✳ Core lessons / Topics

Find the lesson that answers the question.

Foundations, the SOC analyst introduction, AI application and agent security, application supply chain, email authentication, GRC practice, the privacy boundary, and identity federation, in path order and from A to Z. Minutes and prerequisites are on each row. A figure mark means the lesson includes a static diagram.

Cybersecurity foundations

Open this path ↗

Ten lessons that teach a beginner to name assets and losses, judge risk under uncertainty, trace a request, handle identity, write scoped policies, see where an application stops trusting the browser, plan recovery, name who owns cloud and SaaS work, read evidence, and connect those skills to frameworks and product categories.

What we protect: assets, confidentiality, integrity, and availability

Learn to name the things worth protecting and describe a concrete loss as a confidentiality, integrity, or availability failure before talking about products.

No prerequisites.

8 MINHAS FIGURE

Threat, vulnerability, likelihood, impact, and uncertainty

Learn why two similar weaknesses can receive different priorities by separating threat, vulnerability, exploitation evidence, impact, and what you still do not know.

Prerequisites: F1 What we protect: assets, confidentiality, integrity, and availability

9 MIN

How systems communicate: network, DNS, HTTP, and TLS

Trace a browser request to a tracking portal and identify what the network, DNS, HTTP, and TLS each do and do not protect.

Prerequisites: F1 What we protect: assets, confidentiality, integrity, and availability

10 MINHAS FIGURE

Identity, authentication, authorization, and recovery

Distinguish proving who someone is from granting access, and treat account recovery as part of the same control system.

Prerequisites: F1 What we protect: assets, confidentiality, integrity, and availability

9 MINHAS FIGURE

Least privilege, secure defaults, trust boundaries, and layered controls

Choose a scoped access policy by naming trust boundaries and stacking independent controls instead of one powerful exception.

Prerequisites: F1 What we protect: assets, confidentiality, integrity, and availability · F4 Identity, authentication, authorization, and recovery

8 MINHAS FIGURE

F5b

Application trust boundaries: the client, the server, and TLS

See where a web application stops trusting the browser, what TLS does not decide, and how injection or a broken access check becomes a confidentiality or integrity loss.

Prerequisites: F5 Least privilege, secure defaults, trust boundaries, and layered controls · F3 How systems communicate: network, DNS, HTTP, and TLS

9 MIN

Data protection, updates, backups, and resilience

Build a small organization's prevention and recovery plan that covers classification, updates, backups, and what must still work when a warehouse is down.

Prerequisites: F1 What we protect: assets, confidentiality, integrity, and availability · F2 Threat, vulnerability, likelihood, impact, and uncertainty

8 MIN

F6b

Cloud and SaaS shared responsibility

Use one Riverstone service three ways (IaaS, PaaS, and SaaS) and name who patches, who grants access, who keeps logs, who can restore, and who must notify.

Prerequisites: F6 Data protection, updates, backups, and resilience · F4 Identity, authentication, authorization, and recovery

9 MIN

Logs, alerts, and evidence

Separate observed facts, hypotheses, and missing information when reading logs and alerts so a later decision can be defended.

10 MIN

From principles to frameworks and product categories

Relate a named risk to an outcome, a control, the evidence you would collect, and the product category that might help, without treating a purchase as the outcome.

Prerequisites: F1 What we protect: assets, confidentiality, integrity, and availability · F2 Threat, vulnerability, likelihood, impact, and uncertainty · F4 Identity, authentication, authorization, and recovery · F5 Least privilege, secure defaults, trust boundaries, and layered controls · F7 Logs, alerts, and evidence

10 MIN

SOC analyst introduction

Open this path ↗

Four lessons that take the foundations path into evidence-to-decision work: identity-alert triage, vulnerability prioritization, investigation with verified recovery, and an honest introduction to an Agentic SOC. Each lesson lists the foundation skills it depends on.

Triage a synthetic identity alert

Practice stating what is known, what is hypothesized, and which evidence to request next when a synthetic identity alert fires.

Prerequisites: F4 Identity, authentication, authorization, and recovery · F7 Logs, alerts, and evidence

9 MIN

Prioritize vulnerabilities and exposures

Combine severity, exploitation evidence, exposure, and business context to order a synthetic vulnerability backlog without pretending a single score is enough.

Prerequisites: F2 Threat, vulnerability, likelihood, impact, and uncertainty · F8 From principles to frameworks and product categories

9 MIN

Investigate, respond, and verify recovery

Propose a scoped response with a human decision and postcondition checks, using a synthetic identity-and-export case.

Prerequisites: S1 Triage a synthetic identity alert · F7 Logs, alerts, and evidence

10 MIN

Understand and build toward an Agentic SOC

Explain Agentic SOC components as a reference architecture, complete a synthetic walkthrough, and keep human authority separate from model text.

Prerequisites: S1 Triage a synthetic identity alert · S3 Investigate, respond, and verify recovery · F8 From principles to frameworks and product categories

10 MIN

AI application and agent security

Open this path ↗

Four lessons on treating user, retrieved, and tool text as untrusted, keeping tools and credentials outside the model, and requiring a human gate before high-impact actions. Builds on identity, least privilege, and evidence. Agentic SOC remains the place for investigation architecture.

