✳ The learning field guide
Learn the shared principles, then explore how the decisions change in your industry. Build your understanding with concrete examples and practice under realistic constraints.
ONE FOUNDATION. DIFFERENT STAKES.
Choose an industry, then work through its decisions.
START WITH THE SHARED SKILLS
New to security? Start here. Industry paths link back to these lessons whenever you need a concept explained.
8 LESSONS / beginner
Eight lessons that teach a beginner to name assets and losses, judge risk under uncertainty, trace a request, handle identity, write scoped policies, plan recovery, read evidence, and connect those skills to frameworks and product categories.
71 min reading
Explore this path ↗4 LESSONS / intermediate
Four lessons that take the foundations path into evidence-to-decision work: identity-alert triage, vulnerability prioritization, investigation with verified recovery, and an honest introduction to an Agentic SOC and IRIS. Each lesson lists the foundation skills it depends on.
38 min reading
Explore this path ↗INDUSTRY FIELD GUIDE / 01
Practice verifying payment changes and restoring trustworthy financial services.
3 applied lessons · 21 min · synthetic decision checks
Explore finance ↗THE DECISIONS YOU’LL PRACTICE
These synthetic U.S. examples illustrate financial controls; regulatory coverage depends on the institution, regulator, activity, and jurisdiction.
INDUSTRY FIELD GUIDE / 02
Practice operator-led access, trustworthy telemetry, and controlled recovery.
3 applied lessons · 21 min · synthetic decision checks
Explore utilities ↗THE DECISIONS YOU’LL PRACTICE
These synthetic U.S. utility exercises use general OT guidance; electricity and water subsectors have different legal requirements and operating procedures.
INDUSTRY FIELD GUIDE / 03
Practice decisions that preserve safety, quality, and recoverable production.
3 applied lessons · 21 min · synthetic decision checks
Explore manufacturing ↗THE DECISIONS YOU’LL PRACTICE
These synthetic manufacturing examples apply general engineering practices; sector-specific product, safety, contractual, and legal obligations require separate assessment.
INDUSTRY FIELD GUIDE / 04
Practice coordinated downtime, biomedical access, and evidence-based recovery.
3 applied lessons · 21 min · synthetic decision checks
Explore healthcare ↗THE DECISIONS YOU’LL PRACTICE
These synthetic U.S. healthcare cases illustrate security coordination, not medical treatment; HIPAA and other requirements depend on the organization, data, and relationship.
INDUSTRY FIELD GUIDE / 05
Practice separating educational data needs from excessive access.
3 applied lessons · 24 min · synthetic decision checks
Explore education ↗THE DECISIONS YOU’LL PRACTICE
These synthetic U.S. examples distinguish K–12 student records from university research; FERPA coverage depends on Department of Education funding, and CISA recommendations are guidance.
INDUSTRY FIELD GUIDE / 06
Practice accountable access and recovery for public services.
3 applied lessons · 24 min · synthetic decision checks
Explore public sector ↗THE DECISIONS YOU’LL PRACTICE
These synthetic U.S. public-service examples use voluntary risk guidance; federal FISMA obligations do not automatically apply to every state or local agency.
INDUSTRY FIELD GUIDE / 07
Practice securing the customer journey through fulfilment and refunds.
3 applied lessons · 24 min · synthetic decision checks
Explore retail & e-commerce ↗THE DECISIONS YOU’LL PRACTICE
These synthetic retail exercises treat PCI DSS as an industry standard within payment compliance programs, with scope determined by the actual payment architecture and responsibilities.
INDUSTRY FIELD GUIDE / 08
Practice protecting partner access and operational information without unsafe disruption.
3 applied lessons · 24 min · synthetic decision checks
Explore transport & logistics ↗THE DECISIONS YOU’LL PRACTICE
These synthetic scenarios use general transport and OT guidance; road, rail, aviation, maritime, warehouse, and public-transit operations have different rules and safety procedures.
Learn to name the things worth protecting and describe a concrete loss as a confidentiality, integrity, or availability failure before talking about products.
Learn why two similar weaknesses can receive different priorities by separating threat, vulnerability, exploitation evidence, impact, and what you still do not know.
Trace a browser request to a tracking portal and identify what the network, DNS, HTTP, and TLS each do and do not protect.
Distinguish proving who someone is from granting access, and treat account recovery as part of the same control system.
Choose a scoped access policy by naming trust boundaries and stacking independent controls instead of one powerful exception.
Build a small organization's prevention and recovery plan that covers classification, updates, backups, and what must still work when a warehouse is down.
Separate observed facts, hypotheses, and missing information when reading logs and alerts so a later decision can be defended.
Relate a named risk to an outcome, a control, the evidence you would collect, and the product category that might help—without treating a purchase as the outcome.
Practice stating what is known, what is hypothesized, and which evidence to request next when a synthetic identity alert fires.
Combine severity, exploitation evidence, exposure, and business context to order a synthetic vulnerability backlog without pretending a single score is enough.
Propose a scoped response with a human decision and postcondition checks, using a synthetic identity-and-export case.
Explain IRIS components as a reference architecture, complete a synthetic walkthrough, and keep human authority separate from model text.
