Choose the cybersecurity path that matches where you are now.

What this course is for

A child-first digital safety course that turns everyday situations—logging in, chatting, sharing photos, using apps and asking for help—into safe habits. It does not teach hacking tools. It teaches children to protect themselves, respect others and involve a trusted adult early.

What you will be able to do

• Create and protect a strong passphrase and explain why multi-factor authentication helps.
• Recognise personal information, risky sharing and permanent digital footprints.
• Respond safely to unwanted contact, cyberbullying and account problems.
• Build a practical family digital-safety plan.

What the course covers

1. My digital world and trusted adults — 2.5 hours

   Devices, accounts, online identity, private and public information, and when to pause and ask for help.

2. Passwords and account protection — 2.5 hours

   Passphrases, password reuse, password managers, multi-factor authentication and account-recovery contacts.

3. Privacy and personal data — 2.5 hours

   Names, photographs, location, school details, permissions and sharing only what is necessary.

4. Digital footprints — 2.5 hours

   Posts, screenshots, forwarding, online reputation and thinking before publishing.

5. Social media and messaging safety — 2.5 hours

   Known and unknown contacts, privacy settings, group chats and safe blocking and reporting.

6. Cyberbullying, consent and digital citizenship — 2.5 hours

   Kind conduct, permission before sharing, safe bystander choices and preserving evidence.

7. Account recovery and asking for help — 2.5 hours

   What to do after clicking something unsafe, losing a password or receiving an unexpected message.

8. Family safety plan and learner showcase — 2.5 hours

   Scenario exercises, a home-safety checklist and a short learner-parent presentation.

Practical work and labs

• Passphrase-building activity and multi-factor authentication role-play.
• Practice-profile privacy check and app-permission sorting.
• Cyberbullying response scenarios and trusted-adult decision activity.
• Family device and account-safety checklist.

How your work will be assessed

Activity portfolio: 40%. Four scenario checks: 20%. Family safety plan and short learner showcase: 40%. There is no high-pressure written examination.

What this course is for

An investigation-based course covering situations children commonly encounter, including fake links, game-chat manipulation, online marketplace offers, misinformation, deepfakes and unsafe prompts. Learners practise slowing down, checking evidence and reporting safely.

What you will be able to do

• Spot common persuasion and phishing signals without depending on only one visual clue.
• Use safer gaming, chat and marketplace habits.
• Cross-check online claims, images and sources.
• Explain why AI-generated content can be convincing while still being incorrect or manipulated.

What the course covers

1. How scammers create urgency and trust — 2.5 hours

   Fear, prizes, authority, friendship, urgency and the pause-check-tell method.

2. Phishing, fake links and QR-code traps — 2.5 hours

   Checking senders, domains, shortened links, fake login pages and safe reporting.

3. Safe gaming and online communities — 2.5 hours

   Voice and text chat, game trades, modifications, purchases, strangers and account recovery.

4. Browser, search and source verification — 2.5 hours

   Search results, advertisements, source identity, supporting evidence, dates and context.

5. AI safety, deepfakes and safe prompting — 2.5 hours

   AI-generated media, incorrect AI answers, prompt privacy and verification before sharing.

6. Marketplace and customer-support scams — 2.5 hours

   Fake customer support, payment requests, OTPs, screen sharing and refund fraud.

7. Preserving evidence and reporting safely — 2.5 hours

   Taking useful screenshots without spreading harmful material, blocking, reporting and involving trusted adults.

8. Digital-trust investigation — 2.5 hours

   A controlled case combining messages, search results, images and account events.

Practical work and labs

• Controlled phishing-message investigation using fictional accounts.
• URL and domain inspection using mentor-prepared examples.
• Gaming trade and chat-safety simulations.
• Deepfake and context-verification worksheet with a final investigation board.

How your work will be assessed

Weekly detective notebook: 35%. Scenario decisions: 25%. Final digital-trust investigation and explanation: 40%.

What this course is for

A hands-on defensive course that explains devices, apps, websites, downloads, home Wi-Fi and smart gadgets. Children learn what important settings do and practise making devices safer without touching real malware or third-party systems.

What you will be able to do

• Review permissions, updates, screen locks, backups and download choices.
• Explain at a simple level how a browser reaches a website.
• Recognise unsafe files, USB behaviour and app sources.
• Draw and improve a home-network and smart-device safety map.

What the course covers

1. Device-security baseline — 3 hours

   Screen locks, updates, backups, lost-device actions and safe use of shared devices.

2. Apps and permissions — 3 hours

   Camera, microphone, contacts, location, notifications and allowing only necessary access.

3. Downloads, malware and USB safety — 3 hours

   File sources, file extensions, security warnings, removable devices and controlled simulations.

4. Internet and website detectives — 3 hours

   Routers, internet providers, DNS, addresses, browsers, servers and encrypted connections.

5. Browser-safety controls — 3 hours

   Downloads, pop-ups, extensions, saved passwords, cookies and the limitations of private browsing.

6. Home Wi-Fi and guest access — 3 hours

   Router administration, stronger Wi-Fi credentials, guest networks and update routines.

7. Smart-home and connected-device safety — 3 hours

   Cameras, speakers, televisions and toys: default settings, collected data and safe device retirement.

8. Secure My Technology project — 3 hours

   Audit a fictional household, prioritise security improvements and present a safer design.

Practical work and labs

• Practice-device security and permission audit.
• Safe and risky download classification with a controlled USB simulation.
• Physical packet-delivery model showing how browsers, DNS and servers communicate.
• Home-network diagram, guest-network plan and smart-device retirement checklist.

How your work will be assessed

Lab workbook: 45%. Safety-configuration check: 20%. Secure My Technology final project: 35%.

What this course is for

A practical introduction to how information is represented, protected and moved. Learners progress from classical ciphers to modern encryption, hashes, certificates, packets, IP addresses, DNS and ports using visual demonstrations and controlled labs.

