Our Learning Methodology
How our courses systematically transition learners from fundamental concepts to applied lab exercises, ambiguous incident triage, and comprehensive capstone investigations.
The Four-Stage Learning Journey
Learners do not jump straight into complex multi-stage attacks without scaffolded preparation. Each course follows an intentional four-stage instructional progression.
Concept Foundations
Every module begins by decomposing underlying architectural mechanisms: TCP/IP state transitions, Windows security identifiers (SIDs), cloud identity tokens, or file-system metadata structures.
Guided Hands-On Labs
Learners apply concepts through step-by-step guided exercises: configuring Wazuh detection rules, executing targeted Nmap scans against designated lab hosts, or inspecting registry hives.
Ambiguous Incident Triage
Scaffolding is reduced. Learners receive uncurated log streams, packet captures, or compromised endpoints. They must differentiate benign noise from malicious activity and formulate defensible hypotheses.
Capstone Deliverables
Synthesizing multi-week capabilities into a documented, evidence-based investigation report or security assessment that demonstrates technical maturity and clear remediation recommendations.
Suggested Course Assessment Structure
Assessment across all four official courses is balanced between knowledge verification, practical lab execution, and authentic capstone reporting.
Verify conceptual grasp of core protocols, security architectures, legal frameworks, and operating principles before entering labs.
Hands-on weekly exercises: tool configuration, packet parsing, vulnerability verification, cloud access review, and evidence hashing.
Documenting technical findings, attack paths, remediation proposals, and evidence chain-of-custody worksheets.
End-to-end multi-stage simulation producing a documented, evidence-based investigation or security assessment report.
The official course proposals suggest a 70% overall minimum score across quizzes, labs, written assignments, and the capstone project. Final grading scales, retry policies, and cohort evaluation guidelines are currently unconfirmed and subject to institutional approval.
Methodology Applied Across the Four Pathways
Here is how this four-stage methodology translates into tangible learning activities across each specialised course.
Defensive Operations & Alert Triage
- Concepts: SOC tier roles, alert lifecycle, MITRE ATT&CK taxonomy.
- Guided Labs: Sysmon event logging, Wireshark packet dissection, Wazuh alert rule tuning.
- Triage Exercise: Distinguishing benign administrative PowerShell from malicious download cradles.
- Capstone: Investigating a multi-stage enterprise attack scenario, mapping behaviour to ATT&CK, and drafting an incident briefing.
Offensive Verification & Scoped Testing
- Concepts: Rules of engagement, ethical scoping, CVSS severity metrics.
- Guided Labs: Target enumeration with Nmap, scanning with Nessus/OpenVAS, web intercept in Burp Suite.
- Triage Exercise: Analysing vulnerable authentication endpoints and identifying privilege escalations in target VMs.
- Capstone: Authorized penetration test of a multi-service web application and network environment with actionable remediation guidance.
Cloud Identity & Detection Engineering
- Concepts: Zero Trust architecture, Entra ID identity plane, cloud shared responsibility model.
- Guided Labs: Configuring Azure RBAC, PIM just-in-time access, NSG flow rules, and Key Vault policies.
- Triage Exercise: Writing Kusto Query Language (KQL) queries in Microsoft Sentinel to detect suspicious credential usage.
- Capstone: Comprehensive posture assessment of a multi-tier cloud workload, triaging telemetry and presenting residual risks.
Artifact Analysis & Timeline Reconstruction
- Concepts: Order of volatility, cryptographic hashing, file-system structures ($MFT, FAT/ext4).
- Guided Labs: Evidence hashing with SHA-256 utilities, disk parsing in Autopsy and The Sleuth Kit, RAM analysis with Volatility 3.
- Triage Exercise: Event normalization and correlating endpoint, network, and authentication logs into a single timeline.
- Capstone: Investigating a multi-source enterprise compromise and submitting a documented, evidence-based forensic report.
Strict Rules of Engagement & Safe Lab Practice
Every cybersecurity exercise conducted at the Cybersecurity Academy operates under a strict code of ethics and legal responsibility:
- Explicit Authorization: Security testing and penetration exercises are strictly confined to isolated virtual machines and designated lab ranges. Scanning or probing external or unauthorized systems is strictly prohibited.
- Non-Disclosure & Integrity: Training scenarios, sample telemetry, and practice datasets are used solely for instructional purposes under controlled conditions.
- Constructive Purpose: Offensive techniques are taught exclusively to empower defenders to verify vulnerabilities and implement effective remediation controls.
Adherence to these ethical rules is a mandatory prerequisite for all coursework and assessment submissions.
Ready to Review the Laboratory Tooling?
Discover the specific security utilities, virtualized environments, and telemetry datasets used across our practical lab exercises.