CompTIA · Free, ad-free audio course
A structured, audio-first learning route for CompTIA CySA+, designed for focused review and practical understanding.
PUT IT INTO PRACTICE
Try 50 original BMC questions, review every explanation, and return to the lessons behind the answer. No login is required. Earn Challenge achievements and share your progress as you go.
Independent BMC learning practice—not official exam items, a full mock exam, or an exam-readiness score.
Companion Books
The study guide helps you organize and revisit the material. The flashcards book adds active recall and rapid review across the course objectives.
Study Guide
Use the companion study guide to organize the material, compare important concepts, annotate key ideas, and build a written reference for review.
Flashcards Book
Use the flashcards book for active recall, terminology checks, rapid review, and repeated practice across the course objectives.
Complete Lesson Directory
Search by topic or narrow the directory by exam domain. Courses with multiple editions are organized below so every season remains easy to find. Each lesson includes its own audio player, full description, transcript when available, and previous-or-next navigation.
130 lessons available
Getting Started and Exam Review
In this inaugural episode of the CySA+ PrepCast, we begin our journey by exploring what the CompTIA Cybersecurity Analyst certification actually is—and why it's more relevant than ever in today’s threat-driven world.…
Getting Started and Exam Review
Before diving into the technical content, it's important to understand the structure of the exam you're preparing for.…
Getting Started and Exam Review
With so many cybersecurity certifications on the market, it’s natural to wonder how the CySA+ stacks up against others like Security+, CISA, CEH, and CISSP.…
Getting Started and Exam Review
Studying for the CySA+ requires more than reading books—it requires strategic repetition, practice, and the right mix of tools. In this episode, we go beyond generic study tips and focus on what really works when preparing for a hands-on, analysis-heavy certification.…
Getting Started and Exam Review
The exam day experience can make or break your performance—not because of your knowledge, but because of anxiety, confusion, or poor time management. In this episode, we walk you through exactly what to expect when it’s time to take the CySA+ certification exam.…
Getting Started and Exam Review
Before we dive into tools, techniques, and frameworks, it’s important to make sure your foundational knowledge is solid. In this episode, we review the essential cybersecurity concepts that every CySA+ candidate should understand before tackling more advanced material.…
Getting Started and Exam Review
Performance-based questions can catch even well-prepared test takers off guard. Unlike traditional multiple-choice items, these questions ask you to interact with tools, analyze artifacts, or simulate workflows—replicating what you’d actually do in a live security environment.…
Getting Started and Exam Review
The multiple-choice section of the CySA+ exam isn’t just about knowing the right answer—it’s about identifying it under pressure. In this episode, we focus on smart test-taking strategies specifically designed for the CySA+ question format.…
Getting Started and Exam Review
Hands-on practice is essential for CySA+ success, and that means having your own lab environment. In this episode, we help you build one using tools you can install on your own laptop, run in the cloud, or deploy in virtual machines.…
Getting Started and Exam Review
What happens after you pass the CySA+? This episode explores the real-world benefits of certification and how it translates into career opportunities.…
Getting Started and Exam Review
Technical knowledge alone isn’t enough. As a cybersecurity analyst, your ability to explain threats, risks, and remediation strategies to non-technical audiences can make or break your effectiveness.…
Getting Started and Exam Review
In this fast-paced review episode, we recap the most critical concepts from Domain 1 (Security Operations) and Domain 2 (Vulnerability Management).…
Getting Started and Exam Review
This second review episode brings together the essential content from Domain 3 (Incident Response and Management) and Domain 4 (Reporting and Communication).…
Getting Started and Exam Review
Before we tackle deeper technical episodes, it's essential to get fluent with the vocabulary used in the exam and in real-world security operations. This first glossary episode focuses on foundational network and infrastructure terms.…
Getting Started and Exam Review
In this second glossary episode, we focus on the security tools, frameworks, and compliance standards you’ll need to recognize and understand throughout your CySA+ journey.…
