Learn security in the order it builds on itself.

After: Trust Boundaries, Assets and Adversaries

After: Threat Modeling with Data-Flow Diagrams and STRIDE

After: Least Privilege, Defence in Depth and Fail-Safe Defaults

After: Threat Modeling with Data-Flow Diagrams and STRIDE

After: How the Kernel Isolates Processes

After: How the Kernel Isolates Processes

After: How the Kernel Isolates Processes

After: Attacker Positions on the Network

After: Attacker Positions on the Network

After: Attacker Positions on the Network

After: Attacker Positions on the Network · The Network Stack, Layer by Layer

After: Attacker Positions on the Network · How NAT Works, and Why It Isn't a Firewall

After: The Network Stack, Layer by Layer · How Firewalls Work Underneath

After: Kernel Space, User Space and System Calls · Process Isolation and Virtual Memory

After: DNS Security: Resolution, Poisoning, DNSSEC and Encrypted DNS

After: DNS Security: Resolution, Poisoning, DNSSEC and Encrypted DNS

After: Attacker Positions on the Network

After: Hashes, MACs and Digital Signatures

After: Symmetric Encryption and AEAD

After: Hashes, MACs and Digital Signatures

After: Hashes, MACs and Digital Signatures

After: Authentication versus Authorization

After: Authentication versus Authorization

After: Trust on the Wire: HSTS, Certificate Transparency, Pinning and Interception

After: How Tunnels and VPNs Work

After: How Tunnels and VPNs Work

After: Trust on the Wire: HSTS, Certificate Transparency, Pinning and Interception · How IPsec Works

After: How Firewalls Work Underneath · Designing Secure VPN Remote Access

After: How TLS 1.3 Works

After: PKI and Certificate Chains

After: PKI and Certificate Chains · Anatomy of an X.509 Certificate

After: Public-Key Cryptography and Key Exchange · Walk Through a TLS 1.3 Handshake

After: Symmetric Encryption and AEAD

After: PKI and Certificate Chains · Walk Through a TLS 1.3 Handshake

After: How TLS 1.3 Works · How Certificate Validation Works

After: Anatomy of an X.509 Certificate · PKI and Certificate Chains

After: PKI and Certificate Chains · How Certificate Validation Works

After: Certificate Issuance End to End · Root Programs and Trust Stores

After: OAuth 2.0 and PKCE

After: OpenID Connect and ID Tokens · OAuth Authorization Code Flow with PKCE

After: Sessions, Cookies and Tokens

After: Sessions, Cookies and Tokens · Sessions vs Bearer Tokens

After: Symmetric Encryption and AEAD

After: Hashes, MACs and Digital Signatures · Walk Through a TLS 1.3 Handshake

After: Hardware Roots of Trust and Key Custody

After: Authentication versus Authorization · Why Passkeys Resist Phishing

After: How the Kernel Isolates Processes · Unix Permissions, setuid and the Sticky Bit

After: The Mobile Platform Security Model

After: The Mobile Platform Security Model

After: The Linux Privilege Model: Permissions, setuid, Capabilities and MAC

After: How the Kernel Isolates Processes

After: Windows and Active Directory Security for Interviews

After: How the Kernel Isolates Processes

After: How the Kernel Isolates Processes

After: Windows and Active Directory Security for Interviews

After: Protecting Data on Mobile Devices

After: Trusting a Mobile Client: Pinning, Tamper Detection and Attestation · Android vs iOS Security Models

After: Android Sandbox, Signing and Permissions · Secure Boot, Measured Boot and TPMs

After: Windows and Active Directory Security for Interviews · Windows Tokens, Privileges and UAC

After: How the Kernel Isolates Processes

After: The Linux Privilege Model: Permissions, setuid, Capabilities and MAC

After: Windows and Active Directory Security for Interviews · Windows Tokens, Privileges and UAC

After: How the Kernel Isolates Processes

After: macOS Platform Security

After: Containers vs gVisor vs MicroVMs · seccomp-bpf, From Filter to Policy

After: Trust on the Wire: HSTS, Certificate Transparency, Pinning and Interception · What to Pin, and Why HPKP Failed · How Certificate Validation Works

After: Trusting a Mobile Client: Pinning, Tamper Detection and Attestation · Root and Jailbreak Detection

After: Injection Vulnerabilities

After: Cross-Site Scripting and Output Encoding

After: Least Privilege and Defence in Depth · Injection as a Vulnerability Class

After: Least Privilege, Defence in Depth and Fail-Safe Defaults

After: Server-Side Request Forgery

After: Broken Access Control and IDOR

After: Insecure Deserialization

After: Broken Access Control and IDOR

After: Cloud IAM and Privilege Escalation Paths · SSRF and LLM Fetch Tools

After: Protecting Model Weights

After: SLSA and Build Provenance

After: SLSA and Build Provenance

After: What Containers Isolate, and What They Do Not · Containers vs gVisor vs MicroVMs

