Study paths

The natural order for understanding each check and where it fits in the pipeline.

1. 1CI/CDappsecThe pipeline is the stage: understand the steps before the tools.
2. 2Shift-leftappsecThe idea that organizes everything: finding it early costs less.
3. 3Threat modeling: think like the attacker before codingappsecThe leftmost point: finding the flaw in the design.
4. 4Secrets ScanningappsecThe most common mistake and the cheapest to avoid.
5. 5SASTappsecLooking at the code you wrote.
6. 6SCAappsecLooking at the code you imported.
7. 7SBOMappsecKeeping the inventory of what was shipped.
8. 8DASTappsecAttacking the running application, from the outside.
9. 9DevSecOpsappsecBringing it all together in gates, policies and culture.

Follows the cloud cycle: protect, detect and respond, starting with identity.

1. 1IAM - identity and accesscloudsecIdentity is the new perimeter: the place to start.
2. 2Network - segmentation and zero-trustcloudsecSegment to limit lateral movement.
3. 3Logging & detection - signals and alertscloudsecNo signal, no detection: logs come first.
4. 4Zero-trust - trust modelcloudsecThe mental model that joins identity and network: no origin is trusted by default.
5. 5KMS & crypto - keys and envelopescloudsecEncrypting well depends on controlling the keys.
6. 6Secrets - vaults and rotationcloudsecEphemeral secrets, in a vault, with rotation.
7. 7Containers - images and supply chaincloudsecImmutable images and the supply chain.
8. 8Kubernetes - secure runtimecloudsecThe cluster as a distributed operating system.
9. 9CSPM - cloud posturecloudsecContinuous posture: detect configuration drift.
10. 10CWPP - workload protectioncloudsecSee what happens inside the workload.
11. 11Cloud incident responsecloudsecFrom alert to containment, with the evidence preserved.

Build an agent's pipeline and learn where each risk shows up.

1. 1LLM - large language modelai-agentsThe core: what the model does and where it fails.
2. 2Chunkingai-agentsHow knowledge is sliced up.
3. 3Embeddingsai-agentsTurning text into vector meaning.
4. 4Vector DBai-agentsWhere the vectors live and who can see them.
5. 5Retrievalai-agentsChoosing the right context for the question.
6. 6RAG - retrieval-augmented generationai-agentsCombining retrieval and generation, and their indirect injection risk.
7. 7Tool callingai-agentsWhen the model starts acting in the world.
8. 8MCP - model context protocolai-agentsThe protocol that connects tools, and its attack surface.
9. 9Orchestrationai-agentsMultiple agents, trust that must not be transitive.
10. 10Guardrails - input and output filtersai-agentsLayers of protection before and after the model.
11. 11Evals - quality measured in productionai-agentsMeasure before you believe.
12. 12Regression evals - fixed suite on the PRai-agentsProtect what already works with every change.

A path across domains: the same artifact, from the pipeline to production.

1. 1Threat modeling: think like the attacker before codingappsecStart with the design: which threats are worth handling?
2. 2Secrets ScanningappsecNo secrets in the repository.
3. 3SCAappsecDependencies verified before the build.
4. 4SBOMappsecThe inventory that travels with the artifact.
5. 5Containers - images and supply chaincloudsecThe artifact becomes an image: signed and immutable.
6. 6IAM - identity and accesscloudsecThe workload runs with the least privilege it needs.
7. 7Secrets - vaults and rotationcloudsecIn production, the secret comes from the vault.
8. 8CSPM - cloud posturecloudsecThe environment's posture is watched continuously.
9. 9Cloud incident responsecloudsecWhen something slips through, the response is already rehearsed.

From log to block: observe, detect, act and measure, like a real edge defense program.

1. 1Edge and application telemetrysecopsWithout good data, there is no good detection.
2. 2Scale: telemetry, cardinality and costsecopsHow to keep everything fast and cheap when volume explodes.
3. 3L7 attacks: what to look forsecopsThe signatures of the attacks you will be looking for.
4. 4Detection engineeringsecopsTurning patterns into versioned, measured detections.
5. 5WAF - observation, shadow and enforcementsecopsActing carefully: observation, shadow and enforcement.
6. 6Adaptive rate limitingsecopsLimiting abuse without punishing real users.
7. 7Bot managementsecopsSeparating legitimate automation from automated abuse.
8. 8Runbooks, response and post-incident hardeningsecopsFast containment and a fix that closes the door.
9. 9SOC SLOs and continuous tuningsecopsProving it works and tuning every week.
10. 10Defense in depth: edge system designsecopsThe design that ties it all together: where each control lives and what happens if it fails.

From infrastructure as code to automation with brakes: how to build the security platform.

1. 1Secure infrastructure as codesecengStart with what you provision: reviewed, scanned infrastructure.
2. 2Policy as codesecengExecutable rules that apply to everyone.
3. 3CI/CD hardeningsecengThe pipeline that delivers everything must be trustworthy.
4. 4Reliability at scale: idempotency, retries and backpressuresecengAt scale, failure happens: do not lose or duplicate decisions.
5. 5Observability of the security platform itselfsecengKnowing when your own pipeline is blind.
6. 6Security automation and playbooks as codesecengAutomated response with brakes.
7. 7AI in triage and mitigationsecengSpeeding up triage without trusting blindly.
8. 8Security as an internal productsecengThe secure path must be the easiest one.

The ten most important risks in web applications, in the order that makes the most sense for learning, each with failing code, resilient code and the test that proves it.

