Study Guide
CompTIA Security+ Study Guide
Use the companion study guide to organize the material, compare important concepts, annotate key ideas, and build a written reference for review.
CompTIA · Free, ad-free audio course
CompTIA Security+
A complete, audio-first Security+ study system with focused lessons, companion learning resources, and an episode-by-episode directory.
Companion Books
Study with the audio course, then reinforce it in print.
The study guide helps you organize and revisit the material. The flashcards book adds active recall and rapid review across the course objectives.
Flashcards Book
CompTIA Security+ Flashcards
Use the flashcards book for active recall, terminology checks, rapid review, and repeated practice across the course objectives.
Complete Lesson Directory
Choose the exact subject you want to study.
Search by topic or narrow the directory by exam domain. Courses with multiple editions are organized below so every season remains easy to find. Each lesson includes its own audio player, full description, transcript when available, and previous-or-next navigation.
339 lessons available
Season 2 · Current editionCurrent course
S02E01Transcript
Getting Started
SY0-801 at a Glance: What Changed from Security+ 701 (Intro)
Listen to SY0-801 at a Glance: What Changed from Security+ 701 (Intro) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E02Transcript
Getting Started
How to Study with an Audio-First Security+ Plan (Intro)
Listen to How to Study with an Audio-First Security+ Plan (Intro) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E03Transcript
Domain 1 · General Security Concepts
Defense in Depth: Layering Controls So One Failure Doesn’t Sink You (1.1)
Listen to Defense in Depth: Layering Controls So One Failure Doesn’t Sink You (1.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E04Transcript
Domain 1 · General Security Concepts
CIA and AAA: The Core Security Models (1.1)
Listen to CIA and AAA: The Core Security Models (1.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E05Transcript
Domain 1 · General Security Concepts
Non-Repudiation, Least Privilege, and Trust Decisions (1.1)
Listen to Non-Repudiation, Least Privilege, and Trust Decisions (1.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E06Transcript
Domain 1 · General Security Concepts
Zero Trust Principles: Never Trust, Always Verify (1.1)
Listen to Zero Trust Principles: Never Trust, Always Verify (1.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E07Transcript
Domain 1 · General Security Concepts
Control Categories and Control Types (1.1)
Listen to Control Categories and Control Types (1.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E08Transcript
Domain 1 · General Security Concepts
Change Management: Why Security Breaks During Normal Updates (1.2)
Listen to Change Management: Why Security Breaks During Normal Updates (1.2) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E09Transcript
Domain 1 · General Security Concepts
CABs, Approvals, Ownership, and Stakeholders (1.2)
Listen to CABs, Approvals, Ownership, and Stakeholders (1.2) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E10Transcript
Domain 1 · General Security Concepts
Impact Analysis, Test Results, and Maintenance Windows (1.2)
Listen to Impact Analysis, Test Results, and Maintenance Windows (1.2) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E11Transcript
Domain 1 · General Security Concepts
Backout Plans vs. Fail Forward: Recovering from Bad Changes (1.2)
Listen to Backout Plans vs. Fail Forward: Recovering from Bad Changes (1.2) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E12Transcript
Domain 1 · General Security Concepts
Technical and Documentation Impacts of Change (1.2)
Listen to Technical and Documentation Impacts of Change (1.2) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E13Transcript
Domain 1 · General Security Concepts
PKI Foundations: Public Keys, Private Keys, and Trust (1.3)
Listen to PKI Foundations: Public Keys, Private Keys, and Trust (1.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E14Transcript
Domain 1 · General Security Concepts
Certificates and Certificate Authorities (1.3)
Listen to Certificates and Certificate Authorities (1.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E15Transcript
Domain 1 · General Security Concepts
Revocation and Validation: CRLs, OCSP, and Trust Problems (1.3)
Listen to Revocation and Validation: CRLs, OCSP, and Trust Problems (1.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E16Transcript
Domain 1 · General Security Concepts
CSRs, Wildcards, Root of Trust, and Key Escrow (1.3)
Listen to CSRs, Wildcards, Root of Trust, and Key Escrow (1.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E17Transcript
Domain 1 · General Security Concepts
Symmetric vs. Asymmetric Encryption (1.3)
Listen to Symmetric vs. Asymmetric Encryption (1.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E18Transcript
