Where Do You Want to Be in Six Months?
Each path ends with a specific operational capability you can demonstrate. Not "awareness of" — the ability to design, build, investigate, or detect in production. Pick the outcome you need, start with the free modules, and work through the sequence.
Two tiers. Every path starts with free modules.
Premium $179/year · Specialist $289/year
Premium covers most courses. Specialist adds M365 Security Architecture, Purple Teaming, Memory Forensics, and Windows Forensics.
See Pricing & Compare Tiers →MDE architecture, ASR rules, AV tuning, EDR, custom detections, forensic readiness, cross-platform.
Conditional access, phishing-resistant MFA, token protection, PIM, workload identity, identity detection.
Threat modeling, 71 KQL rules across 6 attack chains, testing, tuning, detection-as-code.
Sentinel playbooks, auto-containment, evidence collection, cross-environment orchestration.
Every operator, join type, time-series pattern, and production technique — the query language that powers detection.
Threat modeling, rule development, testing, tuning, detection-as-code, and coverage reporting.
Hypothesis-driven hunting — ten complete campaigns across authentication, OAuth, privilege escalation, and more.
Automate what you've built — playbooks triggered by detection rules, auto-containment with confidence thresholds.
The first 60 minutes — scope, preserve, and contain across cloud, Windows, and Linux.
Windows and M365 forensics — KAPE, EZ Tools, Volatility 3, KQL. Ransomware, BEC, insider threat, APT.
Linux forensics — filesystem, memory, log analysis, container investigation, persistence, cloud VM incidents.
Reconstruct attack chains from the wire — Zeek, Suricata, PCAP, DNS, TLS, NetFlow.
Complete M365 security course — MFA, conditional access, email protection, device compliance, monitoring, governance. Entirely free.
The query language that powers every Microsoft security tool. Start with the free modules, then continue.
Your first engineering course — build the endpoint security stack from OS internals through detection and response.
Read a free module from the path closest to your goal.
Every paid course opens with free foundation modules — no account, no email, no gate. See the depth, run the exercises, and decide if this is the path that gets you where you need to be.
Written by practicing security engineers · 34 courses · New modules added monthly · Cancel anytime