Cybersecurity, learned like a practitioner.
24 learning paths · 398 modules live · every lesson written by someone who has shipped the control or run the engagement. Free to start.
Expert · modules
Modules tagged Expert. Use the sidebar to narrow by track or topic.
Prompt Injection Defense Architecture: Beyond Input Filtering
Why input filtering cannot be the primary control Prompt injection is not a fixed signature; it is any natural-language text that redirects a model’s behaviour. The input space is unbounded and the adversary is adaptive: paraphrase, translate into another language, encode in base64, split across turns, hide in a modality the classifier does not read, […]
Agentic AI Red Teaming: A Methodology for Testing Autonomous Agents
The agentic attack surface is bigger than the prompt A tool-using agent has five components an attacker can reach, and each is a distinct test target: the system prompt and policy, the tool set it can invoke, its memory (short-term context and any persistent store), the planning loop that decides the next action, and the […]
MCP Server Security Architecture: Threat Model and Hardening
The MCP trust model, and why it breaks MCP standardises how an LLM client discovers and invokes external tools — functions exposed by an MCP server that read files, query databases, call APIs, or execute code. The protocol is deliberately thin: it defines transport, tool discovery, and invocation, and leaves authentication, authorisation, and output handling […]
EDR Evasion in 2026
The EDR detection stack User-mode hooks: EDR hooks key API calls (CreateRemoteThread, NtMapViewOfSection, etc.) to inspect arguments. Kernel-mode callbacks: PsSetCreateProcessNotifyRoutine, PsSetCreateThreadNotifyRoutine notify EDR of process / thread events. ETW (Event Tracing for Windows): provides telemetry stream EDR consumes. AMSI: Antimalware Scan Interface; PowerShell / WSH content sent to AV for inspection. File-based scanning: classic signature […]
Advanced JWT Attacks — Beyond Algorithm Confusion
Beyond alg=none and HS256 confusion Module SC-4 covered the classic algorithm-confusion attacks. This module covers the advanced variants. KID header injection # JWT header { "alg": "HS256", "typ": "JWT", "kid": "../../../etc/passwd" } # Application uses kid to look up the signing key. # If kid is unchecked, attacker can: # - Path-traverse to read arbitrary […]
Anti-Analysis Techniques and How to Defeat Them
Why this module exists. A sandbox report that shows “did nothing” or a debugger that crashes when you single-step are not bugs in your tooling — they are the malware authors’ deliberate design. Knowing the catalogue of anti-analysis techniques lets you recognise them and respond appropriately. The four classes of anti-analysis Anti-VM / sandbox detection. […]
DCShadow — Stealth Domain Replication Abuse
Why this module exists. DCShadow is the textbook example of “stealth persistence”. An attacker with sufficient privileges does not need to keep dropping files, scheduling tasks, or modifying registry keys — they push the change into the directory itself via the replication protocol, and the change is now part of the canonical AD state. Defender […]
SID History Abuse & Cross-Forest Trust Attacks
Why this module exists. Forest trusts were Microsoft’s promise that the forest boundary was a hard security boundary. SID Filtering — enabled by default on external trusts since Windows Server 2003 — was the control that made the promise real. But every year, a new variation on SID-History abuse shows it is not as hard […]
Building a Quantum Threat Model — STRIDE-Q, Data Classification, and the Indian Regulatory Frame
STRIDE-Q extends classical threat modeling with the time dimension (store-now-decrypt-later) and quantum-specific vectors. Framework for documenting quantum risk posture, audit-friendly artifact for board and Indian regulators. Module 20.
Quantum Reservoir Computing for SOC Anomaly Detection — Practical 2026 Pilots
Quantum Reservoir Computing (QRC) is the most-likely-to-ship quantum-ML technique for cybersecurity this decade. Hybrid classical-quantum anomaly detection, what works, what doesnt, deployment patterns. Module 19.
Practitioners who've
shipped the controls.
Every module is written by someone who has built the defence or run the engagement. No repackaged tutorials, no generic theory.
Why learn here
Practitioner-written.
Each lesson is authored by someone who has shipped the control or run the engagement in production.
Quiz after every module.
20+ questions with explanations. 70%+ to mark complete. Unlimited retries.
Progress tracked.
Completions, scores and streaks saved automatically. Resume exactly where you left off.
India-priced.
Start free. ₹499/mo for intermediate. ₹4,999/yr for advanced. No hidden fees, ever.