Domain 1 · General Security Concepts
Encryption Levels: Disk, File, Volume, Database, and Record (1.3)
Listen to Encryption Levels: Disk, File, Volume, Database, and Record (1.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E19Transcript
Domain 1 · General Security Concepts
Key Exchange, Algorithms, Key Length, and Protocol Selection (1.3)
Listen to Key Exchange, Algorithms, Key Length, and Protocol Selection (1.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E20Transcript
Domain 1 · General Security Concepts
Hashing, Salting, Digital Signatures, Obfuscation, and Crypto Tools (1.3)
Listen to Hashing, Salting, Digital Signatures, Obfuscation, and Crypto Tools (1.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E21Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Threats vs. Vulnerabilities: Likelihood, Impact, and Life Cycle (2.1)
Listen to Threats vs. Vulnerabilities: Likelihood, Impact, and Life Cycle (2.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E22Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Threat Feeds and Intelligence Sources (2.1)
Listen to Threat Feeds and Intelligence Sources (2.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E23Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Vulnerability Scoring: CVSS, CVEs, and Prioritization (2.1)
Listen to Vulnerability Scoring: CVSS, CVEs, and Prioritization (2.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E24Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Vulnerability Types and Risk-Based Decisions (2.1)
Listen to Vulnerability Types and Risk-Based Decisions (2.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E25Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Threat Actors: Organized Crime, Terrorists, Hacktivists, and Insiders (2.2)
Listen to Threat Actors: Organized Crime, Terrorists, Hacktivists, and Insiders (2.2) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E26Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
State-Sponsored, Competitors, Accidental, and Unskilled Attackers (2.2)
Listen to State-Sponsored, Competitors, Accidental, and Unskilled Attackers (2.2) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E27Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Motivations and Capabilities: Money, Espionage, Ideology, and Extortion (2.2)
Listen to Motivations and Capabilities: Money, Espionage, Ideology, and Extortion (2.2) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E28Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
APTs and the Modern Threat Vector Map (2.3)
Listen to APTs and the Modern Threat Vector Map (2.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E29Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Message-Based Attacks: Email, SMS, RCS, IM, and Collaboration Tools (2.3)
Listen to Message-Based Attacks: Email, SMS, RCS, IM, and Collaboration Tools (2.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E30Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Image and Attachment Attacks: QR Codes, CAPTCHA Abuse, Macros, PDFs, and RTF (2.3)
Listen to Image and Attachment Attacks: QR Codes, CAPTCHA Abuse, Macros, PDFs, and RTF (2.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E31Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Browser-Based Attacks: Extensions, JavaScript, Cookies, Password Managers, and Session Tokens (2.3)
Listen to Browser-Based Attacks: Extensions, JavaScript, Cookies, Password Managers, and Session Tokens (2.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E32Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Network, Remote Access, and Endpoint Threat Sources (2.3)
Listen to Network, Remote Access, and Endpoint Threat Sources (2.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E33Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Supply Chain, SaaS, USB, Human, IoT, OT, Physical, Bluetooth, RF, and NFC Threats (2.3)
Listen to Supply Chain, SaaS, USB, Human, IoT, OT, Physical, Bluetooth, RF, and NFC Threats (2.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E34Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Unsupported, Unpatched, Obsolete, and Unmanaged Systems (2.4)
Listen to Unsupported, Unpatched, Obsolete, and Unmanaged Systems (2.4) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E35Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Ports, Services, Applications, Race Conditions, and Malicious Updates (2.4)
Listen to Ports, Services, Applications, Race Conditions, and Malicious Updates (2.4) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E36Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Code Weaknesses: Hardcoded Secrets and Unsafe Exception Handling (2.4)
Listen to Code Weaknesses: Hardcoded Secrets and Unsafe Exception Handling (2.4) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E37Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Stale Credentials, Rogue Devices, Shadow IT, Wireless, Mobile, and Identity Provider Risks (2.4)
