Catalog
Rooms
82 rooms across four prerequisite paths and four GRC engineering tracks.
Computer Architecture
Understand boot integrity, memory hierarchy, asset evidence and test the resulting controls with reproducible evidence.
Operating Systems
Understand process isolation, service privilege, kernel boundaries and test the resulting controls with reproducible evidence.
Filesystems and Permissions
Understand posix modes, acl evaluation, special bits and test the resulting controls with reproducible evidence.
Command Line and Safe Automation
Understand posix shell, exit handling, evidence collection and test the resulting controls with reproducible evidence.
Identity and Authentication
Understand mfa factors, federation, identity lifecycle and test the resulting controls with reproducible evidence.
Logging and Time
Understand event correlation, clock integrity, retention and test the resulting controls with reproducible evidence.
Hardening and Patching
Understand baseline drift, patch lifecycle, risk prioritization and test the resulting controls with reproducible evidence.
Backup and Recovery
Understand rpo and rto, raid limits, restore assurance and test the resulting controls with reproducible evidence.
IT Fundamentals Capstone
Understand estate audit, control testing, evidence pack and test the resulting controls with reproducible evidence.
Network Models and Encapsulation
Trace a request through two network models, calculate payload budgets, and choose evidence that actually supports a control claim.
Ethernet, Switching and VLANs
Trace Ethernet forwarding, diagnose ARP deception and loops, and distinguish VLAN separation from enforceable access policy.
IPv4 Addressing and CIDR
Decode IPv4 bits, calculate CIDR boundaries, and distinguish private addressing from actual isolation.
Subnetting in Depth
Calculate IPv4 boundaries, allocate unequal networks, and challenge unsafe route summaries with reproducible evidence.
IPv6 Essentials
Read IPv6 addresses, distinguish scope and configuration mechanisms, and close dual-stack control gaps.
Routing and NAT
Trace forwarding decisions, distinguish routing convergence from loop protection, and separate address translation from access control.
Transport and Core Services
Reconstruct transport sessions, address allocation and name resolution without overstating what network evidence proves.
Secure Protocols and PKI
Trace authenticated encryption from TLS negotiation to certificate lifecycle controls and VPN boundaries.
Network Security Architecture
Trace permitted flows, contain lateral movement, and prove firewall controls with configuration and operational evidence.
Networking Fundamentals Capstone
Allocate a verified VLSM plan, enforce zone boundaries, and test an ordered firewall policy against permitted flows.
Cloud Concepts and Shared Responsibility
Classify cloud services, locate the operational boundary, and prove the controls that remain with the customer.
Compute Building Blocks
Locate compute isolation boundaries and preserve deployment evidence after workloads disappear.
Storage Building Blocks
Choose storage interfaces and distinguish surviving data, reachable data, and recoverable data.
Cloud Networking
Trace cloud packet paths and turn subnet, routing, and filtering decisions into testable isolation controls.
Cloud Identity and Access
Trace principals, policy decisions and temporary sessions; constrain workloads and protect emergency access with testable controls.
Cloud Data Protection
Trace encrypted data and key dependencies, then test classification, location, and destruction claims against evidence.
Infrastructure as Code and Immutability
Turn infrastructure changes into reviewed, reproducible deployments without mistaking state, plans, or images for security guarantees.
Cloud Logging, Monitoring and Posture
Distinguish administrative changes from data access, protect central audit evidence, and turn configuration findings into verified remediation.
Cloud Fundamentals Capstone
Reconstruct cloud attack paths, rank account control gaps, and deliver a testable remediation plan.
How Applications Work
Trace a browser request, distinguish method guarantees, and test session and access-control claims against HTTP evidence.
APIs and Data Formats
Read API contracts, preserve complete evidence collections, and distinguish signed credentials from secret data.
Databases for Applications
Trace application data through keys, queries and transactions, then defend database access, recovery and audit evidence.
Authentication and Authorisation in Apps
Trace identity from password verification to delegated tokens, then enforce access on every object request.
The Secure SDLC
Turn application risks into testable requirements, threat models, complementary tests and evidence-backed release decisions.
The OWASP Top 10 in Depth
Trace all ten 2021 application risk categories to their mechanisms, preventive controls, and defensible closure evidence.
Software Supply Chain
Trace dependency graphs, verify release identity and build provenance, and turn vulnerability findings into time-bound decisions.
Release and Runtime
Promote tested releases through isolated environments, enforce independent approval, and operate with reversible changes, protected secrets and actionable telemetry.
Application Fundamentals Capstone
Convert penetration-test evidence into business-ranked risks, testable controls, accountable deadlines and verified remediation.
Risk, Control, Compliance
Three words practitioners use interchangeably and shouldn't. Learn to separate the threat, the safeguard, and the obligation.
Frameworks Tour: SOC 2, ISO 27001, NIST
Map the same underlying safeguard across SOC 2 Trust Services Criteria, ISO 27001 Annex A, NIST CSF and 800-53.
Control Design & Testing
Design vs. operating effectiveness, sampling, populations, and how to write a control that can actually be tested by a machine.
The Audit Lifecycle
Scoping, walkthroughs, evidence requests, exceptions and the report. Triage a live PBC list in the scenario sim.
Evidence 101
What makes evidence sufficient, appropriate and reproducible, and why a screenshot is the weakest artifact you can hand over.