1. 1A01 Broken Access ControlowaspRisk number one: who can do what, on every request.
2. 2A05 InjectionowaspData turning into instructions: the pattern behind SQLi, XSS and commands.
3. 3A07 Authentication FailuresowaspProving who the user is without opening the door to anyone else.
4. 4A04 Cryptographic FailuresowaspProtecting data at rest and in transit without inventing an algorithm.
5. 5A02 Security MisconfigurationowaspCorrect software, insecure configuration: the cheapest mistake to find.
6. 6A06 Insecure DesignowaspThe flaw that lives in the idea, not in the code.
7. 7A03 Software Supply Chain FailuresowaspYou ship other people's code along with your own.
8. 8A08 Software or Data Integrity FailuresowaspProving that what runs is what should run.
9. 9A09 Security Logging and Alerting FailuresowaspSeeing the attack while it happens.
10. 10A10 Mishandling of Exceptional ConditionsowaspWhat happens when something goes wrong is security too.

From what these tools are to using them safely: layers, comparison, context, parallelism, verification and agent security.

1. 1The vibecoding spectrumvibecodingThe spectrum: from autocomplete to autonomous agents, and where each one fits.
2. 2Model, harness and providervibecodingModel, harness and provider: the confusion that explains almost everything.
3. 3Coding agents comparedvibecodingClaude Code, OpenCode, OMP, OMO, herdr: what each one really is.
4. 4Choosing a model: frontier, cheap and openvibecodingFrontier, cheap and open models: cost, speed and where your code goes.
5. 5When to use whatvibecodingFrom the task to the tool, the model and the level of autonomy.
6. 6Context engineering for coding agentsvibecodingWhat the agent sees decides the quality of what it does.
7. 7The verification loopvibecodingTrust only what you can check.
8. 8Orchestration and parallel agentsvibecodingMultiple agents without chaos: worktrees, multiplexers and review.
9. 9Securing the agent itselfvibecodingThe agent reads untrusted text and runs commands: protect it.

The foundation that DevOps and DevSecOps require, in the order in which each piece builds on the previous one.

1. 1Linux and networking essentialsdevopsThe ground floor: processes, permissions, DNS, TCP and TLS.
2. 2Git workflows and code reviewdevopsEvery change goes through review and version control.
3. 3Containers and imagesdevopsPackaging the application to be small, reproducible and secure.
4. 4The delivery lifecycledevopsThe cycle you will automate and the principles behind it.
5. 5CI pipelines that stay fastdevopsFast, reliable pipelines that are clear when they fail.
6. 6Infrastructure as codedevopsEnvironments described as code and reproducible.
7. 7Kubernetes fundamentalsdevopsRunning containers in a cluster with limits and checks.
8. 8Release strategies and rollbackdevopsCanary, blue/green and flags: release without betting everything.
9. 9Observability: metrics, logs and tracesdevopsKnowing what the system does and alerting on what matters.
10. 10Reliability: SLOs, error budgets and incidentsdevopsSLOs, error budgets and learning from every failure.

Prepare, detect, contain and investigate: the order in which each defense skill builds on the previous one.

1. 1The incident response lifecycleresponseThe cycle, the roles and the severity, before any crisis.
2. 2Threat intelligenceresponseWho attacks, how, and how confident we are about it.
3. 3Log analysis and building a timelineresponseBuilding the story from logs with clean timestamps.
4. 4Threat huntingresponseLooking for what the alerts missed, hypothesis by hypothesis.
5. 5Triage, scoping and containmentresponseScoping and containing without destroying evidence.
6. 6Ransomware response playbookresponseThe hardest case, handled as a business crisis.
7. 7Digital forensics fundamentalsresponseCollecting evidence that no one can dispute.
8. 8Malware analysis fundamentalsresponseSafely triaging a suspicious file and producing a detection.

From what separates a test from a crime to the report that becomes a fix.

1. 1Authorization, scope and ethicsoffsecAuthorization, scope and ethics before any packet.
2. 2Penetration testing methodologyoffsecPhases and standards that provide repeatability.
3. 3Reconnaissance and attack surfaceoffsecDiscovering what is exposed, from the attacker's side and the defender's.
4. 4Web and API security testingoffsecTwo accounts and a proxy answer most questions.
5. 5Attack paths and privilege escalationoffsecHow small weaknesses chain together, and how to cut them.
6. 6Social engineering and phishing defenseoffsecThe human surface and the controls that do not depend on perfection.
7. 7Red team, purple team and adversary emulationoffsecTesting whether the defense detects a realistic adversary.
8. 8Reporting findings and driving remediationoffsecThe report is the product: impact, evidence and fix.

Risk, frameworks, evidence, metrics and the conversation with the board.

1. 1Security risk managementgrcDeciding by risk, not by urgency.
2. 2Security frameworks and standardsgrcThe common vocabulary, and how to choose and combine.
3. 3Third-party and supply chain riskgrcThe attack surface that is not on your servers.
4. 4Security architecture principlesgrcControls designed once, as a standard.
5. 5Compliance in practice: controls, evidence and auditsgrcContinuous evidence instead of an audit scramble.
6. 6Security metrics and reporting to leadershipgrcOutcomes, not activity.
7. 7Security strategy, roadmap and budgetgrcPriorities, roadmap and budget.
8. 8Crisis communication and security culturegrcWhat to say in the crisis and the culture that precedes it.