Listen to Stale Credentials, Rogue Devices, Shadow IT, Wireless, Mobile, and Identity Provider Risks (2.4) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E38Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
LLMs, Misconfigurations, Public Repositories, and Public Object Storage (2.4)
Listen to LLMs, Misconfigurations, Public Repositories, and Public Object Storage (2.4) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E39Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Malware Indicators: Ransomware, Trojans, Worms, Spyware, and Fileless Malware (2.5)
Listen to Malware Indicators: Ransomware, Trojans, Worms, Spyware, and Fileless Malware (2.5) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E40Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Physical and Network Attack Indicators (2.5)
Listen to Physical and Network Attack Indicators (2.5) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E41Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Social Engineering Indicators: Smishing, Vishing, Whaling, Quishing, and Deepfakes (2.5)
Listen to Social Engineering Indicators: Smishing, Vishing, Whaling, Quishing, and Deepfakes (2.5) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E42Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Indicators of Compromise: Hashes, Domains, Timestamps, Log Manipulation, and Impossible Travel (2.5)
Listen to Indicators of Compromise: Hashes, Domains, Timestamps, Log Manipulation, and Impossible Travel (2.5) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E43Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Application Attacks: Injection, Buffer Overflow, Replay, Privilege Escalation, Forgery, and Traversal (2.5)
Listen to Application Attacks: Injection, Buffer Overflow, Replay, Privilege Escalation, Forgery, and Traversal (2.5) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E44Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Credential Attacks: Password Spraying, Brute Force, User Enumeration, and MFA Bypass (2.5)
Listen to Credential Attacks: Password Spraying, Brute Force, User Enumeration, and MFA Bypass (2.5) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E45Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
AI Threats: Model Manipulation, Poisoning, and Prompt Injection (2.6)
Listen to AI Threats: Model Manipulation, Poisoning, and Prompt Injection (2.6) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E46Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
AI Failure Risks: Data Loss, Bias, Explainability, Hallucinations, and Ethics (2.6)
Listen to AI Failure Risks: Data Loss, Bias, Explainability, Hallucinations, and Ethics (2.6) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E47Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
AI Abuse: Jailbreaking, Evasion, Privacy, Session Hijacking, and Code Execution (2.6)
Listen to AI Abuse: Jailbreaking, Evasion, Privacy, Session Hijacking, and Code Execution (2.6) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E48Transcript
Domain 3 · Security Architecture
Architecture Models: Cloud, On-Premises, Hybrid, Private, Public, and Community Cloud (3.1)
Listen to Architecture Models: Cloud, On-Premises, Hybrid, Private, Public, and Community Cloud (3.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E49Transcript
Domain 3 · Security Architecture
Serverless, Multicloud, and Infrastructure as Code (3.1)
Listen to Serverless, Multicloud, and Infrastructure as Code (3.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E50Transcript
Domain 3 · Security Architecture
OT, Air-Gapped Networks, Microservices, and Segmentation (3.1)
Listen to OT, Air-Gapped Networks, Microservices, and Segmentation (3.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E51Transcript
Domain 3 · Security Architecture
Technical Architecture Tradeoffs: Availability, Resilience, Open Source, and Usability (3.1)
Listen to Technical Architecture Tradeoffs: Availability, Resilience, Open Source, and Usability (3.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E52Transcript
Domain 3 · Security Architecture
Business Architecture Tradeoffs: Data Sovereignty, Classification, Cost, and Ownership (3.1)
Listen to Business Architecture Tradeoffs: Data Sovereignty, Classification, Cost, and Ownership (3.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E53Transcript
Domain 3 · Security Architecture
Scalability, Environmental Requirements, Risk, and Recovery Decisions (3.1)
Listen to Scalability, Environmental Requirements, Risk, and Recovery Decisions (3.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E54Transcript
Domain 3 · Security Architecture
Infrastructure Protection: Device Placement, Security Zones, Attack Surface, and Diversity (3.2)
Listen to Infrastructure Protection: Device Placement, Security Zones, Attack Surface, and Diversity (3.2) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E55Transcript
Domain 3 · Security Architecture
