The path
Learning tracks
Work them in order. Each track ends in a capstone and promotes you to the next rank.
Prerequisites
New to tech? Start here
Recommended for learners new to tech. Four vendor-neutral paths take you to an intermediate level in IT, networking, cloud and applications, and each one shows how the tech turns into controls and evidence.
IT Fundamentals
Trace the machine, test the control, preserve the evidence.
- ›Explain boot, process and filesystem trust boundaries
- ›Automate reliable evidence collection with a POSIX shell
- ›Evaluate identity, logging and patch controls against observed state
Networking Fundamentals
From packets to subnets to segmentation: read a network the way an attacker and an auditor do.
- ›Subnet any IPv4 block by hand, including VLSM and summarisation
- ›Explain switching, routing, NAT, DNS and TLS at the packet level
- ›Design segmentation and review a firewall rule set against policy
Cloud Fundamentals
The building blocks of any cloud, without the brand names.
- ›Apply the shared responsibility model to IaaS, PaaS and SaaS
- ›Explain compute, storage and network building blocks and their failure modes
- ›Read identity policies and key hierarchies like an assessor
Application Fundamentals
How software is built, shipped and broken, and where the controls belong.
- ›Explain HTTP, APIs, sessions and tokens precisely
- ›Threat model with STRIDE and map OWASP Top 10 findings to controls
- ›Assess dependency, SBOM and provenance practice
GRC fundamentals
Learn GRC before you engineer it
Cybersecurity basics, the vocabulary, governance, risk, laws and obligations, frameworks, operations, resilience and audit. Finish this before the engineering tracks.
GRC engineering
The core path
Automation & Code
Turn policies and controls into version-controlled, testable code.
- ›Model controls as structured data (YAML/JSON/OSCAL)
- ›Write and test OPA/Rego policies against real inputs
- ›Fail a build on a control violation inside CI/CD
Data & Evidence
Build evidence pipelines and continuous control monitoring that auditors trust.
- ›Design an automated evidence collection pipeline
- ›Stand up continuous control monitoring with alerting
- ›Query compliance data with SQL and publish control health metrics
AI & Advanced
Govern AI, automate third-party risk, and scale a GRC engineering function.
- ›Use LLMs safely for policy drafting and gap analysis
- ›Design agentic evidence-gathering workflows with human review gates
- ›Govern AI systems against NIST AI RMF and the EU AI Act