook assumes an attacker who arrives over the network. But the server has a street address, a loading dock, a cleaning crew, and a power feed — and the cheapest way past a firewall is often a…
Site and facility controls: the checklist that holds
Stage E · Expert
Design says what the facility should do; controls are what it actually does at 2 a.m. on a Sunday. The fence, the badge reader, the UPS, the sprinkler head, the temperature sensor in the data closet — each is a control…
The information system lifecycle: security at every gate
Stage E · Expert
Systems are not born secure and do not stay secure by inertia — they pass through phases, and each phase transition is a moment when security can be required, verified, or quietly dropped. The information system…
Network architecture: drawing the lines attackers must cross
Stage E · Expert
a-tcpip-ports taught you the mechanism: what a packet carries and what a firewall rule matches. This lesson is the decision layer above it: which boundaries a network should…
Network components: hardening everything the architecture trusts
Stage E · Expert
The architecture lesson drew the boundaries; this lesson hardens the devices that enforce them. A firewall with an any-any rule, an IDS sensor watching the wrong interface, a switch with default credentials, a wireless…
Secure channels: which encrypted path for which traffic, and why
Stage E · Expert
Every architecture has traffic that must cross untrusted space: the remote engineer reaching the data center, the branch office reaching HQ, the web app reaching the payment processor, the administrator reaching the…
Implementing authentication systems: the rollout, not the theory
Stage E · Expert
e-iam taught you the strategy and lifecycle it serves; b-session-auth is the companion discipline — how authentication breaks, the failure…
Assessment strategy: deciding what gets tested, by whom, and how often
Stage E · Expert
b-methodology taught you how one engagement runs. This lesson decides the portfolio: which systems get tested this year, by whom (internal team, external firm, or the vendor's…
Control testing: choosing the method that proves the claim
Stage E · Expert
b-methodology walks you through one engagement. This lesson stands one level up: across the year's testing, which method do you point at which control, and what does each…
Security metrics: measuring the program without lying to yourself
Stage E · Expert
Every security program eventually faces the question "how are we doing?" — from the board, the auditor, or its own leadership. The honest answer is a measurement program: defined metrics, collected the same way every…
Test analysis and reporting: from ten thousand findings to decisions
Stage E · Expert
Every testing method in e-control-testing produces output: scanner lists, pentest notes, review findings. Raw output is not a report — it's inventory. The analysis turns it…
Security audits: independence, evidence, and the finding that holds up
Stage E · Expert
Testing asks "can it be broken?"; audit asks "is the control operating as claimed, with evidence?" The difference is independence and evidence: the auditor doesn't work for the control owner, and every conclusion traces…
Investigations and digital forensics: the management and legal view
Stage E · Expert
Someone has to decide, before the incident, that evidence will exist when needed — and after, that it can actually be used. That's the management view: forensic readiness (logging, imaging capability, trained first…
Logging and monitoring operations: deciding what gets watched, and by whom
Stage E · Expert
Every detection the SOC ever makes rests on a decision somebody made months earlier: log this event, keep it this long, send it to the people watching. Logging and monitoring operations is the discipline of making those…
Configuration management: baselines, hardening, and catching drift
Stage E · Expert
Every system ships in a default state optimized for working everywhere, which means optimized for security nowhere: unnecessary services running, default credentials set, verbose error messages on. Configuration…
Foundational security operations concepts: the principles you run on
Stage E · Expert
Every operational security decision is one of a small set of principles applied to a new situation: who really needs this access, what's the smallest privilege that works, who else must be involved before this happens,…
Media protection: handling the physical object
Stage E · Expert
Data has a body. It lives on drives, tapes, USB sticks, printed pages, and the backup media in the off-site cage — and every one of those objects can be lost, stolen, sold, or thrown away with the data still on it.…
Incident management: the team, the escalation, and the communications
Stage E · Expert
The response lifecycle tells you what to do about an incident; incident management decides who does it, who gets told, and how the organization gets better afterward. It shows up in…