Getting Started and Exam Review
In the final glossary-focused episode, we turn our attention to the specialized language used in incident response, threat detection, and analyst operations.…
Domain 1 · Security Operations
Welcome to Domain 1, the largest and most foundational section of the CySA+ exam. In this episode, we preview what you’ll learn across the next several modules and explain how Security Operations serves as the nerve center of a modern cyber defense strategy.…
Domain 1 · Security Operations
Effective cybersecurity starts with visibility—and that begins with logs. In this episode, we explore the basics of log ingestion, including what data is collected, how it's normalized, and where it's stored.…
Domain 1 · Security Operations
Understanding the underlying behavior of operating systems is critical for detecting and investigating malicious activity. In this episode, we explore the core OS concepts that every cybersecurity analyst must master.…
Domain 1 · Security Operations
In this episode, we go deeper into the building blocks of computing environments that matter for cyber defense.…
Domain 1 · Security Operations
Today’s IT environments are complex ecosystems that include virtual machines, containers, and serverless platforms. In this episode, we demystify these infrastructure models from a security analyst’s perspective.…
Domain 1 · Security Operations
Networks are the circulatory system of any digital environment, and securing them is a fundamental responsibility of the cyber analyst.…
Domain 1 · Security Operations
Authentication and authorization form the frontline of defense in every digital environment. In this episode, we explore key identity and access management (IAM) concepts including multifactor authentication (MFA), single sign-on (SSO), and federated identity systems.…
Domain 1 · Security Operations
Encryption plays a dual role in cybersecurity—protecting data confidentiality and creating blind spots in visibility.…
Domain 1 · Security Operations
Protecting sensitive data is one of the most urgent and regulated responsibilities in cybersecurity.…
Domain 1 · Security Operations
Your network is constantly broadcasting signals—some of them benign, some of them suspicious. In this episode, we examine network-level indicators that can reveal malicious activity in progress.…
Domain 1 · Security Operations
While the network tells you what’s coming and going, the host shows you what’s actually happening. In this episode, we explore host-level indicators of compromise—from CPU spikes and unauthorized software to abnormal OS behavior and registry anomalies.…
Domain 1 · Security Operations
Applications are often targeted directly by attackers—or exploited indirectly through user interaction.…
Domain 1 · Security Operations
Not all threats come from code—many come from people. This episode explores how attackers use social engineering tactics to bypass technical defenses, trick users, and gain footholds in environments.…
Domain 1 · Security Operations
Being a strong analyst means being comfortable working with packets, flows, and raw network data. In this episode, we explore the tools analysts use for network capture and traffic inspection, including Wireshark and tcpdump.…
Domain 1 · Security Operations
Security Information and Event Management (SIEM) systems are the heart of modern detection and alerting.…
Domain 1 · Security Operations
When malware strikes or an insider behaves maliciously, the endpoint is where the evidence lives.…
Domain 1 · Security Operations
DNS and IP addresses may seem simple at first glance, but they’re powerful resources for cyber defense—if you know how to use them.…
Domain 1 · Security Operations
Some threats are obvious in logs—others hide in files. In this episode, we introduce static file analysis tools and techniques that allow analysts to inspect suspicious files without executing them.…
Domain 1 · Security Operations
When static analysis doesn’t provide clear answers, analysts turn to sandboxing—isolated environments where suspicious files can be safely executed and observed.…
Domain 1 · Security Operations
Detecting threats isn’t just about having the right tools—it’s about applying the right techniques.…
Domain 1 · Security Operations
Threat actors often reuse specific commands, tactics, and patterns of behavior—and analysts learn to recognize those patterns quickly.…
Domain 1 · Security Operations
Sometimes a single command is all it takes to compromise a system—but recognizing the danger isn’t always easy. This episode focuses on how to interpret suspicious command-line activity and identify intent from syntax.…
Domain 1 · Security Operations
