Cybersecurity, learned like a practitioner.
24 learning paths · 398 modules live · every lesson written by someone who has shipped the control or run the engagement. Free to start.
Latest modules
Most recent practitioner playbooks across every track. Filter by topic, level, or search in the sidebar.
Every Protocol Has Trust Assumptions
Every protocol — DHCP, ARP, DNS, BGP, NTP, IP, TCP — was designed for an environment with assumed cooperation. Attackers violate those assumptions. DHCP: trust whoever responds first. ARP: trust whoever claims an IP. DNS: trust whoever answers a query. BGP: trust whoever announces a route. Each assumption is a poisoning attack vector when the […]
Layer 3 vs Layer 7 Mindsets
Network team thinks in subnets, ACLs, firewalls — Layer 3. App team thinks in HTTP semantics, auth, business logic — Layer 7. Attackers exploit the gap. Network ACL allows port 443 from 10.0.0.0/8 to web tier. Web tier app trusts client IP from header. Internal subnet of compromised laptop hits web tier with forged X-Forwarded-For. […]
NAT Doesn’t Mean Safe
NAT was an addressing patch. It happens to drop unsolicited inbound packets. Many treat it as a firewall. It isn’t. NAT doesn’t inspect outbound. Compromised host phones home freely. NAT doesn’t protect peer-to-peer; UPnP / hole-punching exists. NAT doesn’t protect against same-segment attacks. The mindset: every “NAT protects us” claim should be replaced with “outbound […]
Cleartext Is Forever
An adversary records your encrypted traffic today. Stores it. Years later, quantum computer breaks the key exchange. Decrypts. This isn’t hypothetical. Nation-state adversaries have been recording for years. Long-lifespan secrets — IP, state secrets, banking credentials — are exposed even when transmitted over modern TLS today. The mindset: data with multi-decade sensitivity needs post-quantum protection […]
Browser Origin Boundaries
Same-Origin Policy is the bedrock of web security. But “origin” has nuances: scheme matters, port matters, path doesn’t. Subdomains aren’t same-origin (they’re same-site, different concept). CORS is opt-in cross-origin. It carries credentials only with explicit allow. Access-Control-Allow-Origin: * with credentials is invalid. Many implementations get this wrong. postMessage crosses origins by design. Receiver must validate […]
AI Security Evaluations
How do you know if your AI is safe enough? Structured evaluation. Eval categories Adversarial robustness — does it resist attacks? Toxicity — does it produce harmful content? Bias — does it discriminate? Privacy — does it leak training data? Reliability — does it hallucinate? Capability — what can the model do that’s sensitive? Tools […]
AI Governance Frameworks
AI governance is the regulatory frame around technical safety. Major frameworks NIST AI RMF — voluntary US framework; maps risks across lifecycle EU AI Act — risk-tiered (banned, high-risk, limited-risk, minimal); 2024 effective UK pro-innovation — sector-by-sector approach China — algorithm filing, content moderation requirements India — DPDP applies to AI processing PII; specific AI […]
Production AI Deployment Patterns
Production AI is engineering. Choices have security and cost implications. Hosting choices Pattern Privacy Cost Quality OpenAI / Anthropic / Google managed Lowest (data leaves) Pay-per-token; scales Highest Azure OpenAI Moderate (Microsoft tenant; opt-out training) Same as OpenAI Same AWS Bedrock Moderate (your AWS account) Higher Same Self-hosted (Llama, Qwen, Mistral) Highest GPU-rental; ops effort […]
RAG Security
RAG combines vector search + LLM. Security model is hybrid. Threats specific to RAG Vector store data exposure — anyone with access reads embeddings (and retrieves originals) Indirect prompt injection via retrieved docs — adversary plants malicious doc; RAG retrieves and follows instructions IAM bypass via vector similarity — user query semantically matches private docs […]
AI Agent Security
Agents are LLMs that call tools. Permissions matter exponentially. The threat model An agent compromised via prompt injection in any input source (user query, retrieved doc, tool output) executes attacker’s instructions with the agent’s permissions. Defences Least privilege per agent — only the minimum tools needed for its purpose Read-only by default — write actions […]
Practitioners who've
shipped the controls.
Every module is written by someone who has built the defence or run the engagement. No repackaged tutorials, no generic theory.
Why learn here
Practitioner-written.
Each lesson is authored by someone who has shipped the control or run the engagement in production.
Quiz after every module.
20+ questions with explanations. 70%+ to mark complete. Unlimited retries.
Progress tracked.
Completions, scores and streaks saved automatically. Resume exactly where you left off.
India-priced.
Start free. ₹499/mo for intermediate. ₹4,999/yr for advanced. No hidden fees, ever.