Detective and preventive measures in operation: choosing, placing, and tuning controls
Stage E · Expert
Controls are easy to buy and hard to operate. The difference between a control that protects and one that decorates is a series of unglamorous decisions: which type fits the risk, where it sits in the architecture, who…
Patch and vulnerability management operations: from CVE to deployed fix
Stage E · Expert
Vulnerabilities are found constantly; patches exist for most of them; breaches still happen through unpatched systems years later. The gap between "patch available" and "patch deployed" is an operations problem —…
Change management: approving the change before it ships
Stage E · Expert
Most outages are caused by changes, and most unauthorized changes were made by authorized people skipping the process. Change management is the discipline that puts a decision — with a rationale, a risk assessment, and…
Physical security in operation: running the building's defenses day to day
Stage E · Expert
The badge reader, the guard, the camera, the mantrap — none of them work without the operation behind them: the guard's post orders, the badge lifecycle, the camera someone actually watches, the visitor log someone…
Personnel safety: protecting the people, not just the accounts
Stage E · Expert
Security operations protect systems; this lesson protects the humans who run them. Personnel safety covers the risks to people as people: the engineer traveling to a high-crime region, the workplace-violence warning…
How LLM applications are built and where they are attacked
AI track
Every AI security task you will ever do starts at a whiteboard with boxes and arrows: where does user input enter, where does retrieved content enter, what can the model touch, and where is the boundary between…
The OWASP LLM Top 10 beyond prompt injection
AI track
Prompt injection is the risk everyone has heard of; the other nine are the risks that actually fill incident reports. When a vendor says "our model doesn't leak training data," that is a claim about LLM02. When a team…
AI supply chain security
AI track
Every model you have ever downloaded is someone else's build artifact, produced on someone else's infrastructure, from data you have never seen. The question "is this model what it claims to be?" is the entire lesson,…
Governing AI
AI track
Someone has to answer "is this safe to ship, and who says so?" — that someone is you if you work GRC, security leadership, or AI security engineering at any organization large enough to have a risk committee. The answer…
Red team operations: concepts
Stage D · Specialist
A red team is hired to act like an adversary so the defenders can practice on something real. The job needs a shared language for "what the adversary did," and that language is MITRE ATT&CK. You will meet it in…
Malware analysis: concepts
Stage D · Specialist
Every SOC alert that says "suspicious file" ends with someone answering one question: what does this program do? Malware analysts answer it for incident response (what did it do here?), for threat intel (what…
Cloud security: concepts
Stage D · Specialist
Most "cloud breaches" are not breaks of the cloud — they are misconfigurations by the customer: a storage bucket left public, a firewall rule opened to the world, an access key committed to a repo, a trail left…
Application security: concepts
Stage D · Specialist
Someone has to make sure the software gets built securely, not just tested after release. Application security is that discipline: threat modeling before code, scanners and reviews during development,…
Authorization, scope, and the hard rules
Stage B · Practitioner
This is the lesson that gates everything after it. Every hands-on lesson in Stage B — every lab you stand up, every PortSwigger exercise, every bounty report you will ever write — assumes you can state, in writing, what…
Engagement methodology: WSTG, PTES, and NIST SP 800-115
Stage B · Practitioner
Authorization tells you what you may touch. Methodology tells you what to do with it, in what order, and what each step produces. Without a methodology you poke at random: you find the easy bugs, miss the structural…
The toolbench: fifteen phases, one question each
Stage B · Practitioner
Every engagement in the methodology lesson runs on tools, and every tool in this lesson exists to answer exactly one question. Beginners collect tools; professionals collect answers. The difference shows up in the…
Setting up practice targets locally
Stage B · Practitioner
Every hands-on lesson in this guidebook needs a target you are allowed to touch, and the answer is always the same: one you run yourself, on your own machine, bound to localhost. This lesson builds that bench of targets…
Python for security tooling
Stage A · Foundations
Every tool you will meet in Stage B is, under the hood, a program that opens connections, sends crafted input, and parses what comes back — and an enormous share of them are Python scripts.