Phishing remains one of the most common and effective attack vectors—and analysts are often the last line of defense. In this episode, we walk through how to analyze suspicious emails, focusing on headers, sender behavior, and embedded links.…
Domain 1 · Security Operations
When a file changes unexpectedly, something important may have happened—and hashing is one of the best tools we have to track it.…
Domain 1 · Security Operations
Attackers often succeed not because they're invisible, but because they mimic normal user behavior—until they don’t. In this episode, we explore how user and entity behavior analytics (UEBA) help security analysts detect when users start acting outside of their established patterns.…
Domain 1 · Security Operations
Not all threats require a human response—and not all analysis can scale without scripting. In this episode, we dive into the scripting and automation fundamentals analysts need to understand for CySA+ and real-world workflows.…
Domain 1 · Security Operations
Understanding the adversary is the first step to anticipating their next move.…
Domain 1 · Security Operations
Some of the most damaging threats come from within—or through trusted partners. In this episode, we explore the two primary forms of insider threats: intentional actors who sabotage or steal for personal gain, and unintentional insiders whose negligence leads to exposure.…
Domain 1 · Security Operations
All threat intelligence is not created equal. In this episode, we explore how analysts evaluate the reliability of threat intelligence based on confidence levels—specifically timeliness, relevancy, and accuracy.…
Domain 1 · Security Operations
Not all threat intelligence comes with a price tag. In this episode, we explore the value and limitations of open source intelligence (OSINT) in cybersecurity operations.…
Domain 1 · Security Operations
Some of the most actionable threat intelligence is found behind closed doors. In this episode, we examine closed source threat intel—feeds and services provided by vendors, threat intelligence platforms, and information-sharing communities like ISACs.…
Domain 2 · Vulnerability Management
Threat intelligence is more than just information—it’s fuel for proactive defense. In this episode, we show how threat intel informs and enhances nearly every security function: from incident response and vulnerability management to engineering, detection, and monitoring.…
Domain 2 · Vulnerability Management
Threat hunting begins where automation ends. In this episode, we break down the lifecycle of Indicators of Compromise (IoCs)—how they are discovered, validated, and applied across tools and teams.…
Domain 2 · Vulnerability Management
Hunting threats means knowing where to look—and what to expect. In this episode, we identify the key focus areas for threat hunting operations, including misconfigured systems, isolated or high-value network segments, and business-critical applications.…
Domain 2 · Vulnerability Management
Consistency is key in security operations, especially when teams are responding to high volumes of alerts under time pressure. In this episode, we dive into the benefits of standardizing and automating security processes.…
Domain 2 · Vulnerability Management
Security Orchestration, Automation, and Response (SOAR) platforms help security teams move faster and more intelligently.…
Domain 2 · Vulnerability Management
Modern security platforms rarely operate in silos. In this episode, we explore how APIs, webhooks, and plugins allow your tools to communicate—enabling integrations that speed up investigation, automate response, and support real-time correlation.…
Domain 2 · Vulnerability Management
In complex environments, visibility is everything. But when your tools are spread across different dashboards and platforms, critical context can be lost.…
Domain 2 · Vulnerability Management
Welcome to Domain 2: Vulnerability Management. In this foundational episode, we set the stage for everything you’ll learn in the coming sessions—from scanning tools and techniques to validation, prioritization, and secure development practices.…
Domain 2 · Vulnerability Management
Before you can scan for vulnerabilities, you need to know what assets you’re protecting. In this episode, we focus on the first step of the vulnerability management lifecycle: asset discovery.…
Domain 2 · Vulnerability Management
Not all scans are created equal. In this episode, we explore the many considerations that go into planning and executing a vulnerability scan without disrupting business operations.…
Domain 2 · Vulnerability Management
Where you scan from is just as important as what you’re scanning. This episode breaks down the difference between internal and external vulnerability scans—what each one reveals, why both are necessary, and how attackers exploit gaps between them.…