What you will be able to do

• Explain the differences between encoding, encryption and hashing.
• Explain shared keys, public and private keys, digital signatures and certificates at an age-appropriate level.
• Identify the purposes of IP addresses, DNS, TCP, UDP and common ports.
• Interpret a simplified packet capture and recommend a safer connection.

What the course covers

1. Data, bits and representation — 3 hours

   Text, numbers, images, binary concepts, metadata and why representing information is not the same as protecting it.

2. Classical codes and ciphers — 3 hours

   Substitution, Caesar and transposition ciphers, pattern weaknesses and ethical puzzle-solving.

3. Encoding, encryption and hashing — 3 hours

   Their different purposes, reversible and one-way operations, and integrity checks.

4. Symmetric encryption — 3 hours

   Shared secrets, key handling, nonces, initialisation vectors and the danger of reusing keys.

5. Public-key encryption — 3 hours

   Key pairs, key exchange, digital signatures and establishing trust without first sharing a secret.

6. Certificates and HTTPS — 3 hours

   Certificate authorities, browser indicators, the purpose of TLS and certificate warnings.

7. Packets, addresses and protocols — 3 hours

   MAC and IP addresses, TCP, UDP and protocol purposes explained through a delivery analogy.

8. DNS, ports and services — 3 hours

   Name resolution, common services and why unnecessary services create additional risk.

9. Network observation — 3 hours

   Mentor-provided packet captures, filters, normal patterns and privacy boundaries.

10. Secure-message and network project — 3 hours

    Design, demonstrate and explain a protected message path and basic network controls.

Practical work and labs

• Paper-based cipher attack and defence challenges.
• Hash-change and digital-signature demonstrations.
• Certificate inspection on approved websites.
• Controlled Wireshark capture filtering and network-mapping exercise.

How your work will be assessed

Concept checks: 20%. Lab portfolio: 40%. Secure-message and network final project: 40%.

What this course is for

The technical final course in the Young Cyber Explorers pathway. Learners write Python programs, use a safe Linux command line, solve defensive investigation challenges and understand cybersecurity ethics and career paths. The course is intentionally longer so beginners are not rushed.

What you will be able to do

• Write and test small Python programs using variables, decisions, loops, functions and files.
• Navigate Linux, manage files and understand users, permissions, processes and logs.
• Solve controlled defensive challenges using evidence and proper documentation.
• Explain authorisation, responsible security testing and several cybersecurity career paths.

What the course covers

1. Python foundations I — 6 hours

   Values, variables, input, output, data types and safe debugging.

2. Python foundations II — 6 hours

   Conditions, loops, functions and breaking a problem into smaller parts.

3. Python data and files — 6 hours

   Lists, dictionaries, text files, CSV files and simple log processing.

4. Defensive Python mini-tools — 6 hours

   Password-policy checker, hash comparison, indicator lookup from a local file and report generation.

5. Linux command-line foundations — 6 hours

   Navigating the filesystem, viewing and searching text, pipes and safe command habits.

6. Linux users, permissions and processes — 6 hours

   Accounts, groups, file permissions, processes, services and why privileges matter.

7. Defensive cybersecurity challenges — 6 hours

   Log clues, file integrity, suspicious messages, network evidence and documented reasoning.

8. Ethics, careers and final challenge — 6 hours

   Authorisation, acceptable use, cybersecurity careers, teamwork and a supervised defensive project.

Practical work and labs

• Python exercises and defensive mini-tools.
• Disposable Linux virtual machine using safe snapshots and no public targets.
• Local log, file and packet-evidence investigations.
• Team defensive challenge with an incident note and oral explanation.

How your work will be assessed

Coding and lab portfolio: 40%. Linux practical assessment: 20%. Final defensive challenge and explanation: 40%. Learners must follow all ethical-lab rules.

What this course is for

A short safety and workflow course for learners who understand cybersecurity concepts but have not worked inside a controlled cyber lab. It develops safe testing habits before the learner enters advanced practical courses.

What you will be able to do

• Create, isolate, snapshot and restore lab virtual machines.
• Use command-line help, organise evidence and maintain a repeatable lab notebook.
• Apply authorisation, testing scope and data-handling rules before beginning any security exercise.

What the course covers

1. Authorised lab design — 4 hours

   Testing scope, acceptable use, isolated networks, ownership of targets and safe data handling.

2. Virtual machines and snapshots — 4 hours

   Virtual-machine images, system resources, isolated networking, restoration and troubleshooting.

3. Professional commands and evidence workflow — 4 hours

   Command-line help, file transfers, hashing, screenshots, timestamps and professional notes.

4. Repeatable mini-investigation — 4 hours

   Prepare the lab, perform the exercise, record the work, clean the environment and submit a defensible evidence package.

Practical work and labs

• Build an isolated two-virtual-machine laboratory.
• Practise snapshots, restoration and connectivity troubleshooting.
• Create an evidence folder, command log and repeatability checklist.

How your work will be assessed

Safety assessment: 20%. Lab-setup practical: 30%. Repeatable mini-investigation: 50%.

What this course is for

This course teaches how modern web applications and APIs work before learners begin testing their security. Database and SQL knowledge is included so learners can understand how information enters, moves through and is stored by an application.

What you will be able to do

• Build and trace the operation of a small web application and API.
• Work with web requests, forms, sessions, JSON, REST and SQL queries.
• Explain trust boundaries, user-input paths and access-control decisions.

What the course covers

1. Application architecture — 6 hours

   Browsers, user interfaces, servers, databases, supporting services and trust boundaries.

2. HTML, forms and JavaScript behaviour — 6 hours

   User inputs, webpage events, requests and the responsibilities of browsers and servers.

3. Server-side request handling — 6 hours

   Routes, parameters, input validation and generating responses.

