0 of 106 studied
The backbone of modern software: every commit becomes a build, a test run and a deploy with no manual intervention.
start this topic all domains AppSec CloudSec Agents SecOps Engineering OWASP Top 10 Vibecoding DevOps Incident response Offensive security GRC and leadership
any role AppSec Engineer DevSecOps Engineer DevOps / Platform Engineer Cloud Security Engineer Detection / SOC Engineer AI Security Engineer Security Architect Incident Responder Threat Hunter Forensics and Malware Analyst Penetration Tester Red Team Operator Third-Party Risk Analyst GRC and Compliance Manager CISO
01 Foundations
The ideas everything else builds on.
02 Practitioner
Apply the controls and make them work in practice.
03 Advanced
Design, scale and operate at depth.
Foundations
CI/CD The automated build, test and deploy pipeline next Secrets Scanning Detects keys and passwords in the repository Shift-left Security as early as possible Practitioner
SAST Static analysis of source code DAST Dynamic testing of the running application SCA Inventory and CVEs of dependencies Threat modeling: think like the attacker before coding find the flaw in the design, before any code exists Advanced
SBOM The software's ingredient list DevSecOps Security built into every stage Foundations
IAM - identity and access who is who, and what each one can do Network - segmentation and zero-trust segmentation, microsegmentation and network policies Logging & detection - signals and alerts CloudTrail, audit and signal correlation Practitioner
Containers - images and supply chain build, signing and immutable runtime CSPM - cloud posture continuous posture in the cloud Secrets - vaults and rotation credentials never in code KMS & crypto - keys and envelopes key management and encryption Zero-trust - trust model never trust, always verify Advanced
Kubernetes - secure runtime RBAC, admission and cluster security CWPP - workload protection runtime and workload behavior Cloud incident response from alert to containment, with evidence preserved Foundations
Chunking cutting the document into retrievable pieces Embeddings turning text into vectors that approximate meaning LLM - large language model the model that generates text from context Practitioner
RAG - retrieval-augmented generation answers based on retrieved documents Vector DB a database that searches by distance instead of by exact term Retrieval choosing the right passages for the question Tool calling the model invokes typed external functions Evals - quality measured in production dataset, metric and runner to measure quality Guardrails - input and output filters input and output filters to contain the agent Advanced
Agent frameworks a skeleton to orchestrate reasoning, memory and tools Orchestration coordinating multiple agents and steps MCP - model context protocol standardized protocol between model and tools Benchmarks - public reference public sets for comparing agents and LLMs LLM as judge - automated rubric using an LLM to score another's output Regression evals - fixed suite on the PR a fixed suite that blocks regressions on the PR Foundations
Edge and application telemetry from raw log to an event ready for detection L7 attacks: what to look for a taxonomy of application-layer abuse Practitioner
Detection engineering treating detections as software: versioned, tested and measured WAF - observation, shadow and enforcement filter L7 traffic without taking down what is legitimate Adaptive rate limiting limit abuse without punishing real users Bot management separating legitimate automation from automated abuse Advanced
Scale: telemetry, cardinality and cost keeping detection fast and cheap when volume explodes Runbooks, response and post-incident hardening from fast containment to the fix that closes the door SOC SLOs and continuous tuning measure time, precision and coverage, and adjust every week Defense in depth: edge system design where each control lives, and what happens when it fails
Practitioner
Secure infrastructure as code Terraform and Ansible reviewed, scanned and drift-free CI/CD hardening the pipeline is a target too: protecting it protects everything it delivers Advanced
Policy as code executable, versioned, testable security rules Reliability at scale: idempotency, retries and backpressure the pipeline that withstands failure without losing or duplicating a decision Observability of the security platform itself knowing when the detection pipeline is blind or late Security automation and playbooks as code automated response with brakes: idempotent, auditable and reversible AI in triage and mitigation LLMs as security assistants, with validation and no blind trust Security as an internal product the secure path must be the easiest path Foundations
A01 Broken Access Control users acting outside the permissions they were meant to have A05 Injection untrusted input interpreted as code or commands A07 Authentication Failures attackers pass as someone else: guessed, stuffed, stolen or fixed sessions Practitioner
A02 Security Misconfiguration safe software, shipped with unsafe settings A03 Software Supply Chain Failures compromise through what you depend on, build with or install A04 Cryptographic Failures sensitive data exposed by weak, missing or misused cryptography A06 Insecure Design a flaw in the idea itself, which no amount of clean code fixes A09 Security Logging and Alerting Failures attacks that go unnoticed because nothing recorded them or nobody was told A10 Mishandling of Exceptional Conditions errors, timeouts and odd inputs that leave the system open or leaking Advanced