Domain 2 · Vulnerability Management
Should you deploy agents on every device, or scan remotely without them? In this episode, we compare agent-based and agentless vulnerability scanning approaches and explore their respective strengths, limitations, and use cases.…
Domain 2 · Vulnerability Management
Credentials can change everything. In this episode, we explore the differences between credentialed and non-credentialed scans—and why access matters when identifying vulnerabilities accurately.…
Domain 2 · Vulnerability Management
Not all scanning involves direct interaction. In this episode, we explore the differences between passive and active vulnerability detection techniques.…
Domain 2 · Vulnerability Management
Some vulnerabilities are embedded in code—others appear only at runtime. In this episode, we unpack the distinction between static and dynamic vulnerability analysis.…
Domain 2 · Vulnerability Management
Operational technology (OT) environments—such as industrial control systems (ICS) and SCADA platforms—pose unique challenges for vulnerability management.…
Domain 2 · Vulnerability Management
Before you can identify deviations, you need a baseline. This episode focuses on how security baseline scans compare systems and configurations against established security policies and industry benchmarks.…
Domain 2 · Vulnerability Management
Many vulnerability scanning strategies are guided by established frameworks. In this episode, we break down the most widely recognized standards referenced throughout the CySA+ exam and in real-world practice.…
Domain 2 · Vulnerability Management
Understanding your network begins with visibility—and that visibility is powered by scanning and mapping tools. In this episode, we introduce key network discovery tools such as Angry IP Scanner and Maltego.…
Domain 2 · Vulnerability Management
Web applications are among the most targeted assets in modern enterprises—and automated scanning tools are the first line of defense.…
Domain 2 · Vulnerability Management
At the heart of vulnerability management lies automated vulnerability scanners—and few are more widely used than Nessus and OpenVAS. In this episode, we break down how these scanners work, what they look for, and how analysts interpret their output.…
Domain 2 · Vulnerability Management
Not every vulnerability is easy to spot—some require stepping into the execution environment itself.…
Domain 2 · Vulnerability Management
Some tools do it all—and analysts rely on them for everything from scanning to exploitation to open-source intelligence gathering.…
Domain 2 · Vulnerability Management
The move to the cloud has redefined how organizations think about security—and how analysts perform assessments.…
Domain 2 · Vulnerability Management
Not all vulnerabilities are created equal—and CVSS helps quantify just how severe they are.…
Domain 2 · Vulnerability Management
Automated scanners are powerful—but they’re not perfect. In this episode, we explore the analyst’s role in validating scan results, filtering out false positives, and identifying dangerous false negatives.…
Domain 2 · Vulnerability Management
Sometimes the same vulnerability poses very different risks depending on the environment. This episode teaches you how to analyze vulnerabilities in context—a crucial CySA+ concept and a daily responsibility in the SOC.…
Domain 2 · Vulnerability Management
A vulnerability doesn’t become a threat until someone weaponizes it—and that’s when it becomes truly urgent. In this episode, we explore the concepts of exploitability and weaponization in depth.…
Domain 2 · Vulnerability Management
Every vulnerability exists in the context of what it could damage—and that’s where asset valuation comes in. In this episode, we explore how security analysts assess the value of an asset and how that valuation affects how quickly a vulnerability must be addressed.…
Domain 2 · Vulnerability Management
Cross-site scripting, or XSS, is one of the most common and dangerous web application vulnerabilities.…
Domain 2 · Vulnerability Management
When a program doesn’t control how much data it processes, memory can be overwritten—and attackers can take control. In this episode, we explore the mechanics and consequences of overflow vulnerabilities: buffer, heap, stack, and integer overflows.…
Domain 2 · Vulnerability Management
When attackers manipulate training data or trusted inputs, they can corrupt the very systems meant to defend against them.…
Domain 2 · Vulnerability Management
Access control determines who can do what—and when it breaks, attackers often find a clear path in. In this episode, we take a deep dive into broken access control vulnerabilities, one of the most serious and widespread categories in application security.…