Zero Trust Architecture: User, Device, and Application Decisions (3.2)
Listen to Zero Trust Architecture: User, Device, and Application Decisions (3.2) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E56Transcript
Domain 3 · Security Architecture
Secure Access: VPNs, Remote Access, Tunneling, and Encrypted Messaging (3.2)
Listen to Secure Access: VPNs, Remote Access, Tunneling, and Encrypted Messaging (3.2) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E57Transcript
Domain 3 · Security Architecture
Out-of-Band Management, File Transfer, and Security Service Edge (3.2)
Listen to Out-of-Band Management, File Transfer, and Security Service Edge (3.2) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E58Transcript
Domain 3 · Security Architecture
Identity Architecture: gMSAs, Least Privilege Accounts, Privilege Creep, and Failure Modes (3.2)
Listen to Identity Architecture: gMSAs, Least Privilege Accounts, Privilege Creep, and Failure Modes (3.2) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E59Transcript
Domain 3 · Security Architecture
Data Types and States: Structured, Unstructured, At Rest, In Use, and In Transit (3.3)
Listen to Data Types and States: Structured, Unstructured, At Rest, In Use, and In Transit (3.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E60Transcript
Domain 3 · Security Architecture
Data Classification: Public to Top Secret, Sensitive to Restricted (3.3)
Listen to Data Classification: Public to Top Secret, Sensitive to Restricted (3.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E61Transcript
Domain 3 · Security Architecture
Securing Data: Masking, Hashing, Filtering, Tokenization, Encryption, and Obfuscation (3.3)
Listen to Securing Data: Masking, Hashing, Filtering, Tokenization, Encryption, and Obfuscation (3.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E62Transcript
Domain 3 · Security Architecture
Data Protection Roles: Owner, Custodian, Steward, Operator, Controller, and Subprocessor (3.3)
Listen to Data Protection Roles: Owner, Custodian, Steward, Operator, Controller, and Subprocessor (3.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E63Transcript
Domain 3 · Security Architecture
Data Handling, Geofencing, Lifecycle, Retention, Disposal, and Compliance (3.3)
Listen to Data Handling, Geofencing, Lifecycle, Retention, Disposal, and Compliance (3.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E64Transcript
Domain 3 · Security Architecture
Resilience Sites: Hot, Warm, Cold, and Environmental Planning (3.4)
Listen to Resilience Sites: Hot, Warm, Cold, and Environmental Planning (3.4) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E65Transcript
Domain 3 · Security Architecture
Platform Diversity, Load Balancing, Clustering, Autoscaling, and High Availability (3.4)
Listen to Platform Diversity, Load Balancing, Clustering, Autoscaling, and High Availability (3.4) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E66Transcript
Domain 3 · Security Architecture
Power, Storage, Backups, Immutability, and Restoration Testing (3.4)
Listen to Power, Storage, Backups, Immutability, and Restoration Testing (3.4) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E67Transcript
Domain 3 · Security Architecture
Disaster Recovery and Business Continuity: Failover, Simulation, Parallel Processing, and Capacity Planning (3.4)
Listen to Disaster Recovery and Business Continuity: Failover, Simulation, Parallel Processing, and Capacity Planning (3.4) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E68Transcript
Domain 3 · Security Architecture
Recovery Metrics: RTO, RPO, MTTR, and MTBF (3.4)
Listen to Recovery Metrics: RTO, RPO, MTTR, and MTBF (3.4) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E69Transcript
Domain 4 · Security Operations
Mitigating Controls Overview: Segmentation, Access Control, Hardening, and Sandboxing (4.1)
Listen to Mitigating Controls Overview: Segmentation, Access Control, Hardening, and Sandboxing (4.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E70Transcript
Domain 4 · Security Operations
Deception and Disruption: Honeypots, Honeynets, Honeyfiles, Honeytokens, and Canary Accounts (4.1)
Listen to Deception and Disruption: Honeypots, Honeynets, Honeyfiles, Honeytokens, and Canary Accounts (4.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E71Transcript
Domain 4 · Security Operations
Monitoring, MDM, Allow Lists, Block Lists, IDS, IPS, and WIPS (4.1)
Listen to Monitoring, MDM, Allow Lists, Block Lists, IDS, IPS, and WIPS (4.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E72Transcript
Domain 4 · Security Operations
Firewalls and Filtering: WAF, UTM, Layer 4/Layer 7, Rate Limiting, and DLP (4.1)
Listen to Firewalls and Filtering: WAF, UTM, Layer 4/Layer 7, Rate Limiting, and DLP (4.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E73Transcript
Domain 4 · Security Operations
Endpoint and Network Access Control: EDR, XDR, Antivirus, Captive Portals, 802.1X, and Posture (4.1)