4. Sessions and authentication flow — 6 hours

   Cookies, tokens, login, logout, session state and access checks.

5. REST and JSON APIs — 8 hours

   Resources, request methods, status codes, data structures and safe error handling.

6. API authentication concepts — 6 hours

   API keys, bearer tokens, OAuth and OpenID Connect orientation, and safe token storage.

7. SQL and relational databases — 10 hours

   Tables, keys, creating and changing records, joins, parameters and transactions.

8. Logging, errors and safer application design — 6 hours

   Useful application logs, safe failures, secret values and software-dependency awareness.

9. Application-mapping final project — 6 hours

   Build or inspect an application and document its components, data movement and trust boundaries.

Practical work and labs

• Complete exercises using a local web application and API.
• Observe application behaviour using browser-development tools and an approved proxy.
• Complete SQLite or PostgreSQL query exercises using parameterised code.
• Produce a data-flow and trust-boundary application map.

How your work will be assessed

Application-building and observation labs: 45%. SQL and API practical: 20%. Application map and demonstration: 35%.

What this course is for

This course provides the assessment and reporting method required before entering LTE security-testing pathways. Learners discover systems, safely verify vulnerabilities, assess risk, preserve evidence, recommend practical corrections and write reports that technical teams and managers can use.

What you will be able to do

• Plan an authorised security assessment and remain within its approved scope.
• Run and verify discovery and vulnerability checks without treating automated results as automatically correct.
• Prioritise findings and produce repeatable evidence and practical correction guidance.
• Deliver management and technical reports and verify completed corrections.

What the course covers

1. Rules of engagement and assessment method — 6 hours

   Objectives, systems, testing scope, timing, contacts, stop conditions and clean-up.

2. System discovery and attack-surface inventory — 6 hours

   Hosts, services, applications, software versions, ownership and supporting evidence.

3. Vulnerability information and scanning — 8 hours

   Security advisories, vulnerability identifiers, severity concepts, authenticated and unauthenticated scans and tool limitations.

4. Manual verification of findings — 8 hours

   Reproducing results, identifying false positives, understanding the environment and producing safe proof.

5. Risk and prioritisation — 6 hours

   Severity, likelihood, exposure, exploitability, organisational impact and existing protections.

6. Evidence and repeatability — 6 hours

   Screenshots, web requests, commands, timestamps, minimum necessary data and clear reasoning.

7. Correction guidance and retesting — 6 hours

   Root causes, practical corrections, verification and closure requirements.

8. Professional security-report writing — 8 hours

   Management summary, scope, method, findings, limitations and technical supporting information.

9. Authorised assessment final project — 6 hours

   Assess a controlled multi-service target and present a defensible professional report.

Practical work and labs

• Prepare a security-testing rules-of-engagement document.
• Perform network, service and local-application scanning inside an isolated environment.
• Verify false positives and review the quality of collected evidence.
• Prepare a complete report, deliver a client-style presentation and write a retest note.

How your work will be assessed

Lab and evidence portfolio: 35%. Individual finding write-ups: 25%. Final authorised assessment report and presentation: 40%.

What this course is for

This course moves learners from searching logs to performing practical defensive-security work. Learners verify alerts, connect evidence from devices, networks and identities, assign severity, make safe containment decisions and document their work using repeatable procedures.

What you will be able to do

• Follow a complete alert-to-investigation workflow.
• Connect evidence from devices, networks, email and identity systems.
• Map suspicious behaviour, recommend containment and write a case suitable for escalation.

What the course covers

1. Security-operations workflow and case quality — 6 hours

   Alert queues, priorities, response targets, escalation, handover and documentation.

2. Device-security information — 8 hours

   Processes, related processes, persistence, files and user context.

3. Network and DNS evidence — 8 hours

   Connections, domains, protocols, normal behaviour and suspicious patterns.

4. Email and phishing investigation — 6 hours

   Email headers, links, attachments, sender infrastructure and affected users.

5. Identity and cloud sign-in activity — 6 hours

   Failed access, multi-factor authentication, location, device context and risky sign-in patterns.

6. Threat information and behaviour mapping — 6 hours

   Indicators, attacker behaviour, confidence levels, evidence enrichment and MITRE ATT&CK orientation.

7. Containment and evidence preservation — 6 hours

   Device, account and network containment, required approvals and possible side effects.

8. Improving detection and response procedures — 6 hours

   Root causes, false positives, alert improvement and lessons learned.

9. Defensive-security final project — 8 hours

   Complete a multi-stage incident exercise involving investigation, escalation, containment and explanation.

Practical work and labs

• Complete device, network and email investigation exercises.
• Perform behaviour mapping and evidence-enrichment exercises.
• Use a simulated case-management workflow and containment-decision table.
• Complete a timed defensive-security shift simulation.

How your work will be assessed

Investigation-case portfolio: 35%. Two alert-investigation practicals: 25%. Defensive-security final project: 40%.

What this course is for

This course prepares learners to operate cloud resources through both a management portal and command or API workflows before they enter advanced cloud-security training. Microsoft Azure is used as the primary lab platform while the underlying concepts remain applicable elsewhere.

What you will be able to do

• Administer cloud identities, networks, computing, storage and logs.
• Use command-line tools, PowerShell or templates to create repeatable cloud configurations.
• Troubleshoot access and connectivity while controlling spending and preserving useful evidence.

What the course covers

1. Cloud account and resource organisation — 6 hours

   Accounts, subscriptions, resource groups, naming, tags and cost controls.

2. Cloud-identity administration — 8 hours

   Users, groups, roles, automated identities and testing access.

3. Cloud-network administration — 8 hours

   Virtual networks, subnets, routes, network-security groups, DNS and private access.

4. Computing and platform operations — 6 hours

   Virtual-machine lifecycle, system images, updates and managed services.