Prompt injection and retrieval trust

Separate developer instructions from user, retrieved, and tool text, and treat a retrieval store as untrusted input rather than as a policy.

Prerequisites: F4 Identity, authentication, authorization, and recovery · F5 Least privilege, secure defaults, trust boundaries, and layered controls · F7 Logs, alerts, and evidence

10 MIN

Excessive agency: tools, credentials, and blast radius

Constrain what an application can do by limiting tool functions, credentials, and autonomy outside the model, and name the blast radius before a model can call anything.

Prerequisites: G1 Prompt injection and retrieval trust

10 MIN

Human oversight as a designed process

Name who may approve a high-impact agent action, what they must see, and when the application must stop for a person.

Prerequisites: G2 Excessive agency: tools, credentials, and blast radius

10 MIN

A light map to the NIST AI Risk Management Framework

Place a constrained mail-and-payments agent on Govern, Map, Measure, and Manage without treating the AI RMF as a certification.

Prerequisites: G3 Human oversight as a designed process

9 MIN

From dependency to decision

Open this path ↗

Four lessons on threat-modeling a small checkout API, seeing transitive dependencies, separating who can write code from who can promote it, and using an SBOM as inventory evidence rather than as a control. Builds on risk, least privilege, and framework vocabulary. TrackPort’s client and TLS lesson stays in Foundations.

Map the shop: trust boundaries on a synthetic checkout API

Draw ShopCart’s data flows and trust boundaries, name an abuse case at each boundary, and write one control that still works if a network rule fails.

Prerequisites: F2 Threat, vulnerability, likelihood, impact, and uncertainty · F5 Least privilege, secure defaults, trust boundaries, and layered controls · F8 From principles to frameworks and product categories

9 MIN

What you didn’t import still ships with you

Tell a direct dependency from a transitive one, name the risk of an unmaintained component, and list inventory sources you would actually open.

Prerequisites: A1 Map the shop: trust boundaries on a synthetic checkout API

9 MIN

Who can write, who can promote

Map workstation to runtime, mark where a second person must approve promotion, and name a secret the writer must not hold.

Prerequisites: A2 What you didn’t import still ships with you · F5 Least privilege, secure defaults, trust boundaries, and layered controls · F8 From principles to frameworks and product categories

9 MIN

Inventory, evidence, exposure, then the business

Use an SBOM as inventory evidence, then order a synthetic component finding by exploitation evidence, exposure, and business context.

Prerequisites: A3 Who can write, who can promote · F2 Threat, vulnerability, likelihood, impact, and uncertainty

10 MIN

What the mailbox proves

Open this path ↗

One lesson on what SPF, DKIM, and DMARC each check, which phishing still gets through, and how a synthetic domain moves from monitoring (p=none) to enforcement without treating a pass as safe mail.

What the mailbox proves (and what it doesn’t): SPF, DKIM, and DMARC

Name what SPF, DKIM, and DMARC each check, which phishing still gets through, and how a synthetic domain moves from monitoring to enforcement without treating a pass as safe mail.

Prerequisites: F3 How systems communicate: network, DNS, HTTP, and TLS

12 MIN

From risk sentence to operating cadence

Open this path ↗

Three lessons that turn one Riverstone risk into an owned control, the evidence that shows the control ran, and a month of CSF 2.0 Govern work. Builds on risk, evidence, and framework vocabulary. Practices the framework cards.

One risk, one owner, one open question

Turn the Riverstone VPN and the TrackPort export into separate risk sentences, with an owner, a review date, and the uncertainty still open.

Prerequisites: F2 Threat, vulnerability, likelihood, impact, and uncertainty · F7 Logs, alerts, and evidence · F8 From principles to frameworks and product categories

9 MIN

The control is not the screenshot of a vendor logo

Choose one control for the VPN risk, name the record that shows it ran, and write an exception that expires.

Prerequisites: R1 One risk, one owner, one open question

10 MIN

Govern is a calendar, not a poster

Walk the six CSF 2.0 Govern categories in plain language, then run a 30-day Riverstone cadence. ISO/IEC 27001 stays a scoped ISMS.

Prerequisites: R2 The control is not the screenshot of a vendor logo

11 MIN

Privacy is not a CIA checkbox

Open this path ↗

One foundations-adjacent lesson on the boundary between security objectives (confidentiality, integrity, availability, and resilience) and privacy objectives (appropriate use, minimization, and individual rights). Encryption and access control are not privacy done. Sector laws stay in separate explainers.

Privacy is not a CIA checkbox

Separate security objectives (confidentiality, integrity, availability, and resilience) from privacy objectives (appropriate use, minimization, and individual rights) without treating encryption or a framework map as a legal determination.

Prerequisites: F1 What we protect: assets, confidentiality, integrity, and availability

10 MIN

Trust tickets, not hallway trust

Open this path ↗

Three lessons on OAuth tickets, OIDC and SAML sign-in claims, and five federation failure habits. Builds on F4. Practices trust decisions. Does not replace the glossary term guides.

IF1