Cybersecurity, learned like a practitioner.
24 learning paths · 398 modules live · every lesson written by someone who has shipped the control or run the engagement. Free to start.
Latest modules
Most recent practitioner playbooks across every track. Filter by topic, level, or search in the sidebar.
GRC Metrics for Executives
Operational SOC metrics (Module 13 Blue Team) inform analysts. Executive metrics inform decision-making. Executive metrics Risk trend — total risk score, top-5 risks, treatment status Control coverage — % of controls implemented + tested Audit results — findings count by severity, time-to-remediation Vendor risk — % of tier-1 vendors with current SOC 2/ISO Incident metrics […]
Reporting Security to the Board
Board members aren’t security experts. They are fiduciaries who need to discharge oversight responsibility. What boards want to know What’s our risk posture? How does it compare to peers? What’s our biggest exposure? Are we investing the right amount? What incidents have happened? What’s coming up regulatorily? The 15-minute briefing Heat-map of top risks (1 […]
Regulatory Tracking Process
Indian + international regulations evolve constantly. Missing a notification = compliance failure. Establish process for tracking. Sources to monitor MeitY — DPDP, IT Act amendments RBI — for financial services SEBI — for capital markets IRDAI — for insurance CERT-In — directions, advisories NCIIPC — for critical infrastructure TRAI / DoT — telecom International — […]
Symmetric Cryptography in Practice
Symmetric crypto is fast, ubiquitous, and routinely misused. Modes that matter AES-256-GCM — authenticated encryption with associated data; default choice ChaCha20-Poly1305 — alternative AEAD; faster on devices without AES-NI AES-CBC — legacy; no built-in auth (vulnerable to padding-oracle if MAC absent) AES-CTR — fast; needs separate MAC; nonce reuse catastrophic AES-ECB — never use; reveals […]
Asymmetric Cryptography
Asymmetric (public-key) crypto for digital signatures and key exchange. The choices RSA-2048 — minimum acceptable; phasing out for 4096 in regulated RSA-4096 — slow; use only when compatibility requires ECDSA P-256 — fast; smaller keys (256-bit ~ RSA-3072 strength) Ed25519 — modern; fast; safer-by-default than ECDSA X25519 — for ECDH key agreement When to use […]
PKI Fundamentals
PKI = the trust infrastructure for asymmetric crypto. Most engineers use it; few understand it. The components Certificate Authority (CA) — issues certs; private key very protected Certificate Signing Request (CSR) — what you submit to a CA X.509 certificate — public key + identity, signed by CA Certificate chain — your cert → intermediate […]
TLS Cipher Suite Selection
TLS 1.3 covered in Networking Module 10. This is the operational hardening view. The 2026 baseline TLS 1.2 + TLS 1.3 only Disable TLS 1.0, 1.1 entirely Forward-secret ciphers only (ECDHE-*) AEAD ciphers (GCM or ChaCha20-Poly1305) Strong elliptic curves (X25519, P-256, P-384) HSTS enabled Sample nginx config ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305; ssl_prefer_server_ciphers off; ssl_ecdh_curve […]
Key Management at Scale
Crypto without good key management is decoration. Every breach has a “where did the keys live” question. The hierarchy of safety HSM (FIPS 140-3 Level 2-4) — most secure; keys never leave hardware Cloud KMS — managed; keys logically scoped; audit trails HashiCorp Vault — flexible; software-based; supports HSM backend Application-level keystore — least secure […]
Purdue Model & ICS Architecture
Purdue Model = standard reference architecture for ICS networks. Six levels of segmentation. Levels Level 0 — physical process (sensors, actuators) Level 1 — basic control (PLCs, RTUs) Level 2 — area supervision (HMIs, historians) Level 3 — site operations (MES, plant historians) Level 3.5 — DMZ between OT and IT Level 4-5 — corporate […]
IoT Penetration Testing Methodology
IoT pentesting spans more layers than typical web. Methodology to cover all of them. Phases Reconnaissance — manuals, FCC IDs, FCC database, related devices Hardware — open device, identify chips, find debug ports (UART, JTAG) Firmware extraction — flash dump, firmware update interception, OTA capture Firmware analysis — Module 9 above Wireless — Wi-Fi, BLE, […]
Practitioners who've
shipped the controls.
Every module is written by someone who has built the defence or run the engagement. No repackaged tutorials, no generic theory.
Why learn here
Practitioner-written.
Each lesson is authored by someone who has shipped the control or run the engagement in production.
Quiz after every module.
20+ questions with explanations. 70%+ to mark complete. Unlimited retries.
Progress tracked.
Completions, scores and streaks saved automatically. Resume exactly where you left off.
India-priced.
Start free. ₹499/mo for intermediate. ₹4,999/yr for advanced. No hidden fees, ever.