5. Storage and data services — 6 hours

   Access models, encryption, data lifecycle and backup.

6. Command line, PowerShell and templates — 10 hours

   Authentication, repeatable commands, variables, outputs and safer automation.

7. Logging and monitoring operations — 6 hours

   Enable log sources, search administrative activity and create a basic alert.

8. Troubleshooting and recovery — 4 hours

   Access, networking, service limits, spending and restoration problems.

9. Cloud-automation final project — 6 hours

   Deploy and document a repeatable, monitored cloud environment.

Practical work and labs

• Administer resources inside a controlled cloud sandbox.
• Create cloud deployments using command-line tools or PowerShell.
• Complete cloud-identity and networking troubleshooting exercises.
• Build an automated and monitored cloud environment.

How your work will be assessed

Cloud-administration labs: 45%. Troubleshooting practical: 20%. Cloud-automation final project: 35%.

What this course is for

This course moves learners from identity-security terminology to operating an organisational directory. Learners manage users, groups, policies, sign-on concepts, automated identities, audit records and processes for people joining, changing roles and leaving.

What you will be able to do

• Administer users, groups, roles and policies inside a directory laboratory.
• Trace authentication and single-sign-on flows and troubleshoot common failures.
• Implement identity-lifecycle and access-review controls with usable evidence.

What the course covers

1. Directory architecture — 6 hours

   Domains, tenants, objects, attributes, groups, synchronisation concepts and trust.

2. Users, groups and delegated administration — 6 hours

   Creating accounts, group strategy, role assignment and administrator boundaries.

3. Authentication and access policy — 6 hours

   Passwords, multi-factor authentication, conditional-access concepts, device and user context and recovery.

4. Single sign-on and federation foundations — 8 hours

   Kerberos orientation, SAML, OAuth, OpenID Connect and examining tokens and claims.

5. Service and automated identities — 6 hours

   Service accounts, managed identities, secrets, certificates and ownership.

6. Identity lifecycle and provisioning — 6 hours

   Joining, role changes, leaving, approvals, automation and removing access.

7. Audit, access review and incident response — 6 hours

   Identity logs, outdated access, privileged changes and containing identity incidents.

8. Identity-operations final project — 4 hours

   Implement and explain a small organisation’s identity design.

Practical work and labs

• Administer users, groups and other directory objects.
• Examine sign-in logs, tokens and identity claims.
• Build an identity lifecycle and access-review workflow.
• Complete an identity-operations final project.

How your work will be assessed

Identity laboratory work: 45%. Troubleshooting and lifecycle practical: 20%. Identity-operations final project: 35%.

What this course is for

This course explains collaborative source control, automated building and testing, software packages, containers, registries, infrastructure-as-code concepts and delivery pipelines. Security concepts are introduced here before the learner progresses to advanced DevSecOps training.

What you will be able to do

• Use Git branches, code reviews and recovery features safely.
• Build, test and package a small service through an automated delivery pipeline.
• Build, run and troubleshoot containers and explain essential Kubernetes objects.
• Identify where security checks and approvals belong inside software delivery.

What the course covers

1. Software-delivery lifecycle — 6 hours

   Source code, building, testing, packaging, releases, deployment and operation.

2. Git foundations — 8 hours

   Commits, branches, merges, remote repositories, ignored files and recovery.

3. Collaborative development workflow — 6 hours

   Pull requests, reviews, version tags, releases and protected branches.

4. Automated building, testing and packaging — 8 hours

   Dependencies, unit tests, build outputs and creating repeatable builds.

5. Automated delivery-pipeline foundations — 10 hours

   Jobs, agents, variables, secrets, stages and approvals.

6. Container foundations — 10 hours

   Images, layers, Dockerfiles, storage volumes, container networks and registries.

7. Kubernetes orientation — 8 hours

   Pods, deployments, services, configurations, namespaces and essential commands.

8. Infrastructure-as-code concepts — 6 hours

   Declarative configuration, proposed changes, variables and reviewing changes.

9. Monitoring and release operations — 4 hours

   Logs, measurements, rollback and learning from incidents.

10. Software-delivery final project — 6 hours

    Version, test, containerise and deploy a small service through an automated pipeline.

Practical work and labs

• Resolve Git conflicts and recover prepared repository problems.
• Build an automated pipeline with tests and stored build outputs.
• Complete container-building, networking and storage exercises.
• Deploy a local Kubernetes application and complete the software-delivery project.

How your work will be assessed

Development-workflow labs: 45%. Git and container practical: 20%. Software-delivery final project: 35%.

What this course is for

This course turns governance language into practical work involving valuable assets, risks, security controls, evidence and findings. It prepares learners who prefer non-coding cybersecurity work for advanced risk, compliance and security-audit training.

What you will be able to do

• Build a properly scoped risk register and explain the selected treatment decisions.
• Turn requirements into security controls that can be tested and supported with evidence.
• Interview a control owner and write a fair finding based on the available evidence.

What the course covers

1. Governance, scope and accountability — 5 hours

   Objectives, responsibilities, policies, valuable assets and organisational boundaries.

2. Risk identification and analysis — 5 hours

   Threats, vulnerabilities, likelihood, impact and writing clear risk statements.

3. Risk treatment and acceptance — 5 hours

   Reducing, transferring, avoiding and accepting risks, assigning owners and tracking actions.

4. Security controls and frameworks — 5 hours

   Preventive, detective and corrective controls and mapping between common frameworks.

5. Evidence and control testing — 5 hours

   Control design, whether controls operate correctly, selecting samples and maintaining traceability.

6. Third-party and privacy risk — 5 hours

   Supplier checks, contracts, personal information and ongoing monitoring.

7. Findings and corrective actions — 5 hours

   Current condition, expected requirement, cause, effect, recommendation and management response.

8. Mini-audit final project — 5 hours

   Plan, test, report and close a small security-control review.

