Security,
taken apart.
Most security training teaches you what to say about a mechanism. This one hands you the mechanism.
Two courses — the foundations first, then a small network you build, attack, and defend. Forty-one modules, and every one of them is something you type into, break, read, or rebuild. Start below by finding out whether you can already explain what the panel is doing.
Which of these four actually protects anything?
Below is one piece of text, rendered four ways. Three of them are encodings — costumes the same bytes wear, removable by anyone, no key involved. One is a hash — a one-way fingerprint that cannot be turned back. Confusing the two is how passwords end up "encrypted" in a database that anyone can read. Type something of your own, then press the two buttons and watch what each one does.
Your text — change it and every row below updates as you type
That is the whole distinction: encoding changes how bytes look, hashing destroys the ability to get them back. A password column full of Base64 is a password column full of plaintext with extra steps.
Course 1 · Module 2 →Six sentences that are almost right
Each of these is something competent people say every week. None is stupid; each one hides a mechanism that decides whether it holds. If the right-hand column surprises you anywhere, that module is worth your afternoon.
Six questions the courses expect you to answer cold
These are the real payoff of a module, phrased the way a colleague would ask at a whiteboard. Open one to see the answer and where it is taught.
Someone on the café Wi-Fi watches you load your bank over HTTPS. What can they still see?
The domain you asked for, the size and rhythm of every exchange, and how long you stayed. Encryption hides the contents — not the shape.
Course 1 · Module 7Two organizations leak the same password file. Why does one lose everything and the other almost nothing?
Salting and a deliberately slow hash. Identical passwords, wildly different cracking economics — measured in hours versus centuries.
Course 1 · Module 8The firewall rule blocks that port. The attacker reaches the share anyway. How?
Because nobody ever tested it from the segment that mattered. A control is not working merely because it has been configured.
Course 2 · Module 9Malware needs to survive a reboot. Where do you look first?
Run keys, scheduled tasks, services, startup folders — persistence has to live somewhere a machine reads on its way up, and that list is short.
Course 1 · Module 14Two findings on the report: CVSS 9.8 and CVSS 6.1. Which do you fix first?
Whichever one is actually reachable and actually sits under something you care about. Severity is a score; risk is a sentence about your network.
Course 1 · Module 12You have auth logs, DNS logs, and a firewall log. Where does the story start?
At the one event you can pin to a time, then you correlate outward from it. That single move is most of what incident investigation is.
Course 1 · Module 16What actually happens when you open a module
Not a video, not a chapter with a quiz stapled to the end. Every module runs the same four moves, and the first one exists to get you out of the module as fast as your knowledge allows.
It checks you first
Every module opens with a short competency check — including a "not sure" option, because guessing right only buys you an afternoon of material you needed. Score 80% and the module is marked complete and you move on.
One panel at a time
If you stay, the module walks: a section, the next section, then the labs — as a stepper with a map of where you are, not a wall of scroll. Jump anywhere in it, in any order.
You do the thing
Type into a simulated shell, click through a packet capture, crack synthetic hashes, build a firewall matrix, sort a blast radius, work an incident with a clock running. Twelve kinds of hands-on work; reading is the smaller half.
You prove it
"Mastered" is not for opening a lab — it needs the required ones passed. Along the way you're writing artifacts (command notes, a crypto reference, an IR workflow) you export and keep.
Don't know where you'd land? The placement check asks one question per module and stops the moment the material stops being familiar — then it marks everything you proved as complete. Take the placement check →
Foundations, then a network of your own to defend
Course 1 is about how the machinery works. Course 2 is about the machinery you are actually responsible for. They stand alone, but the second assumes the first.
How Cybersecurity Actually Works
Assets and risk, what computers actually store, packets and DNS, HTTPS and hashing, passwords and identity, Linux, reconnaissance, the major attack families, and how to read evidence. Each one is something you take apart rather than read about.
Securing & Attacking Small Networks
Stand up a range you can break safely, discover what is really on the network, segment it, harden wireless, endpoints, servers, NAS and containers, manage external exposure and vulnerabilities, then test your own defenses and run detection and response.
What this is, and what it isn't
A practitioner's bench, not a certificate
No proctor, no exam voucher, no career-ladder framing. The measure is whether you can do the thing afterward — on a real network, for a real organization.
Safe by construction
Simulated hosts, synthetic hashes, fictional companies, invented IP addresses. Nothing here asks you to touch a network you don't own, and the labs run entirely in your browser.
You leave with a reference
Twenty-eight artifacts you write as you go — command notes, a cryptography reference, an incident-response workflow — exportable as Markdown and genuinely reusable at work.
Nothing here asks you to start anything. Opens in whichever course you were last in.
Knowing a security fact is not the same as understanding the mechanism.
The principle the whole Academy runs on.