Listen to Endpoint and Network Access Control: EDR, XDR, Antivirus, Captive Portals, 802.1X, and Posture (4.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E74Transcript
Domain 4 · Security Operations
Repository, Application, and Code Security: Secrets Scanning, Input Validation, Secure Cookies, Static Analysis, and Code Signing (4.1)
Listen to Repository, Application, and Code Security: Secrets Scanning, Input Validation, Secure Cookies, Static Analysis, and Code Signing (4.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E75Transcript
Domain 4 · Security Operations
Email and OS Security: DMARC, SPF, DKIM, BIMI, Group Policy, and SELinux (4.1)
Listen to Email and OS Security: DMARC, SPF, DKIM, BIMI, Group Policy, and SELinux (4.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E76Transcript
Domain 4 · Security Operations
Asset Management: Hardware, Software, and Data Life Cycle (4.2)
Listen to Asset Management: Hardware, Software, and Data Life Cycle (4.2) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E77Transcript
Domain 4 · Security Operations
Planning, Procurement, Assignment, Tracking, Disposal, and Decommissioning (4.2)
Listen to Planning, Procurement, Assignment, Tracking, Disposal, and Decommissioning (4.2) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E78Transcript
Domain 4 · Security Operations
Vulnerability Management Overview: Scanning, IPAM, CSPM, and Source Code Review (4.3)
Listen to Vulnerability Management Overview: Scanning, IPAM, CSPM, and Source Code Review (4.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E79Transcript
Domain 4 · Security Operations
Prioritization: Severity, Business Impact, and Pen Test Report Review (4.3)
Listen to Prioritization: Severity, Business Impact, and Pen Test Report Review (4.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E80Transcript
Domain 4 · Security Operations
Remediation, Verification, and Internal Reporting (4.3)
Listen to Remediation, Verification, and Internal Reporting (4.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E81Transcript
Domain 4 · Security Operations
External Reporting: Bug Bounties and Responsible Disclosure (4.3)
Listen to External Reporting: Bug Bounties and Responsible Disclosure (4.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E82Transcript
Domain 4 · Security Operations
Monitoring Resources: Systems, Applications, Infrastructure, and Log Aggregation (4.4)
Listen to Monitoring Resources: Systems, Applications, Infrastructure, and Log Aggregation (4.4) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E83Transcript
Domain 4 · Security Operations
Alerting Operations: Scanning, Archiving, Reporting, and Alert Tuning (4.4)
Listen to Alerting Operations: Scanning, Archiving, Reporting, and Alert Tuning (4.4) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E84Transcript
Domain 4 · Security Operations
Monitoring Tools: SIEM, DLP, Vulnerability Scanners, Orchestration, and Packet Analyzers (4.4)
Listen to Monitoring Tools: SIEM, DLP, Vulnerability Scanners, Orchestration, and Packet Analyzers (4.4) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E85Transcript
Domain 4 · Security Operations
Monitoring Protocols and Data Flow: NetFlow, SNMP, Syslog, SCAP, Port Mirroring, and Dashboards (4.4)
Listen to Monitoring Protocols and Data Flow: NetFlow, SNMP, Syslog, SCAP, Port Mirroring, and Dashboards (4.4) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E86Transcript
Domain 4 · Security Operations
IAM Lifecycle: Provisioning, Deprovisioning, Permissions, and Identity Proofing (4.5)
Listen to IAM Lifecycle: Provisioning, Deprovisioning, Permissions, and Identity Proofing (4.5) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E87Transcript
Domain 4 · Security Operations
Federation and SSO: SAML, LDAP, and OAuth (4.5)
Listen to Federation and SSO: SAML, LDAP, and OAuth (4.5) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E88Transcript
Domain 4 · Security Operations
Account Types and Privilege Models: User, Privileged, Service, Third-Party, and Emergency Access (4.5)
Listen to Account Types and Privilege Models: User, Privileged, Service, Third-Party, and Emergency Access (4.5) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E89Transcript
Domain 4 · Security Operations
MFA: Tokens, Biometrics, OTPs, Backup Codes, and Bypass Risks (4.5)
Listen to MFA: Tokens, Biometrics, OTPs, Backup Codes, and Bypass Risks (4.5) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E90Transcript
Domain 4 · Security Operations
Access Models and Modern Authentication: JIT Access, Passkeys, Passwordless, and Credential Monitoring (4.5)
Listen to Access Models and Modern Authentication: JIT Access, Passkeys, Passwordless, and Credential Monitoring (4.5) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E91Transcript
Domain 4 · Security Operations
Automation Use Cases: Provisioning, Desired State, Anomaly Detection, and Ticketing (4.6)