Practical work and labs

• Write risk statements and build a risk register.
• Map security controls to required evidence.
• Conduct a simulated interview and test prepared evidence samples.
• Prepare a mini-audit report and conduct a closing meeting.

How your work will be assessed

Risk and control exercises: 30%. Evidence-testing practical: 25%. Mini-audit final project: 45%.

What this course is for

Learn a structured method for testing web applications safely and legally. You will identify vulnerabilities, confirm their impact, explain their cause, recommend practical fixes and prepare a professional security report instead of merely running an automated scanner.

What you will be able to do

• Test authentication, sessions, access control, input handling and business logic in an isolated environment.
• Use proxy-assisted manual testing and collect clear, reproducible evidence.
• Prioritise vulnerabilities and explain their business and technical impact.
• Recommend practical fixes and verify that vulnerabilities have been corrected.
• Complete an authorised web-application security assessment and professional report.

What the course covers

1. Scope, mapping and test strategy (6 hours)

   Rules of engagement, content discovery, technology mapping and attack-surface inventory.

2. Authentication and account recovery (6 hours)

   Login controls, multi-factor authentication, password resets and account-enumeration risks.

3. Session management (6 hours)

   Cookies, tokens, session fixation, session invalidation and secure storage.

4. Access control (8 hours)

   Object-level, function-level and role-based access checks using controlled multi-user testing.

5. Injection and server-side input (8 hours)

   SQL, command and template-injection concepts, safe validation and root-cause analysis.

6. Client-side security (6 hours)

   Cross-site scripting, browser-side data flow, content security policies and browser controls.

7. Server-side requests and file handling (6 hours)

   Server-side request forgery, file uploads, downloads, path traversal and parser risks.

8. Business logic and workflow abuse (6 hours)

   Application states, process limits, race-condition concepts and unsafe trust assumptions.

9. Configuration, components and logging (6 hours)

   Security headers, error handling, third-party components, secrets and security-event logging.

10. Reporting, remediation and retesting (6 hours)

    Severity ratings, evidence, developer guidance and verification of completed fixes.

11. Web-application assessment project (8 hours)

    Complete an end-to-end authorised assessment and present the findings in a client-style review.

Practical work and labs

• Testing of purpose-built vulnerable web applications in an isolated environment.
• Manual testing using an approved web-security proxy and browser tools.
• Authentication, session, access-control and input-validation exercises.
• Finding review and remediation-verification exercises.
• Complete web-application assessment and professional report.

How your work will be assessed

Lab evidence: 35%; vulnerability reports: 25%; final authorised web-application assessment: 40%.

What this course is for

Learn how to test REST APIs, JSON services, token-based authentication and selected GraphQL and webhook implementations. You will examine API inventory, access control, resource limits, sensitive-data exposure and machine-to-machine trust.

What you will be able to do

• Discover and document an API attack surface.
• Test API authentication, tokens and access controls.
• Identify object-level, function-level and property-level authorisation weaknesses.
• Assess rate limits, configuration, versions and third-party API trust.
• Complete an API-specific security assessment, report and retest.

What the course covers

1. API architecture and inventory (6 hours)

   REST, JSON, schemas, OpenAPI, API versions, gateways and endpoint discovery.

2. Authentication and tokens (6 hours)

   API keys, JSON Web Tokens, OAuth, OpenID Connect and secure token handling.

3. Object and function authorisation (8 hours)

   Object-level and function-level access testing using repeatable multi-user scenarios.

4. Property-level authorisation (6 hours)

   Mass assignment, excessive data exposure and schema-based controls.

5. Input, injection and server-side requests (6 hours)

   Parameters, content types, parsers, injection risks and unsafe downstream requests.

6. Resource consumption and automated abuse (6 hours)

   Rate limits, quotas, pagination and protection of sensitive business processes.

7. Inventory, configuration and third-party APIs (6 hours)

   Old API versions, debugging endpoints, TLS, cross-origin controls and supplier trust.

8. GraphQL, webhooks and asynchronous APIs (4 hours)

   GraphQL introspection, query costs, callbacks, event messages and signature verification.

9. API security assessment project (12 hours)

   Prepare a test plan, assess an API, recommend fixes and verify remediation.

Practical work and labs

• API requests and testing using Postman, curl and an approved security proxy.
• Token, claim and authentication testing exercises.
• Multi-user API authorisation testing.
• Rate-limit, API inventory and configuration exercises.
• Complete API security assessment and professional report.

How your work will be assessed

Lab portfolio: 35%; API vulnerability findings: 25%; final API assessment project: 40%.

What this course is for

Learn how to assess an internal network safely and legally. You will progress from scoping and network discovery to service analysis, vulnerability validation, segmentation testing, credential-risk assessment, controlled exploitation, restoration and reporting.

What you will be able to do

• Plan and perform an authorised internal-network assessment.
• Discover hosts, services, trust relationships and network boundaries.
• Validate service, configuration, segmentation and credential-related risks.
• Perform controlled vulnerability validation without damaging systems.
• Produce a prioritised report and verify completed remediation.

What the course covers

1. Rules of engagement and lab operations (6 hours)

   Scope, authorisation, safety, communication, stop conditions and system restoration.

2. Discovery and network mapping (6 hours)

   Hosts, routes, services, system ownership and assessment coverage.

3. Service enumeration (8 hours)

   Analysis of common Windows, Linux and network services using evidence-led methods.

4. Vulnerability validation (8 hours)

   Security advisories, software versions, configuration context and false-positive elimination.

5. Segmentation and firewall testing (6 hours)

   Network paths, trust boundaries, firewall behaviour and evidence collection.

6. Credential and authentication assessment (6 hours)

   Password policies, credential exposure, authentication controls and safe password-audit limitations.