Reading code through a vulnerability
Stage A · Foundations
Every vulnerability you will ever find is a story about input: where it enters, what touches it, and where it lands. Source code is where that story is written down — and the ability to read it, following one…
Windows concepts for security
Stage A · Foundations
The servers you will attack in Stage B are Linux. The victims in Stage C and D are very often Windows: the workstation that got phished, the domain controller, the server running the business application.…
OSINT and research discipline
Stage A · Foundations
Every authorized engagement in b-methodology begins with reconnaissance — and the first half of reconnaissance never touches the target at all. OSINT (open-source intelligence)…
AI attacks and defenses in the build pipeline
AI track
Every model you will ever deploy passed through a pipeline: data was collected, a training or fine-tuning job ran, an artifact was packaged, it landed in a registry, and something deployed it. That pipeline is an attack…
Threat modeling AI systems
AI track
Before anyone writes a control, someone has to answer: what are we actually afraid of, here, in this system? That answer is a threat model, and for AI systems it is a distinct skill — not because the…
Running a security program
Stage E · Expert
Someone has to own security as a whole — not the vulnerabilities, the tools, or the incidents, but the program: the direction, the resources, the proof it works. That someone is the security program lead (a…
Board-level communication
Stage E · Expert
Every security program eventually faces its real audience: people who control the budget, accept the risk, and do not read firewall logs. The board memo, the quarterly briefing, the incident call where you have ninety…
DFIR deep: disk, memory, network forensics
Stage D · Specialist
Triage ends with a decision: close it, or escalate it. Everything in this lesson is the escalation side — the work that begins when an alert becomes an incident and someone has to answer, with evidence, what…
Exploit development and reverse engineering: concepts
Stage D · Specialist
Every memory-safety CVE you have ever read — the buffer overflow in the CVE record, the use-after-free in the Project Zero write-up — is the same story at the bottom: a program written in an unsafe language mishandled…
Building a public track record: write-ups that teach
Stage C · Professional
The guidebook's thesis, stated in the brief and repeated in every stage, is that skill should leave public, verifiable evidence: lab artifacts, reports, disclosed findings, CVE credits, detection work,…
AI tooling professionals use: the Cyber Verification Program as the worked example
Stage C · Professional
Frontier AI models ship with conservative safeguards, and those safeguards block legitimate security work — malware analysis looks like malware creation to a classifier, authorized penetration testing looks like attack…
NIST Cybersecurity Framework 2.0
Stage E · Expert
Every security program eventually faces the same meeting: leadership asks "how secure are we, and what should we do next?" and the answer has to be structured, comparable, and honest. The NIST Cybersecurity Framework is…
ISO/IEC 27001
Stage E · Expert
Sooner or later a customer, a partner, or a regulator asks some version of: "prove you manage information security systematically." In much of the world — especially Europe and in regulated industries — the accepted…
SOC 2 and the Trust Services Criteria
Stage E · Expert
A prospective enterprise customer sends your company a security questionnaire, and question 40 reads: "Provide your most recent SOC 2 Type II report." If you have one, the sales cycle shortens by months; if you don't,…
Cryptography: what the primitives do, and what breaks when you misuse them
Stage A · Foundations
Every login you will ever test touches cryptography: the password is hashed, the session cookie is signed or encrypted, the traffic runs over TLS, the server's identity is a…
API abuse: the flaws that live behind the JSON
Stage B · Practitioner
Modern applications are APIs wearing a web page as a costume: the front end is JavaScript calling JSON endpoints, and the mobile app talks to the same endpoints directly. Testers who only click the UI miss the real…
Server-side template injection: when your input becomes the program
Stage B · Practitioner