A08 Software or Data Integrity Failures trusting code or data that could have been tampered with Foundations
The vibecoding spectrum from autocomplete to autonomous agents, and where each one fits Model, harness and provider the three layers behind every AI coding tool, and why the same model behaves differently Coding agents compared Claude Code, OpenCode, OMP, OMO, herdr and the rest: what each is and how they differ Practitioner
Choosing a model: frontier, cheap and open Claude, GPT, Gemini, DeepSeek and local models: quality, cost, speed and where your code goes When to use what a decision guide from the task to the tool, model and amount of autonomy Context engineering for coding agents project instructions, plans, skills and small tasks: how to get reliable output The verification loop tests, diffs, review and CI gates: trusting AI output only as far as you can check it Advanced
Orchestration and parallel agents git worktrees, multiplexers like herdr and layers like OMO: running many agents without chaos Securing the agent itself permissions, sandboxes, prompt injection, secrets and supply chain for coding agents Foundations
Linux and networking essentials processes, permissions, services, DNS, TCP and TLS: the ground every other tool stands on Git workflows and code review branching, pull requests, protected branches and ownership as the front door of delivery Containers and images images, layers, registries and a Dockerfile that is small, reproducible and safe to run The delivery lifecycle from commit to production and back: continuous integration, delivery and deployment Practitioner
CI pipelines that stay fast stages, caching, artifacts and reproducible builds Infrastructure as code describe servers, networks and services in files, review them, and apply them repeatably Kubernetes fundamentals pods, deployments, services, configuration, probes and resource limits Observability: metrics, logs and traces knowing what your system is doing from the outside, and alerting on what matters Advanced
Release strategies and rollback blue/green, canary, rolling and feature flags: shipping without betting the company Reliability: SLOs, error budgets and incidents defining how reliable is reliable enough, and learning from every failure Foundations
The incident response lifecycle prepare, detect, contain, eradicate, recover and learn: the loop every incident follows Threat intelligence knowing who attacks you and how, and using that to decide what to defend first Practitioner
Log analysis and building a timeline turning scattered logs into the story of what the attacker did and when Triage, scoping and containment decide what happened and how big it is, then stop the bleeding without destroying evidence Ransomware response playbook contain fast, preserve evidence, recover from backups and decide with legal and leadership Advanced
Threat hunting looking for attackers that your alerts missed, starting from a hypothesis Digital forensics fundamentals collecting evidence in the right order, proving it was not altered, and reading what it shows Malware analysis fundamentals triaging a suspicious file safely: static and dynamic analysis, detection rules and a disciplined lab Foundations
Authorization, scope and ethics what separates a security test from a crime: permission, boundaries and rules of engagement Penetration testing methodology phases, test types and the standards that give an assessment structure and repeatability Practitioner
Reconnaissance and attack surface finding what is exposed: assets, services and forgotten systems, from the attacker's and the defender's side Web and API security testing a method for testing authentication, authorization and input handling, with two accounts and an intercepting proxy Social engineering and phishing defense the human attack surface: how it works, how to simulate it ethically, and the controls that work Reporting findings and driving remediation the report is the product: clear impact, reproducible evidence and fixes people can apply Advanced
Attack paths and privilege escalation how small misconfigurations chain into full compromise, and how defenders find the chain first Red team, purple team and adversary emulation testing whether people and detection can stop a realistic adversary, not just whether a bug exists Foundations
Security risk management identify, rate, treat and track risks so that decisions are made on purpose Security frameworks and standards ISO 27001, NIST CSF, CIS Controls and PCI DSS: what each is for and how to choose Practitioner
Third-party and supply chain risk assessing suppliers and partners, because their weakness becomes yours Security architecture principles zero trust, defense in depth, least privilege and reference architectures that scale Compliance in practice: controls, evidence and audits turning requirements into controls with an owner, collecting evidence continuously and passing audits calmly Security metrics and reporting to leadership measuring outcomes, not activity, and telling the board a story it can act on Advanced
Security strategy, roadmap and budget what a CISO decides: priorities, a multi-year plan, a budget and the trade-offs behind them Crisis communication and security culture what to say, to whom and when during an incident, and how culture decides everything before it