7. Controlled exploitation (8 hours)

   Minimal proof of impact, system stability, logging and clearly defined limitations.

8. Post-access validation and cleanup (6 hours)

   Privilege context, lateral-movement risks, evidence handling and system restoration.

9. Remediation and retesting (6 hours)

   System hardening, segmentation, patching, configuration improvements and verification.

10. Network penetration-testing project (12 hours)

    Complete an authorised assessment of an isolated enterprise network and prepare a professional report.

Practical work and labs

• Isolated network containing multiple Windows and Linux systems.
• Network discovery, service enumeration and segmentation exercises.
• Controlled vulnerability-validation exercises with restoration checkpoints.
• Credential and authentication-control assessment.
• Complete network penetration test, report and findings presentation.

How your work will be assessed

Method and lab portfolio: 35%; validated vulnerability findings: 25%; final network assessment: 40%.

What this course is for

Prepare for entry-level Security Operations Centre work through realistic alert and shift simulations. You will validate alerts, connect evidence, determine severity, recommend containment and communicate findings across endpoint, email, network, identity and cloud-security cases.

What you will be able to do

• Operate an entry-level SOC alert queue using clear investigation procedures.
• Investigate endpoint, phishing, network, identity and cloud alerts.
• Separate false positives from events that require escalation.
• Record investigation evidence and prepare clear incident notes.
• Complete a simulated SOC shift and professional handover.

What the course covers

1. SOC operations and service quality (6 hours)

   SOC responsibilities, alert queues, response times, handovers, severity and escalation.

2. Endpoint alert investigation (8 hours)

   Process trees, files, persistence, malware indicators and user context.

3. Phishing and email incidents (8 hours)

   Email headers, attachments, URLs, mailboxes and user impact.

4. Network and DNS alerts (8 hours)

   Connections, suspicious communication patterns, domains, protocols and normal baselines.

5. Identity and access alerts (6 hours)

   Password-spray indicators, unusual travel, multi-factor authentication and privilege events.

6. Cloud and software-service alerts (6 hours)

   Cloud configuration changes, storage exposure and risky sign-in activity.

7. Threat intelligence and ATT&CK (6 hours)

   Source confidence, indicator enrichment, attacker behaviour and investigation use.

8. Containment, escalation and communication (6 hours)

   Response authority, evidence, affected stakeholders and high-quality incident tickets.

9. Detection improvement and lessons learned (6 hours)

   False positives, alert-tuning requests and investigation knowledge articles.

10. SOC shift simulation (12 hours)

    Complete a timed multi-alert shift, escalate an incident and deliver an oral handover.

Practical work and labs

• Safe SIEM and endpoint-security datasets with a simulated alert queue.
• Email, endpoint, network and identity investigation exercises.
• Evidence collection and incident-ticket documentation.
• Timed alert-triage exercises.
• Complete simulated SOC shift and handover.

How your work will be assessed

Investigation portfolio: 30%; two timed alert-triage practicals: 30%; final SOC shift simulation: 40%.

What this course is for

Develop deeper practical skills in security logging, SIEM searches, detection rules, alert tuning and multi-source investigations. Microsoft Sentinel and KQL may be used as the primary lab platform, while the investigation methods remain applicable to other SIEM technologies.

What you will be able to do

• Collect and validate useful security telemetry.
• Write clear and maintainable SIEM investigation queries.
• Create and test useful detection rules.
• Tune noisy alerts and reduce avoidable false positives.
• Complete a structured investigation using multiple log sources.

What the course covers

1. SIEM architecture, log sources and data quality (6 hours)

   Collection paths, schemas, delays, completeness, retention and operational costs.

2. SIEM query skills I (8 hours)

   Filtering, selecting fields, parsing values and summarising events.

3. SIEM query skills II (8 hours)

   Joins, lookups, time windows, event sequences and reusable query functions.

4. Detection engineering fundamentals (8 hours)

   Detection ideas, attacker behaviour, rule logic, thresholds and test data.

5. Alert tuning and lifecycle management (6 hours)

   False positives, suppression, exceptions, ownership and scheduled reviews.

6. Dashboards and operational measurements (4 hours)

   Detection coverage, alert quality, queue health and useful visual reporting.

7. Investigation and evidence enrichment (8 hours)

   Connecting identity, endpoint, network and threat-intelligence evidence into a timeline.

8. Detection versioning and change control (4 hours)

   Peer review, testing, controlled deployment and rollback of security content.

9. SIEM investigation project (8 hours)

   Onboard data, create and tune a detection rule, and investigate a staged security event.

Practical work and labs

• KQL-style SIEM search and investigation exercises.
• Log-parser and data-quality troubleshooting.
• Detection-rule creation, testing and alert tuning.
• Multi-source event correlation and timeline development.
• Complete SIEM investigation and findings presentation.

How your work will be assessed

SIEM query portfolio: 35%; detection and tuning practical: 25%; final investigation project: 40%.

What this course is for

Learn how to protect cloud identities, networks, workloads, storage and secrets. Azure will be used as the primary lab platform, with AWS comparisons where useful. You will also investigate cloud activity and respond safely to security incidents.

What you will be able to do

• Secure cloud identities, networks, workloads, storage and sensitive data.
• Apply least-privilege access and privileged-access controls.
• Identify and correct cloud-security configuration weaknesses.
• Monitor cloud activity and investigate suspicious events.
• Contain and respond to a staged cloud-security incident.

What the course covers

1. Cloud threats and shared responsibility (6 hours)

   Important cloud assets, provider and customer responsibilities, trust boundaries and common failures.

2. Identity and privileged access (8 hours)

   Roles, least privilege, workload identities, multi-factor authentication, conditional access and privileged-access concepts.

3. Cloud network security (8 hours)

   Segmentation, private endpoints, firewalls, outbound traffic controls and network-flow evidence.