Policy, Standard, Procedure
The document hierarchy that governs everything you will later encode, and how to keep it from rotting.
Cybersecurity Essentials
Distinguish security objectives, attack mechanisms, and layered controls, then evaluate evidence rather than reassuring labels.
The Language of Security and GRC
Separate risk, controls, exceptions, and assurance claims using evidence rather than confident labels.
Governance and Accountability
Translate oversight into clear decision rights, risk boundaries, independent assurance, and meaningful board reporting.
Risk Assessment in Practice
Build evidence-based risk scenarios, score exposure, and assign accountable treatment and review.
Laws, Regulations and Obligations
Determine which obligations apply, distinguish legal duties from promises, and trace requirements to controls and evidence.
Security Operations Basics for GRC
Trace access, changes, vulnerabilities, incidents, and monitoring from operational decisions to defensible audit evidence.
Resilience and Continuity
Translate business impact into recovery priorities, resilient backups, rehearsed continuity plans, and defensible evidence.
People and Third Parties
Measure safer behavior, time workforce access changes, and manage supplier risk across the relationship lifecycle.
Foundations Capstone
Pull the whole fundamentals track together on one startup: risks, obligations and recovery targets drive a SOC 2 scope, a control set two people can run, and an evidence plan.
What Is GRC Engineering?
The failure mode of traditional GRC, what changes when you treat compliance as a software problem, and the skills that define a GRC engineer.
The Spreadsheet Failure Mode
Diagnose a real compliance program drowning in manual work and identify the three automations that save the most work.
Your First Automated Control
Take one access-review control from Word document to a scheduled check that produces its own evidence.
Git for GRC Artifacts
Version control, review and approval workflows applied to policies and control definitions.
Controls as Data
Model a control catalog in YAML/JSON and OSCAL so it can be queried, diffed and tested.
Policy as Code with OPA/Rego
Write Rego policies that evaluate cloud configuration against your control catalog.
Control Checks in CI/CD
Fail a pipeline on a control violation, and design the exception path that keeps engineers moving.
OSCAL Profiles & Baselines
Tailor a catalog into a profile without destroying it, and keep the SSP, assessment results and POA&M pointing at the same control ids.
Automating GRC with APIs
Script against Okta, Jira and cloud APIs for evidence: authentication, pagination, throttling and proving the population was complete.
Testing Compliance Code
Write tests that can actually fail: negative cases, missing-field cases and assertions on the decision rather than on the run.
Build an Evidence Pipeline, Step by Step
Build a working GRC evidence pipeline end to end: collectors for identity, cloud, ticketing, CI and HR sources, a normalised evidence record, policy code you write yourself, custody, scheduling and reporting.
Automation Capstone
Ship one control end to end as code: repository layout, tests that can fail, a gate that cannot be skipped quietly, and evidence emitted by the pipeline itself.
Evidence Pipelines
Collect, normalize, timestamp and store control evidence automatically.
Continuous Control Monitoring
Move from point-in-time testing to always-on monitoring with alerting and drift detection.
SQL for Compliance Data
Answer auditor questions with queries: coverage, exceptions, aging and control health metrics.
Evidence Integrity & Chain of Custody
Hashing, canonical payloads, immutable storage and the run metadata that lets an auditor re-derive an artefact you collected nine months ago.
Control Health Metrics & Scorecards
Coverage, freshness, pass rate and exception aging, and the denominators that turn a reassuring dashboard into a lie.
Drift Detection & Alert Design
Declared state versus observed state, detection latency, suppression windows, and alerts a human can actually act on at 3am.
Vendor Risk Automation
Tier vendors by the data they actually touch, turn questionnaires into scored data, and ingest vendor evidence on a schedule instead of chasing it by email.
Fourth-Party & Supply-Chain Visibility
Your vendors have vendors. Map subprocessors, convert contract clauses into testable controls, and monitor the chain you cannot see.
Data & Evidence Capstone
Design the evidence architecture for one control family end to end: collection, integrity, monitoring, metrics and the auditor's read view.
LLMs for Policy & Gap Analysis
Where LLMs genuinely help in GRC, where they hallucinate, and how to keep a human in the loop.
Governing AI Systems
NIST AI RMF and EU AI Act obligations translated into controls you can actually operate.
Agentic Evidence Workflows
Let an agent plan and collect, but never let it decide. Tool scoping, human gates, and provenance for machine-gathered evidence.
AI Risk Management with NIST AI RMF
Govern, Map, Measure, Manage turned into an operable control set with owners, evidence and metrics rather than a maturity poster.
EU AI Act Obligations as Controls
Classify a system, find the obligations that attach to that class, and turn each one into a control with an owner and an artefact.
Scaling a GRC Engineering Function
Team shape, intake, platform versus project work, and the metrics that tell you whether the function is compounding or just busy.
Incident Response as Code
Runbooks in version control, severity matrices that decide who gets paged, and postmortems that commit their own follow-ups.
Tabletop to Pipeline
An exercise finding without an owner never ships. Turn tabletop outcomes into tracked work that lands as controls, alerts and runbook edits.
Capstone: Automate a SOC 2 Control Family
End to end: control definitions, policy code, evidence pipeline, monitoring and auditor-ready reporting.