How a stay-at-home mom broke into cybersecurity
A career-changer walks through the exact study plan, first tickets and interview answers that landed a Tier 1 SOC role.
#Video
Free
12 3
View Free
Resources
Watch, read, and build the analyst habit.
Video sessions, printable guides, and the full Academy lesson library in one place.
Video sessions
Conversations, role breakdowns and tooling walkthroughs.
Tech role: SOC Analyst Tier 1
What a Tier 1 analyst actually does all shift: triage, phishing queues, escalation criteria and the tooling you touch daily.
#Video
Free
26 7
View FreeCertifications and tools that matter
Everyone talks about certs and tools — few talk about the invisible analyst skills that actually make you stand out.
#Video
Free
12 5
View FreePDF guides
Downloadable playbooks, roadmaps and checklists.
From classroom or career to cyber: building skills employers want
Whether you're a student choosing a role or a professional switching careers, this roadmap helps you map transferable skills, find entry-level openings and rebrand yourself for security work.
PDF guide2 pages
Download FreeFree
The phishing investigation field guide
A printable checklist for headers, content, attachments and links — with the exact tools to reach for and what a good finding looks like at each stage.
PDF guide2 pages
Download FreeFree
Academy lessons
Short, practical lessons tied to investigation moments. Every lesson ends with a checklist, an interview answer, and an open discussion thread.
Email Auth
Foundation
3 minSPF in 3 minutes
SPF tells you which servers are allowed to send mail for a domain. It says nothing about who wrote the message or what the user sees in the From line.
Foundation
4 minDKIM: what a signature actually proves
DKIM proves a domain signed specific parts of a message and that those parts were not modified in transit. It does not prove intent, ownership of the brand, or that the From address is honest.
Core
5 minDMARC alignment vs authentication
DMARC is the only one of the three that looks at the address your user actually sees. It ties an SPF or DKIM pass to the visible From domain and tells receivers what to do when neither lines up.
Files
Foundation
3 minFile hashes and why MD5 still shows up
A hash is an exact-match fingerprint. It is superb for correlation and useless the moment a single byte changes — which is why fuzzy hashing exists alongside it.
Core
6 minReading a sandbox report critically
A sandbox tells you what happened in one artificial environment for a few minutes. Your job is to separate observed behaviour from vendor scoring, and to notice what did not happen.
Identity
Advanced
6 minOAuth consent abuse
The user is never asked for a password. They are asked to approve an app, and the resulting token survives password resets and often MFA entirely.
Core
4 minMalicious inbox rules
A rule is the cheapest persistence in email compromise: it hides the attacker's tracks, exfiltrates continuously, and survives long after the initial access is forgotten.
Advanced
5 minMFA fatigue and token theft
MFA raises the bar; it does not close the door. Push bombing exploits the human, and adversary-in-the-middle proxies steal the session token after MFA has already succeeded.