4. Compute and workload protection (8 hours)

   Security of virtual machines, containers, serverless workloads, patching and runtime controls.

5. Storage, databases and data security (6 hours)

   Public access, encryption, keys, backups, recovery and sensitive-data protection.

6. Secrets and key operations (4 hours)

   Secure vault access, ownership, credential rotation and emergency response.

7. Posture and vulnerability management (8 hours)

   Security benchmarks, recommendations, exceptions and remediation tracking.

8. Cloud logging, detections and investigations (8 hours)

   Identity, administrative, network and workload security telemetry.

9. Cloud incident response (6 hours)

   Credential containment, workload isolation, evidence preservation and recovery.

10. Cloud-defence project (10 hours)

    Secure, monitor and defend a staged cloud environment.

Practical work and labs

• Cloud identity, network and storage hardening.
• Privileged-access and least-privilege configuration.
• Cloud-security posture and vulnerability remediation.
• Cloud activity-log investigation.
• Credential containment and cloud incident response.
• Complete cloud-defence project with defined cost limits.

How your work will be assessed

Cloud operations lab portfolio: 35%; configuration and investigation practicals: 25%; final cloud-defence project: 40%.

What this course is for

Learn how enterprise organisations manage user access from account creation through role changes and account removal. You will work with single sign-on, modern authentication, conditional access, privileged accounts, service identities, access reviews and identity incident response.

What you will be able to do

• Design role-based and attribute-based access controls.
• Implement user account lifecycle and access-review processes.
• Configure and troubleshoot single sign-on and modern authentication.
• Protect privileged accounts and automated service identities.
• Investigate and contain identity-related security incidents.

What the course covers

1. Identity architecture and trust boundaries (6 hours)

   Identity sources, directories, tenants, domains and hybrid identity environments.

2. Identity lifecycle and provisioning (6 hours)

   New users, role changes, account removal, approvals and automated provisioning concepts.

3. Role and attribute design (6 hours)

   Role-based access, attribute-based access, segregation of duties and entitlement design.

4. Single sign-on and modern authentication (8 hours)

   SAML, OAuth, OpenID Connect, claims, tokens, signing and troubleshooting.

5. Multi-factor and conditional access (6 hours)

   Authentication factors, passwordless access, device and risk signals, recovery and policy testing.

6. Privileged-access management (6 hours)

   Temporary elevation, just-in-time access, emergency accounts and privileged-session evidence.

7. Workload and service identities (6 hours)

   Managed identities, service accounts, secrets, certificates, rotation and ownership.

8. Identity governance and access reviews (6 hours)

   Access certification, unused permissions, exceptions and audit evidence.

9. Identity detection and response (4 hours)

   Risky sign-ins, stolen sessions, token revocation and account containment.

10. IAM engineering project (6 hours)

    Implement and defend an enterprise identity-management scenario.

Practical work and labs

• Enterprise directory and cloud-identity configuration.
• Single sign-on and token-flow troubleshooting.
• Conditional-access and privileged-access design.
• User lifecycle and access-review exercises.
• Identity-security incident investigation.
• Complete IAM engineering project.

How your work will be assessed

IAM lab portfolio: 35%; identity troubleshooting and design practical: 25%; final IAM engineering project: 40%.

What this course is for

Learn how to integrate security throughout software development and deployment. You will add code, dependency, secret, infrastructure, container and application-security checks to a working delivery pipeline and manage findings without making the pipeline unusable.

What you will be able to do

• Design practical security controls across the software-development lifecycle.
• Add security scanning to a continuous integration and deployment pipeline.
• Identify vulnerable code, dependencies, secrets, infrastructure and containers.
• Create software inventories and protect release artifacts.
• Manage security exceptions, evidence and developer feedback.

What the course covers

1. DevSecOps working model (6 hours)

   Shared responsibility, threat-based controls, fast feedback and meaningful security measurements.

2. Repository and branch protection (6 hours)

   Code reviews, signatures, protected branches, access tokens and least privilege.

3. Static application-security testing (8 hours)

   Security rules, finding analysis, false positives, developer feedback and baselines.

4. Dependency security and software inventory (8 hours)

   Third-party packages, security advisories, software bills of materials, licences and inventory.

5. Secrets and credential protection (6 hours)

   Secret detection, prevention, credential rotation and incident handling.

6. Infrastructure-as-code security (6 hours)

   Configuration policies, deployment plans, drift, scanning and remediation.

7. Container and registry security (6 hours)

   Container images, provenance, vulnerability scanning, signing and admission-control concepts.

8. Dynamic testing and security automation (6 hours)

   Safe test environments, test data, automated security checks and release gates.

9. Software supply-chain integrity (6 hours)

   Build isolation, trusted artifacts, provenance and secure software releases.

10. Security exceptions and measurements (4 hours)

    Risk acceptance, ownership, expiry dates, control coverage and useful measurements.

11. DevSecOps pipeline project (10 hours)

    Secure a delivery pipeline from source-code submission to a deployed application.

Practical work and labs

• Build and configure a continuous integration and deployment pipeline.
• Static code, dependency and secret scanning.
• Infrastructure and container-security scanning.
• Software bill of materials and signed-artifact workflow.
• Security finding review, tuning and exception handling.
• Complete secure-delivery pipeline project.

How your work will be assessed

Pipeline lab portfolio: 35%; security-control implementation practical: 25%; final DevSecOps project: 40%.

What this course is for

Learn how to secure container builds, registries and Kubernetes environments. You will work with access control, namespaces, network policies, secrets, workload restrictions, admission controls, security logging and runtime monitoring.

What you will be able to do

• Build and maintain more secure container images.
• Protect container registries and software artifacts.
• Apply least privilege to Kubernetes users, services and workloads.
• Implement network segmentation and workload-security policies.
• Detect and respond to container and Kubernetes security problems.