Web applications build pages from templates: files mixing fixed HTML with placeholders the server fills in (Hello, {{ name }}). Template injection happens when attacker input stops being…
XXE: when the parser works for the attacker
Stage B · Practitioner
XML is still everywhere: SOAP APIs, SAML assertions (SAML — Security Assertion Markup Language — the XML-based tokens used in single sign-on logins), document uploads (DOCX/XLSX are zipped XML), SVG images,…
Insecure deserialization: when data builds the objects
Stage B · Practitioner
Applications constantly convert objects to bytes and back — sessions in cookies, cached objects, messages between services, "remember me" tokens. Serialization is object→bytes;…
GraphQL abuse: the query language that trusts the querier
Stage B · Practitioner
GraphQL replaces REST's fixed endpoints with a single endpoint that answers whatever shape the client asks for: the client writes the query, the server resolves it. That flexibility is the feature — and the…
Race conditions: when "check, then act" isn't atomic
Stage B · Practitioner
Most web code runs as check, then act: check the coupon is unused, then apply the discount; check the balance covers the transfer, then move the money; check the username is free, then create the…
JWT and OAuth flaws: trusting the token more than the verifier deserves
Stage B · Practitioner
JSON Web Tokens carry identity between services: header.payload.signature, base64url-encoded, the signature proving the payload wasn't tampered with. OAuth 2.0 is the delegation protocol that hands those…
AI security automation: concepts
AI track
You are a SOC analyst, a detection engineer, or the person on a purple team who has to answer "what changes when the attacker uses AI?" The SANS subject areas for this ground are SEC598 (automation for offense, defense,…
Reading order: DNS → TCP/IP → Linux CLI → Windows concepts → Git & GitHub → HTTP in depth → Python for security → Reading code → OSINT & research discipline → Authorization & scope → Methodology → Toolbench → Practice targets → IDOR → SQL injection → Command injection → SSRF → CSRF → XSS → Business-logic flaws → Session & auth → Security headers → Bug bounty mechanics → SOC triage → Log sources → Sigma detection → Incident response → Coordinated disclosure → CVE Program → CVSS → Vulnerability ecosystem → IAM → Applied crypto → Secure SDLC → BCP/DR. AI track: Prompt injection → LLM architecture → LLM Top 10 → Supply chain → AI governance → AI pipeline → AI threat modeling. Risk assessment → IAM → Applied crypto → Secure SDLC → BCP/DR → Security program → Board communication. Stage D wave 1: Red team concepts → Malware analysis → Cloud security → AppSec. Stage D wave 2: Exploit concepts → DFIR deep. Stage C remainder: Vulnerability ecosystem → Public track record → AI tooling. AI track: Prompt injection → LLM architecture → LLM Top 10 → Supply chain → AI governance → AI pipeline → AI threat modeling.
The stages
Stage A — Foundations
Novice to grounded
The login-to-render path, packet by packet…
Stage B — Practitioner
First valid finding
Authorized testing, vulnerability classes, triage-ready reports…
Stage C — Professional
Disclosure and credit
Coordinated disclosure, CVE records, detection work…
Stage D — Specialist
One track, deep
Red team, DFIR, AppSec, exploit dev, malware, cloud…
Stage E — Expert
Breadth and leadership
CISSP domains, governance, running a security program…
Each stage page states the stage's goal, its milestone, and what a reader can and cannot honestly claim after it.
Role paths
Knowledge maps
CISSP knowledge map
Every objective, 1.1 to 8.5
Each objective points to the lesson that teaches it — or is logged as a gap…
CAISP knowledge map
Seven chapters
Each chapter points to the lessons that teach it…
AIGP knowledge map
Four domains
IAPP’s AI governance domains, mapped to lessons…
GASAE knowledge map
Ten objectives
GIAC’s AI security automation objectives, mapped to lessons…
GOAA knowledge map
Ten objectives
GIAC’s offensive AI objectives — defensive side only…
AAISM knowledge map
Three domains
ISACA’s AI security management domains, mapped to lessons…
How we verify
The same rules as the rest of this site: no verification URL, no row. Every walkthrough command was executed in a clean local environment and the transcript kept; where a step could not run — no Docker, no local model, no packet capture, no UDP loopback on the build machine — the lesson marks it not run by us instead of pretending.