Build Cybersecurity Skills Through Real-World Challenges.
Go beyond theory. Develop practical cybersecurity expertise through hands-on exercises, realistic scenarios and problem-solving designed for working professionals.
Courses
Develop the knowledge, judgment and technical capability to tackle real cybersecurity challenges through structured learning, hands-on exercises and practical problem-solving.
Cybersecurity Engineering
Identity, endpoint, and platform security you design, deploy, and defend.
SOC, Threat Detection & Hunting
Detection rules, hunt campaigns, and SOC operations that find threats before they escalate.
Digital Forensics & Incident Response
From alert to containment to court-defensible findings, across cloud, Windows, Linux, and macOS.
Cybersecurity Operations
GRC and the operational backbone that connects controls to business outcomes.
AI Security
Securing the LLM applications and AI agents an organization builds, from the threat model to the incident.
Learning paths
Each path is an ordered sequence of courses that takes you to a capability you can demonstrate.
Practice Hub
Every surface here runs against one fictional estate: 810 staff, 865 endpoints, twelve servers, and telemetry generated from real attack chains rather than sampled at random. You write the queries, reach the findings, and make the containment calls, and the engine scores the decision rather than the keystrokes.
Graded environments
You work the problem and the engine scores the decision, not just the answer.
Take an alert from intake through investigation against live telemetry to a containment decision and a written record. Scored throughout, with the reasoning behind every call.
SigninLogs
| where ResultType != 0
| summarize count() by IPAddressThe queue as it actually arrives: several open incidents, competing priorities, and the judgment of which one to take first.
Generated evidence across Windows, Linux and cross-platform intrusions. Examine the artifacts, reach a finding, and defend it.
Write SPL against the same estate the courses investigate, projected into Splunk CIM sourcetypes. Graded on the result your query actually returns.
CloudTrail, VPC flow and GuardDuty against a generated AWS estate. Practitioner drills first, then multi-phase investigations.
SELECT eventName, count(*)
FROM cloudtrail_logs
GROUP BY 1Volatility 3 in the browser over simulated Windows memory captures. Free practice challenges with a brief and questions, plus the captures the Memory Forensics course is worked on.
Design reviews and architecture tools drawn from the courses: judge a proposal someone else wrote, or build your own, and keep the record as a file.
Open practice
No exercise, no grading. The estate and a console.
Free tools and references
Interactive tools and working references for SOC analysts and incident responders. Nothing gated; use them in the browser.
Production KQL for Microsoft Sentinel and Defender XDR, organized by ATT&CK tactic. Copy, adapt, run.
Open the tool →Seven structured investigation runbooks, identity compromise, endpoint, email, and more, from first signal to containment.
Open the tool →The full collect-parse-analyze Windows DFIR workflow: KAPE targets and modules, custom .tkape/.mkape, every EZ Tools parser with the output columns that matter and worked examples.
Read the cheatsheet →Triage a Microsoft 365 alert: classify it, pull the right table, decide containment, and know what survives a token revoke.
Read the cheatsheet →From the blog
Written to give you something you can apply at work this week.
Device code phishing passes MFA on Microsoft's own page. Find it in sign-in logs, catch the device registration that follows, and block the flow safely.
Read article →Revoke sessions in Entra ID kills refresh tokens, not issued access tokens, app sessions or guests. Contain in the right order and verify it from the logs.
Read article →Defender's remote-session columns describe RDP, so WinRM sessions leave them empty. Find PowerShell remoting and its source from the host process and the port.
Read article →Start building the capability
Pick the course closest to the work in front of you, read its first module, and decide from there.
Browse Courses