What the course covers

1. Container internals and security threats (6 hours)

   Container isolation, runtimes, system boundaries and common attack surfaces.

2. Secure container-image builds (6 hours)

   Minimal base images, non-root users, packages, secrets and repeatable builds.

3. Registry and supply-chain security (6 hours)

   Registry access, vulnerability scanning, signing, provenance and retention.

4. Kubernetes architecture (6 hours)

   Control plane, worker nodes, workloads, APIs and trust boundaries.

5. Identity, service accounts and access control (8 hours)

   Users, service accounts, roles, role bindings, tokens and least privilege.

6. Namespaces, networking and exposure (8 hours)

   Segmentation, services, ingress, network policies and outbound communication.

7. Secrets, configuration and data (6 hours)

   Secret handling, encryption, storage volumes and external secret-management systems.

8. Workload security and admission controls (8 hours)

   Security contexts, system capabilities, workload policies and admission controls.

9. Logging and runtime detection (6 hours)

   Audit logs, workload events, suspicious behaviour and investigation.

10. Hardening and incident response (4 hours)

    Security benchmarks, workload isolation, credential rotation and recovery.

11. Kubernetes security project (8 hours)

    Assess, harden, monitor and defend a local Kubernetes environment.

Practical work and labs

• Local container and Kubernetes lab environment.
• Container-image and registry vulnerability scanning.
• Image signing and artifact-verification exercises.
• Kubernetes access-control and network-policy implementation.
• Workload-security and admission-control configuration.
• Runtime-event investigation and cluster-hardening project.

How your work will be assessed

Container and Kubernetes lab portfolio: 35%; configuration practical: 25%; final Kubernetes security project: 40%.

What this course is for

Learn how to review Python applications using a repeatable security process. You will trace untrusted data, examine security decisions, identify weaknesses, use automated tools carefully, implement safer code and verify that fixes work.

What you will be able to do

• Perform a structured security review of a Python application.
• Trace untrusted data through application code.
• Identify authentication, access-control, injection and file-handling weaknesses.
• Review secrets, cryptography, logging and third-party dependencies.
• Implement safer code and write tests that verify security fixes.

What the course covers

1. Code-review method and threat context (6 hours)

   Scope, application architecture, entry points, important assets and trust boundaries.

2. Data flow and input validation (6 hours)

   Data sources, transformations, sensitive operations, allowlists and canonicalisation.

3. Injection and unsafe code execution (6 hours)

   SQL, operating-system command, template and interpreter-related risks.

4. Authentication, sessions and authorisation (8 hours)

   Identity flows, access checks, multi-user boundaries and account recovery.

5. Files, paths, uploads and unsafe objects (6 hours)

   Path traversal, file types, archives, deserialisation and unsafe parsers.

6. Outbound requests and server-side request risks (4 hours)

   URL validation, network boundaries, redirects and cloud metadata services.

7. Secrets, cryptography and sensitive data (6 hours)

   Configuration, logging, security libraries, storage and key lifecycle.

8. Errors, logs and business logic (4 hours)

   Safe error handling, audit events, application states and workflow abuse.

9. Dependencies and automated review tools (4 hours)

   Static analysis, dependency scanning, finding review and tool limitations.

10. Fixing, testing and reporting (4 hours)

    Safe code changes, regression tests and evidence that vulnerabilities were corrected.

11. Python code-review project (6 hours)

    Review, correct, test and present the security of a realistic Python application.

Practical work and labs

• Manual review of purpose-built Python projects.
• Static-analysis and dependency-scanning exercises.
• False-positive identification and tool-result validation.
• Vulnerability correction and regression testing.
• Complete Python application security review and report.

How your work will be assessed

Security-review portfolio: 35%; code correction and testing practical: 25%; final Python code-review project: 40%.

What this course is for

Learn how organisations identify cyber risks, design controls, assess third parties and conduct security audits. You will prepare risk registers, examine evidence, test controls, document findings and present the results to management. This is a non-coding cybersecurity pathway, but it requires detailed analysis and professional judgement.

What you will be able to do

• Complete a scoped cyber-risk assessment.
• Prepare and maintain a practical risk-treatment plan.
• Design and map cybersecurity controls.
• Examine evidence and test whether controls are working.
• Plan a security audit and produce clear findings and management reports.

What the course covers

1. Governance and security frameworks (6 hours)

   Security objectives, accountability, policies and orientation to commonly used frameworks.

2. Assets, scope and risk assessment (6 hours)

   Asset inventories, boundaries, assessment criteria, likelihood, impact and clear risk statements.

3. Control design and mapping (6 hours)

   Control objectives, implementation methods, ownership and framework mapping.

4. Risk treatment and tracking (6 hours)

   Treatment plans, risk acceptance, exceptions, measurements and management reporting.

5. Third-party and supply-chain risk (6 hours)

   Supplier assessment, contracts, evidence, monitoring and concentration risks.

6. Privacy, legal and incident obligations (6 hours)

   Data handling, authorisation, incident response, notification and record-keeping.

7. Audit planning and programmes (6 hours)

   Audit objectives, scope, criteria, materiality, sampling and working documents.

8. Evidence, interviews and control testing (6 hours)

   Evidence reliability, control design, operating effectiveness, traceability and professional judgement.

9. Findings and management reporting (6 hours)

   Documenting the issue, requirement, cause, impact, severity, recommendation and management response.

10. Cyber-risk and audit project (6 hours)

    Complete a combined risk-and-audit case and present the findings in a closing meeting.

Practical work and labs

• Build a risk register and cybersecurity control library.
• Prepare a third-party security assessment and evidence-request list.
• Conduct simulated control-owner interviews.
• Review evidence and complete control-testing samples.
• Prepare an audit report and conduct a management closing meeting.

How your work will be assessed

Risk and control work products: 30%; security-audit practical: 25%; final report and presentation: 45%.