After: Typosquatting and Dependency Confusion · Hardening CI/CD Pipelines · Package Ecosystem Attacks: npm, PyPI and Beyond

After: Threat Modeling with DFDs and STRIDE · How Scanning Sees Your Exposure

After: Memory Corruption and the Mitigations Against It

After: How the Kernel Isolates Processes

After: Memory Corruption and the Mitigations Against It · Injection as a Vulnerability Class

After: Malware Triage and YARA Rules · Reverse Shells and Command and Control

After: Attack Trees and Kill Chains · How a Penetration Test Runs

After: How the Kernel Isolates Processes

After: Reverse Engineering as a Security Method

After: Software Protection and Its Limits

After: Reverse Engineering as a Security Method · Android Sandbox, Signing and Permissions

After: Reverse Engineering Mobile Apps · How Android Rooting Works

After: Android vs iOS Security Models · The Mobile Platform Security Model

After: Memory Corruption and the Mitigations Against It · Memory-Safety Bug Classes · ASLR, DEP, Canaries, PIE and RELRO

After: Software Protection and Its Limits

After: How the Kernel Isolates Processes

After: Memory-Safety Bug Classes · ASLR, DEP, Canaries, PIE and RELRO

After: Trusting a Mobile Client: Pinning, Tamper Detection and Attestation · Certificate Pinning Design and Rotation

After: Android vs iOS Security Models · From Memory Bug to Exploit, Conceptually

After: System Prompt Leakage

After: The OWASP Top 10 for LLM Applications

After: Retrieval-Augmented Generation as a Data Flow

After: Tool Calling and the Agent Loop

After: How LLM Applications Work

After: What Is Prompt Injection? · Instructions and Data in One Channel

After: Indirect Prompt Injection · Prompt Injection vs SQL Injection

After: Prompt Injection versus Jailbreaking

After: System Prompt Leakage · Why the System Prompt Isn't a Boundary

After: Data Poisoning

After: What AI Red Teaming Is

After: Threat Modeling AI Systems

After: Unsafe Model Files: Pickle versus Safetensors

After: Design Patterns That Bound Prompt Injection

After: Indirect Prompt Injection

After: Insecure Output Handling

After: Data Exfiltration Channels in LLM Applications · Handling LLM Output Safely

After: System Prompt Extraction · Text-Only Assistants That Still Leak

After: Instructions and Data in One Channel · Spotlighting and Instruction Hierarchy

After: Sensitive Information Disclosure

After: RAG Security

After: The Lethal Trifecta · Direct vs Indirect Prompt Injection

After: Excessive Agency · Function Calling and Agent Authority

After: MCP Security

After: Excessive Agency · Delegated Authorization for AI Agents

After: Tool Poisoning and Rug Pulls · MCP Security Risks in Interviews

After: Membership Inference Attacks · Evasion vs Poisoning Attacks

After: Model Extraction · Evasion vs Poisoning Attacks

After: Data Poisoning

After: Model Extraction

After: Evasion vs Poisoning Attacks · Model Extraction: Gains and Defences

After: Scoping an AI Red Team Engagement · AI Red Teaming vs Pentesting vs Benchmarks

After: Attack Success Rate and Probabilistic Findings · Red-Teaming a Customer Chatbot End to End

After: AI Incident Response

After: SAST, DAST, SCA and Fuzzing Compared · LLM-Assisted Security Code Review

After: The Inference Stack as Attack Surface

After: Sandboxing Untrusted Code

After: SLSA and Build Provenance

After: RAG Security

After: RAG Security

After: Excessive Agency

After: Agent Memory Security: Poisoning, Provenance and Forgetting

After: Stopping Agent Memory Poisoning · Defending Against MCP Tool Poisoning

After: AI Incident Response

After: Protecting Model Weights

After: Governing Non-Human Identities · Rate Limits and Budgets for Agents · Kill Switches for AI Features

After: AI Incident Response

After: Incident Handling: Declare, Contain, Scope, Recover, Learn

After: Endpoint and Network Telemetry for Detection · Event, Alert and Incident

After: Detection Engineering: From Hypothesis to Tested Alert · Event, Alert and Incident

After: Incident Handling: Declare, Contain, Scope, Recover, Learn

After: Vulnerability Management by Risk: CVSS, EPSS, KEV and Context

After: Prioritising Vulnerabilities · Vulnerability Management by Risk: CVSS, EPSS, KEV and Context

After: The NIST AI Risk Management Framework

After: The EU AI Act for Engineers

After: Incident Response: a Leaked API Key