Defend your devices, your identity, your comms and your people.

1. 01 Home Network Defense Scheduled · 30 Sep

   Find out what is actually on your network, including the things you did not put there, and the account that really owns the router.

   • 8locate every device on your own network

   2.0 h load self-serve: reference book · $60
2. 02 Consumer Device Rescue and Defense Scheduled · 28 Oct

   Take a phone or a laptop that somebody else has had their hands on, and make it yours again — checklist first, guesswork never.

   • 7follow a device hardening checklist

   2.0 h load self-serve: reference book · $60
3. 03 Scam and Fraud Home Defense Scheduled · 25 Nov

   Read a pretext for what it is, and hold a callback rule that survives being rushed by somebody who sounds official.

   • 9operate a callback rule against incoming contact
   • 10classify an incoming contact as genuine or pretext

   2.0 h load self-serve: reference book · $60
4. 04 Digital Identity Defense Scheduled · 26 Aug

   Attack your own account recovery, find where it folds, and rebuild it so that losing the device is not the same as losing the account.

   • 9configure recovery that survives losing the device
   • 11falsify your own account recovery by attempting it
   • 10classify an incoming contact as genuine or pretext
   • 9operate a callback rule against incoming contact

   2.0 h load self-serve: reference book · $60
5. 05 Field Opsec Written · no date

   Write the threat model for your actual situation, drill the playbook it calls for, and reconcile all of it with what people will really do under pressure.

   • 9produce a threat model for your own situation
   • 8execute a security playbook in a drill
   • 10classify a situation into the playbook it calls for
   • 13reconcile security with what people will actually do

   7.0 h load 20 exercises self-serve: no app yet
6. 06 Blue Team Common Certification Written · no date

   The defender's professional track: enumerate where untrusted input enters a system and characterise the injection surface it opens.

   • 9produce a list of where untrusted input enters a system
   • 10characterise an applications injection surface

   8.0 h load 24 exercises self-serve: no app yet
7. 07 The Dark Arts (Red Team) Written · no date

   The other side of the same skill. Try to falsify an application's defences against a named attack class, because a defence nobody attacked is an assumption.

   • 11falsify an applications defences against a named attack class

   3.8 h load 3 exercises 1.0 h recorded self-serve: no app yet
8. 08 Agentic AI Security: Securing What You Build Written · no date

   You shipped something that acts on its own. Where does untrusted input reach it, and can you verify model-written code against its specification?

   • 10characterise an applications injection surface
   • 9produce a list of where untrusted input enters a system
   • 11verify model written code against its specification

   2.2 h load 1 exercises self-serve: reference
9. 09 AI-Assisted Attacks: What Actually Happened Written · no date

   How AI-assisted attacks actually unfolded, reconstructed. Cases, not predictions.

   • 10characterise how an ai assisted attack unfolded
   • 11falsify an applications defences against a named attack class
   • 7follow a device hardening checklist

   2.0 h load self-serve: reference
10. 10 AI Security: Governance, Standards and Safety Cases Written · no date

    Find the standard that governs what you are building, work out which framework applies where you are in the lifecycle, and justify a safety case you would sign.

    • 8locate the standard that governs a system you are building
    • 10classify which framework applies where you are in the lifecycle
    • 11justify a safety case for a system that acts without you

    2.0 h load self-serve: reference

Why identity defence comes after scams. Falsifying your own account recovery means pretexting yourself: ringing the help desk, answering the security questions, seeing how far a plausible stranger gets. You cannot run that honestly until you can read a pretext, which is what the class before it teaches. Take them the other way round and you will grade your own attack too kindly.

Why offence sits after the blue team track. Falsifying a defence against a named attack class is only meaningful once you can enumerate where untrusted input gets in. Step 07 is a test of step 06's answer.

Read the last one again. Reconcile security with what people will actually do. Every control on this path is negotiated against a household, a colleague or a volunteer who will route around it if it costs them too much. That is the top of the ladder, and it is why this is taught live rather than shipped as a video.