Domain 3 · Incident Response Management
When encryption fails, the consequences can be catastrophic. In this episode, we explore cryptographic failures—formerly called "Sensitive Data Exposure" in the OWASP Top Ten—and why they continue to affect even high-profile organizations.…
Domain 3 · Incident Response Management
Injection vulnerabilities have been on the OWASP Top Ten for years—and for good reason. In this episode, we explain how SQL, command-line, and LDAP injection flaws allow attackers to manipulate input to execute unintended commands or access unauthorized data.…
Domain 3 · Incident Response Management
In this episode, we examine Cross-Site Request Forgery, or CSRF—a vulnerability that tricks authenticated users into executing unwanted actions on a web application.…
Domain 3 · Incident Response Management
When input isn’t properly restricted, users can end up accessing far more than intended. In this episode, we break down directory traversal vulnerabilities—flaws that allow attackers to manipulate file paths and access sensitive files or directories outside of the intended web root.…
Domain 3 · Incident Response Management
Not all vulnerabilities are bugs—some are architectural. In this episode, we explore the concept of insecure design, a growing concern recognized in recent OWASP rankings.…
Domain 3 · Incident Response Management
Even the strongest tools can be rendered useless by poor configuration.…
Domain 3 · Incident Response Management
Running outdated software isn't just inconvenient—it’s dangerous. In this episode, we explore the risks posed by end-of-life (EOL) systems and unsupported components, which often lack vendor patches, security updates, or compatibility with modern security tools.…
Domain 3 · Incident Response Management
If attackers can bypass your login system, the rest of your defenses may not matter. In this episode, we explore identification and authentication failures such as broken login flows, weak password policies, exposed session tokens, and improper use of multifactor authentication (MFA).…
Domain 3 · Incident Response Management
Some of the most dangerous requests come from inside the house. In this episode, we unpack Server-Side Request Forgery (SSRF), a vulnerability that allows attackers to trick a server into sending requests to internal services, external endpoints, or cloud metadata APIs.…
Domain 3 · Incident Response Management
Few vulnerabilities are as critical—or as devastating—as remote code execution. In this episode, we explore how RCE vulnerabilities allow attackers to run arbitrary code on target systems, often with high privileges and zero user interaction.…
Domain 3 · Incident Response Management
Attackers often start with limited access—but they rarely stay there. In this episode, we break down privilege escalation vulnerabilities, which allow attackers to move from low-level accounts to administrative or root-level control.…
Domain 3 · Incident Response Management
Sometimes attackers don’t need to upload malicious files—they just need to include them.…
Domain 3 · Incident Response Management
What happens when you can’t fix a vulnerability directly? In this episode, we introduce the concept of compensating controls—alternative safeguards put in place to reduce risk when a vulnerability cannot be immediately remediated.…
Domain 3 · Incident Response Management
Not all security controls serve the same function. In this episode, we explain the various types of controls used across cybersecurity programs and why it’s important to understand their classification.…
Domain 3 · Incident Response Management
Vulnerabilities don’t just exist—they persist, especially when patch and configuration management processes are weak.…
Domain 3 · Incident Response Management
Security teams can’t just apply patches whenever they want—especially in enterprise environments where uptime and availability are critical.…
Domain 3 · Incident Response Management
Sometimes a vulnerability can’t be fixed—at least, not right away. In this episode, we explain how analysts and risk managers document and process exceptions: formal records of accepted risk where vulnerabilities are not remediated within standard timelines.…
Domain 3 · Incident Response Management
Effective vulnerability management is built on sound risk management principles. In this episode, we explore the four classic risk response strategies—accept, avoid, transfer, and mitigate—and how they apply to real-world cybersecurity scenarios.…
Domain 3 · Incident Response Management
