Stage C — Professional
Working like a professional: the defender's side — SOC triage, log sources, detection engineering, incident response — plus coordinated disclosure end to end, the CVE program and how credit works, severity scoring by hand, the vulnerability catalogs, and building the public track record the whole program's premise rests on.
Published 2026-10-09 · generated from the lesson data
The milestone
A coordinated disclosure completed, and a CVE record that credits you — a public, permanent entry with your name on it.
The lessons
1. SOC Triage: From Alert to Decision
Every alert a security operations center produces lands on a human who has minutes — not hours — to decide what it means. That decision is triage: turning a detection's hypothesis into a classification and a routing…
2. Log Sources That Matter
Triage told you what to decide; this lesson tells you where to look. Every investigation is a question aimed at a log source: "who logged in where" goes to identity logs, "what did the process do" goes…
3. Writing Detections with Sigma
Every alert triage ever performed started as a detection someone wrote. Detection engineering is the discipline of turning "we should notice when X happens" into a tested, tuned rule that fires on X and stays quiet on…
4. Incident Response Basics
Triage ends with "confirmed incident" — and then a different discipline takes over. Incident response is the structured work of containing, eradicating, and recovering from a security incident without making it worse:…
5. Coordinated vulnerability disclosure
Everything before this lesson taught you to find flaws on targets you are allowed to touch. The moment you find a real flaw in software you do not own, you have a second problem: telling the people who can fix it…
6. The CVE Program
A CVE ID is the closest thing the security field has to a permanent public record of a vulnerability — and of who found it. When a hiring manager, a bounty platform, or a program like Anthropic's Cyber Verification…
7. CVSS v3.1 and v4.0, scored by hand
Every prioritization decision in security runs through a CVSS score: the scanner output you triage, the KEV catalog's urgency, the vendor advisory's headline number, the risk register's "High." Most practitioners treat…
8. The surrounding catalogs: CWE, CAPEC, KEV, EPSS — and where enrichment comes from now
A CVE record tells you a flaw exists. It does not tell you what to do first. Every security team on earth faces the same queue — thousands of CVEs, finite patching windows — and the industry built four catalogs to…
9. Building a public track record: write-ups that teach
The guidebook's thesis, stated in the brief and repeated in every stage, is that skill should leave public, verifiable evidence: lab artifacts, reports, disclosed findings, CVE credits, detection work,…
10. AI tooling professionals use: the Cyber Verification Program as the worked example
Frontier AI models ship with conservative safeguards, and those safeguards block legitimate security work — malware analysis looks like malware creation to a classifier, authorized penetration testing looks like attack…
In reading order, 10 lessons. Every lesson follows the same ten parts — mechanism, walkthrough, sources, proof — and every walkthrough was executed and dated.
What you can honestly claim
You can honestly claim: you have reported a real flaw responsibly and can point to the public record; you can score severity and prioritize like a professional. You cannot yet claim: specialization depth — that is Stage D — or managerial breadth — that is Stage E.
What comes next
When the milestone is met, continue to Stage D — Specialist.