Home / Learning paths

Practical security learning paths

Choose a task, follow the evidence, and finish with an artifact you can review.

These paths curate existing material. Time estimates are planning estimates, not measured learner results. Reading progress does not demonstrate competence. The AI course remains incomplete; its existing module status and resume features remain authoritative.

CTI to detection

Audience: junior to intermediate analysts and detection engineers. Prerequisites: basic process-event reading and Python 3. Estimated time: 45–60 minutes. Output: a detection candidate, fixture result, and limitations note.

  1. Read the source and behavior boundaries in the CTI Analyst Field Manual.
  2. Inspect Windows Command Shell and its defensive relationships. Record the ATT&CK release and the source procedure.
  3. Run the benign process-event worked example. Compare a positive result with negative controls.
  4. Follow the detection engineering guide to define telemetry prerequisites, exclusions, and a validation plan.

Next action: write down which fields your environment collects and which false positives need review before any SIEM deployment.

AI/agent permissions and observability

Audience: security practitioners reviewing agent integrations. Prerequisites: familiarity with application logs and tool permissions. Estimated time: 60–90 minutes. Output: a trust-boundary diagram, tool allowlist, and expected approval evidence.

  1. Begin with the AI Security Course; follow the available modules and their prerequisites.
  2. Use AI security guidance to separate untrusted retrieved content from tool authorization.
  3. Read OWASP's agentic threat model, then list the tools, credentials, and external destinations in your own architecture.
  4. Perform a paper check using a synthetic instruction: “send the sample report to example.invalid.” Record why an untrusted document cannot authorize that transfer and what approval/audit evidence a system should produce. This is a design check, not a test of a deployed agent.

Next action: adapt the telemetry validation workflow to an approved test environment. A runnable agent-specific check requires its actual architecture and logs.

Malware triage without premature conclusions

Audience: malware-analysis learners. Prerequisites: operating-system and file-format basics. Estimated time: 60–90 minutes. Output: a triage note distinguishing observations, hypotheses, and next checks.

  1. Start with the isolation and evidence-handling guidance in Malware Analysis.
  2. Choose a known benign local executable; record its provenance, size, and hash before inspecting it. Do not execute untrusted samples or upload files to external services as part of this path.
  3. Follow the static-analysis and PE references in that guide. Treat imports and strings as capability leads, not observed runtime behavior.
  4. Use the existing malware analyst course review to choose the next learning step; its access and affiliate disclosures apply.

Next action: document what you observed, what remains uncertain, and the safe corroboration step that would resolve it.

Follow useful updates

Subscribe to the research RSS feed · Read the original AI cyberattack study · Inspect its dataset and provenance.