Cybersecurity doesn’t happen in a vacuum—it happens under governance. In this episode, we explain how policies, governance structures, and service-level objectives (SLOs) shape the work of the security analyst.…
Domain 3 · Incident Response Management
In a world where thousands of vulnerabilities exist, how do you decide which to address first? In this episode, we break down the art and science of vulnerability prioritization—how analysts combine CVSS scores, asset value, exploitability, and business context to triage effectively.…
Domain 3 · Incident Response Management
You can't protect what you can't see. In this episode, we explore the evolving discipline of attack surface management (ASM)—a proactive process that helps security teams identify, map, and reduce the ways in which an attacker could compromise an organization.…
Domain 3 · Incident Response Management
You don’t need to be a developer to influence secure code—but you do need to understand what secure coding looks like.…
Domain 3 · Incident Response Management
Security that begins in production is already behind schedule.…
Domain 3 · Incident Response Management
What if you could anticipate the attacker’s plan before they even launch it? In this episode, we introduce threat modeling as a method for identifying and prioritizing potential threats based on how applications and systems are designed.…
Domain 3 · Incident Response Management
Before moving forward, it’s time to reflect. In this comprehensive recap, we walk through the critical knowledge areas covered in Domain 2: Vulnerability Management.…
Domain 4 · Reporting and Communication
Welcome to Domain 3 of the CySA+ PrepCast, where we move from prevention and vulnerability management into response and containment. In this episode, we provide an overview of what incident response means in modern organizations and how it’s structured in the CySA+ exam.…
Domain 4 · Reporting and Communication
To stop an attack, you must understand its progression. In this episode, we explore the Lockheed Martin Cyber Kill Chain—a widely used framework that maps the stages of a cyberattack from initial reconnaissance through delivery, exploitation, command and control, and beyond.…
Domain 4 · Reporting and Communication
What happens when we move beyond events and look at the relationships between adversaries, capabilities, victims, and infrastructure?…
Domain 4 · Reporting and Communication
In this episode, we explore the MITRE ATT&CK Framework—a living matrix of adversary behaviors that has transformed how cybersecurity professionals track and respond to attacks.…
Domain 4 · Reporting and Communication
The OSSTMM is often overlooked—but it provides a rigorous, standards-based approach to security testing that aligns with the goals of CySA+ and many compliance frameworks.…
Domain 4 · Reporting and Communication
Detecting an attack starts with recognizing the signs. In this episode, we explore Indicators of Compromise (IoCs)—artifacts that suggest an organization may have been breached or is under active threat.…
Domain 4 · Reporting and Communication
Once an incident is detected, preserving evidence becomes a top priority. In this episode, we walk through the evidence acquisition process—from initial identification to collection, storage, and transfer.…
Domain 4 · Reporting and Communication
Raw data becomes actionable intelligence when it’s properly analyzed.…
Domain 4 · Reporting and Communication
Detecting an incident is only the beginning. In this episode, we examine the containment, eradication, and recovery phases of incident response—what they are, how they differ, and how they build upon one another to restore a secure state.…
Domain 4 · Reporting and Communication
The best incident response doesn’t start with detection—it starts with preparation. In this episode, we walk through the preparation phase of the incident response lifecycle, focusing on how organizations create, document, and test their response plans.…
Domain 4 · Reporting and Communication
Once the smoke clears, the real improvement begins. In this episode, we explore the post-incident phase of the incident response lifecycle.…
Domain 4 · Reporting and Communication
Welcome to Domain 4 of the CySA+ PrepCast. In this episode, we introduce the principles of reporting and communication—critical soft skills that define how technical findings are translated into business decisions.…
Domain 4 · Reporting and Communication
In this episode, we break down the core components of a vulnerability management report. You’ll learn how to organize and present data on discovered vulnerabilities, affected assets, associated risk scores, remediation efforts, recurrence frequency, and mitigation timelines.…
Domain 4 · Reporting and Communication
