Learn cyber by doing the real work.

You learn how a computer really works underneath, files, processes, memory and user accounts, by driving a live machine yourself. This gives you the mental model every security task later depends on.

• OS internals
• File systems
• Process basics

You follow real traffic across a small network and see how data actually moves between machines, ports and services. By the end you can read an IP address, a port and a packet and say what is happening.

• TCP/IP basics
• Ports & services
• Packet reading

You work entirely from the Linux command line to move files, manage permissions and automate tasks with short Bash scripts. This is the daily working environment for almost every security tool you will meet.

• Linux CLI
• Bash scripting
• Permissions

You drive Windows the way a professional does, through PowerShell, the registry and the event logs rather than the desktop. You learn where Windows records what happened, which matters for both attack and defence.

• PowerShell
• Windows internals
• Event logs

You learn the core ideas of security, risk, controls and how real attacks unfold, using plain language and current examples. This gives you the vocabulary to talk about threats with any team.

• Security concepts
• Threat landscape
• Risk basics

You take apart how websites and applications work by inspecting requests and responses with Burp Suite. You see where common weaknesses live before you ever try to exploit or defend one.

• HTTP basics
• Web requests
• App structure

You watch the same event from both sides, the attacker's action and the defender's trace of it, on the live range. This shows you why offensive and defensive work are two views of one story.

• Attacker mindset
• Defender view
• Kill chain

You set up a clean working lab and complete a guided two-sided intrusion, recording every step as you go. The graded capstone scores how well you work and document, not what you memorised.

• Lab setup
• Note-taking
• Guided intrusion

You learn how a security operations centre is run day to day and how work flows from alert to action. You map that work to the frameworks a real team uses so you fit in from day one.

• SOC workflow
• MITRE ATT&CK
• Analyst tiers

You collect logs from Windows, Linux, network and cloud systems and learn what each one can and cannot tell you. This teaches you where to look before an alert ever fires.

• Log sources
• Telemetry
• Data mapping

You load real data into Splunk and the Elastic Stack and write your own searches to find suspicious activity. This is the core console you will live in as an analyst.

• Splunk search
• Elastic queries
• Dashboards

You inspect live network traffic with Zeek and Suricata to spot scanning, beacons and data leaving the estate. You learn to separate normal chatter from a real intrusion.

• Zeek
• Suricata
• Traffic analysis

You use an EDR and Sysmon data to watch what programs actually do on a machine and catch malicious behaviour. You investigate a compromised host from the endpoint outward.

• EDR
• Sysmon
• Endpoint triage

You write detections as code, Sigma and Elastic rules, then test and tune them against real attacks on the range. You learn to cut false alarms without missing the real thing.

• Sigma rules
• Detection tuning
• Rule testing

You take a queue of live alerts and decide quickly which are real, which are noise and which need to escalate. You build the evidence trail that supports each decision.

• Alert triage
• Investigation
• Escalation

You enrich alerts with threat intelligence in MISP and learn which indicators are worth acting on. This turns a raw alert into a picture of who might be attacking and why.

• Threat intel
• MISP
• IOC enrichment

You form a hypothesis about how an attacker might be hiding and go looking for them before any alert fires. Your hunts are mapped to MITRE ATT&CK so the results are repeatable.

• Threat hunting
• Hypotheses
• ATT&CK mapping

You run a live incident through its early stages and learn a clean handoff to the incident response team. You practise keeping calm records while an attack is still unfolding.

• Incident handling
• IR handoff
• Containment basics

You build simple automated playbooks so repetitive tasks handle themselves and analysts focus on real judgement. You see how automation speeds response without removing the human decision.

• SOAR
• Playbooks
• Automation

You write clear incident write-ups and track the metrics that show whether the SOC is working. The graded capstone scores a full monitor-triage-hunt run on the live range.

• Reporting
• SOC metrics
• Communication

You learn the full incident lifecycle from preparation to lessons learned, and the roles and decisions at each stage. This gives you the plan you follow when a real breach lands.

• IR lifecycle
• Governance
• Playbooks

You capture disks and data in a way that holds up later, with an unbroken chain of custody. You learn why how you collect evidence matters as much as what you find.

• Evidence capture
• Chain of custody
• Imaging

You dig into the Windows file system and registry to see what was installed, run and changed. You reconstruct attacker footprints from the traces Windows leaves behind.

• NTFS artifacts
• Registry analysis
• RegRipper

You pull execution evidence and event logs together into one timeline of what happened and when. You use Plaso to build a defensible sequence of the attack.

• Event logs
• Execution artifacts
• Timelining

You capture and analyse system memory with Volatility 3 and MemProcFS to find malware that never touched the disk. Memory often holds the clearest picture of a live intrusion.

• Volatility 3
• MemProcFS
• Memory analysis

You investigate compromised Linux hosts and cloud accounts, including the Microsoft 365 audit log. You learn where the evidence lives when the crime scene is a server or a tenant.

• Linux forensics
• Cloud logs
• M365 UAL

You reconstruct an attack from captured network traffic, tracing command channels and stolen data. You learn to prove what left the network even when the host is wiped.

• PCAP analysis
• C2 tracing
• Exfil detection

You safely detonate and observe a suspicious file to learn what it does without full reverse engineering. You extract the indicators the rest of the team needs to hunt with.

• Malware triage
• Behavioral analysis
• IOC extraction

You investigate a hijacked mailbox and a business email fraud, following logins, rules and message paths. You learn how these common, costly attacks actually play out.

• BEC investigation
• Mailbox forensics
• Header analysis

You tie the evidence to known attacker groups and techniques and judge how confident that link really is. You learn to attribute carefully without overreaching.

• Attribution
• TTP mapping
• Intel analysis

You cut off an active attacker, remove their access and restore the business safely without losing evidence. You practise the hard calls made under pressure during a real breach.

• Containment
• Eradication
• Recovery

You turn your investigation into a defensible report and a clear executive briefing. The graded capstone scores a full incident run end to end on genuinely compromised range systems.

• DFIR reporting
• Executive briefing
• Timeline defence