Source-reviewed practitioner knowledge base
A practitioner-oriented cybersecurity knowledge system connecting concepts, evidence, workflows, laboratories, and operational handoffs. Eleven connected disciplines take you from cybersecurity concepts to reviewable operational work.
Last reviewed
Explore 697 techniques through official groups, mitigations, detection strategies, and analytics, then follow governed inline routes into the most relevant practitioner modules across all eleven domains.
Use it for: behavior-led learning, CTI pivots, detection planning, adversary emulation scoping, mitigation review, and evidence-aware cross-domain study.
Explore the matrix →Each guide has one canonical purpose and links to the neighboring disciplines that consume or produce its evidence. Every page includes a table of contents, practical workflows, case studies or worked examples, labs, source links, AI-use boundaries, and acceptance criteria.
Turning raw data about adversaries into decisions: the intelligence cycle, ATT&CK, the Diamond Model, actor tracking, and how CTI feeds detection engineering.
10 modules ~55 min Foundation to practitioner Version 1.0 Reviewed 27 Jul 2026
For: Intelligence analysts, threat hunters, and detection engineers
Adversary emulation, penetration testing, and exploit tradecraft: recon, initial access, privilege escalation, lateral movement, and reporting.
14 modules ~112 min Practitioner to advanced Version 1.0 Reviewed 27 Jul 2026
For: Authorised security testers, red teams, and purple teams
SOC operations, detection engineering, threat hunting, and incident handling: the discipline of finding and stopping what red team simulates.
14 modules ~55 min Foundation to practitioner Version 1.0 Reviewed 27 Jul 2026
For: SOC analysts, detection engineers, and threat hunters
Finding and understanding software flaws: fuzzing, memory corruption classes, static/dynamic analysis, and responsible disclosure.
14 modules ~44 min Practitioner to advanced Version 1.0 Reviewed 27 Jul 2026
For: Security researchers, exploit developers, and product-security teams
Static and dynamic triage, unpacking, disassembly, and behavioral analysis of malicious code, from first-look triage to full reverse engineering.
14 modules ~29 min Practitioner to advanced Version 1.0 Reviewed 27 Jul 2026
For: Malware analysts, reverse engineers, and incident responders
Secure design, threat modeling, identity, authorization, API and browser controls, supply-chain assurance, AI-system boundaries, testing, release evidence, and remediation.
14 modules ~27 min Foundation to practitioner Version 1.0 Reviewed 27 Jul 2026
For: Application-security engineers, developers, and product teams
Incident readiness, defensible evidence handling, endpoint, disk, memory, network, cloud, identity and malware forensics, timeline reconstruction, containment, recovery, reporting, labs, and controlled AI assistance.
14 modules ~32 min Practitioner to advanced Version 1.0 Reviewed 27 Jul 2026 Baseline: NIST SP 800-61 Rev. 3
For: Incident responders, forensic analysts, and SOC leads
Shared responsibility, landing zones, human and workload IAM, network and data protection, IaC, containers, Kubernetes, multi-cloud detection and response, SaaS, suppliers, and AI workloads.
14 modules ~35 min Practitioner Version 1.0 Reviewed 27 Jul 2026
For: Cloud-security engineers, architects, and incident responders
Cyber governance, scenario-based risk, frameworks, policy and control design, evidence and audit, legal and contractual obligations, suppliers, privacy, resilience, metrics, product assurance, and AI governance.
14 modules ~36 min Foundation to practitioner Version 1.0 Reviewed 27 Jul 2026
For: Security leaders, risk owners, auditors, and control operators
Authorized and ethical collection, search and archives, DNS/RDAP/certificates, internet exposure, applications, organizations, public code, media verification, threat infrastructure, automation, AI assistance, evidence, and reporting.
14 modules ~42 min Foundation to practitioner Version 1.0 Reviewed 27 Jul 2026
For: OSINT investigators, intelligence analysts, and security researchers
Securing the whole AI system: threat modeling, data and retrieval integrity, model supply chain, prompt injection, agents and MCP, adversarial testing, monitoring, incident response, and governance.
14 modules ~20 min Practitioner to advanced Version 1.0 Reviewed 27 Jul 2026 Baseline: NIST AI RMF, OWASP GenAI Security Project, MITRE ATLAS
For: AI engineers, application-security teams, security architects, red teams, defenders, and risk owners
Cybersecurity work crosses team boundaries. These routes show which guide produces the evidence, decision, or control consumed by the next one.
CTI defines the question, OSINT collects attributable public evidence, and the Blue Team guide turns supported behavior into telemetry, hunting, and validation.
OSINT identifies candidate external assets, Vulnerability Research establishes root cause and affected versions, and Application Security verifies the remediation and regression controls.
Red Team defines an authorized behavior and proof, Blue Team validates visibility, and DFIR with Malware Analysis preserves and explains the resulting evidence.
Cloud Security assigns shared responsibilities, Secure Code integrates product and pipeline controls, and GRC connects objectives, risk, control ownership, testing, and evidence.
These routes connect selected chapters across multiple guides. They are practical starting points, not mandatory curricula.
Build shared vocabulary, understand defensive operations, and finish with evidence and governance fundamentals.
Move from triage and evidence preservation into endpoint analysis and source-backed intelligence pivots.
Translate behavioral intelligence into telemetry requirements, detection logic, controlled testing, and reviewable evidence.
Establish authorization and scope, reproduce safely, evaluate exploitability, and prepare remediation evidence.
Define rules of engagement, select evidence-backed behaviors, execute controlled validation, and report defensibly.
Connect governance and scenario-based risk to control ownership, evidence, metrics, resilience, and review.
Set intelligence requirements, collect public evidence, assess sources, and produce behavior-led analytical outputs.
Start with responsibility and identity boundaries, then assess posture, telemetry, response, and assurance evidence.
Model the AI system and trust boundaries, test model and agent abuse paths, then establish monitoring, response, and governance evidence.
This map is generated from cross-domain links in the field guides. Select an icon to open that domain; select a connection to follow one of the underlying routes.
Move from the field guides into published research, browser-based ATT&CK exploration, hands-on labs, and the self-hosted AdversaryGraph platform.
Product overview, deployment routes, documentation, and validation evidence.
Browse ATT&CK groups, techniques, comparisons, coverage leads, and Navigator layers.
Actor profiles, campaigns, detection research, and source-linked analysis.
A statistical CTI study of 103 core publications, with an interactive dashboard and 108 indexed references.
Controlled lab environments, validation walkthroughs, and reproducible evidence.
Local, searchable versions of published long-form research and technical articles.
Source-backed external contributions, references, and acceptance evidence.
Search 165 assessed standards, research portals, tools, datasets, and learning resources by category, tag, audience, access, and quality.
Search the deduplicated external sources cited across maintained 1200km articles, guides, research, documentation, and labs.
Source-linked terminology with direct routes back to the guide context.
External sources grouped by class and the guides where each is used.
Source selection, review, correction, versioning, and AI-assistance boundaries.
Use study aids, lab notes, checklists, and concise infographic-supported explanations, then continue into the source-backed field guides, course learning records, research, and labs.
A single indexed collection of visual explainers, lab guides, study aids, and analyst references with topic, provenance, course, evidence, and lifecycle tags.