Security isn't just about stopping threats—it's also about proving due diligence. In this episode, we explore how security teams create and interpret compliance reports aligned with frameworks like PCI DSS, HIPAA, NIST 800-53, and ISO 27001.…
Domain 4 · Reporting and Communication
Once vulnerabilities are identified, the work isn’t done—it’s just beginning. In this episode, we explore how analysts develop and communicate action plans for addressing discovered risks.…
Domain 4 · Reporting and Communication
Even when vulnerabilities are known and documented, remediation doesn’t always move forward. In this episode, we examine the most common inhibitors to remediation—technical, procedural, and political obstacles that delay or prevent action.…
Domain 4 · Reporting and Communication
You can’t improve what you don’t measure. In this episode, we focus on key performance indicators (KPIs) and metrics used to evaluate the effectiveness of vulnerability management programs.…
Domain 4 · Reporting and Communication
Not all stakeholders need the same level of technical detail—but all of them need accurate, timely, and actionable reporting. In this episode, we explore how analysts identify and tailor communication for different stakeholder groups during the vulnerability management process.…
Domain 4 · Reporting and Communication
During an incident, clear and timely communication becomes a matter of urgency—not just best practice. In this episode, we cover how security analysts coordinate communication across teams and leadership tiers when responding to security events.…
Domain 4 · Reporting and Communication
Not every alert becomes an incident—but when one does, it needs to be declared formally and escalated swiftly.…
Domain 4 · Reporting and Communication
When the incident is over, the reporting begins. In this episode, we explore how security analysts write effective incident response reports that document what happened, how it was discovered, what actions were taken, and what outcomes resulted.…
Domain 4 · Reporting and Communication
Communication during a security incident isn't just internal—it can affect your company’s reputation, legal standing, and customer trust.…
Domain 4 · Reporting and Communication
Sometimes the most difficult part of a security incident isn’t stopping the threat—it’s explaining what happened to the people affected. In this episode, we explore how organizations communicate with customers, partners, and the media during and after an incident.…
Domain 4 · Reporting and Communication
When a breach crosses a legal threshold, reporting to regulators or law enforcement may be required. In this episode, we examine the processes and obligations associated with regulatory reporting under frameworks like GDPR, HIPAA, PCI DSS, and state-level data breach laws.…
Domain 4 · Reporting and Communication
Every incident response process must end with two critical questions: What went wrong? And how do we prevent it next time?…
Try another term or clear one of the filters.
A Practical Study Routine
Use the free audio course during a commute, walk, workout, or focused study session.
Use the study guide to organize the material, annotate key ideas, and build a reference you can return to.
Use the flashcards book to practice active recall and quickly revisit weak areas.
Related Magazine Features
Related Cyber Wiki
A defensive guide to the Enterprise ATT&CK campaign record C0028, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2015 campaign that disrupted Ukrainian electric-power substations using BlackEnergy and KillDisk.
ATT&CK Campaign AnalysisA defensive guide to the Enterprise ATT&CK campaign record C0025, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2016 campaign that disrupted Ukrainian electric-power distribution using Industroyer.
ATT&CK Campaign AnalysisA defensive guide to the Enterprise ATT&CK campaign record C0034, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2022 campaign against a Ukrainian electric utility that combined malware and living-off-the-land behavior to issue unauthorized SCADA commands.
ATT&CK Campaign AnalysisA defensive guide to the Enterprise ATT&CK campaign record C0063, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing destructive December 2025 attacks against Polish energy infrastructure involving Windows and PowerShell wipers.
ATT&CK Campaign AnalysisA defensive guide to the Enterprise ATT&CK campaign record C0057, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a cascading supply-chain compromise that moved from a trojanized trading application into 3CX build environments.
ATT&CK Software AnalysisA defensive guide to the Enterprise ATT&CK software record S0677, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a PowerShell framework used to administer, enumerate, and test Azure Active Directory environments.