Listen to Automation Use Cases: Provisioning, Desired State, Anomaly Detection, and Ticketing (4.6) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E92Transcript
Domain 4 · Security Operations
Automation Risks and Guardrails: Logic, Complexity, Financial Risk, and Process Risk (4.6)
Listen to Automation Risks and Guardrails: Logic, Complexity, Financial Risk, and Process Risk (4.6) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E93Transcript
Domain 4 · Security Operations
AI in SecOps: Agentic AI, Chatbots, Predictive Analysis, AI-Augmented Baselines, and CI/CD (4.6)
Listen to AI in SecOps: Agentic AI, Chatbots, Predictive Analysis, AI-Augmented Baselines, and CI/CD (4.6) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E94Transcript
Domain 4 · Security Operations
Incident Response Preparation: Training, Tabletop Exercises, Playbooks, Simulations, and Roles (4.7)
Listen to Incident Response Preparation: Training, Tabletop Exercises, Playbooks, Simulations, and Roles (4.7) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E95Transcript
Domain 4 · Security Operations
Identification and Investigation: Detection, Advisories, Threat Hunting, Forensics, and Chain of Custody (4.7)
Listen to Identification and Investigation: Detection, Advisories, Threat Hunting, Forensics, and Chain of Custody (4.7) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E96Transcript
Domain 4 · Security Operations
Containment Through Post-Incident: Isolation, Negotiation, Recovery, Reporting, Lessons Learned, and RCA (4.7)
Listen to Containment Through Post-Incident: Isolation, Negotiation, Recovery, Reporting, Lessons Learned, and RCA (4.7) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E97Transcript
Domain 4 · Security Operations
Investigation Data Types: Access, Device, Server, Application, Authentication, Communication, and Audit Logs (4.8)
Listen to Investigation Data Types: Access, Device, Server, Application, Authentication, Communication, and Audit Logs (4.8) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E98Transcript
Domain 4 · Security Operations
Investigation Sources: Vulnerability Scans, Automated Reports, NetFlow/IPFIX, Surveillance, and Packet Captures (4.8)
Listen to Investigation Sources: Vulnerability Scans, Automated Reports, NetFlow/IPFIX, Surveillance, and Packet Captures (4.8) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E99Transcript
Domain 4 · Security Operations
Evidence and Stakeholders: File Integrity, Memory Dumps, Bit Copies, Snapshots, HR, Legal, and Log Parsing (4.8)
Listen to Evidence and Stakeholders: File Integrity, Memory Dumps, Bit Copies, Snapshots, HR, Legal, and Log Parsing (4.8) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E100Transcript
Domain 5 · Security Program Management and Oversight
GRC Artifacts: Guidelines, Benchmarks, Advisories, Implementation Guides, and Reference Architectures (5.1)
Listen to GRC Artifacts: Guidelines, Benchmarks, Advisories, Implementation Guides, and Reference Architectures (5.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E101Transcript
Domain 5 · Security Program Management and Oversight
Standards and Procedures: Baselines, Passwords, Physical Security, RFCs, Encryption, SOPs, and Runbooks (5.1)
Listen to Standards and Procedures: Baselines, Passwords, Physical Security, RFCs, Encryption, SOPs, and Runbooks (5.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E102Transcript
Domain 5 · Security Program Management and Oversight
Plans and Policies: BCP, DRP, BYOD, AUP, Clean Desk, Incident Response, Data Retention, Access Control, and Privacy (5.1)
Listen to Plans and Policies: BCP, DRP, BYOD, AUP, Clean Desk, Incident Response, Data Retention, Access Control, and Privacy (5.1) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E103Transcript
Domain 5 · Security Program Management and Oversight
Risk Identification and Assessment: Assets, Stakeholders, Scoring, and Categorization (5.2)
Listen to Risk Identification and Assessment: Assets, Stakeholders, Scoring, and Categorization (5.2) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E104Transcript
Domain 5 · Security Program Management and Oversight
Risk Analysis and Registers: Impact, Likelihood, Owners, Current Mitigations, and Qualitative vs. Quantitative Risk (5.2)
Listen to Risk Analysis and Registers: Impact, Likelihood, Owners, Current Mitigations, and Qualitative vs. Quantitative Risk (5.2) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E105Transcript
Domain 5 · Security Program Management and Oversight
Risk Treatment and Business Impact: Transfer, Accept, Avoid, Mitigate, BIA, Appetite, Residual Risk, SLE, ALE, and ARO (5.2)
Listen to Risk Treatment and Business Impact: Transfer, Accept, Avoid, Mitigate, BIA, Appetite, Residual Risk, SLE, ALE, and ARO (5.2) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E106Transcript
Domain 5 · Security Program Management and Oversight
Third-Party Risk: Vendor Selection, RFP, RFI, RFQ, EOI, Due Diligence, and Conflicts (5.3)
Listen to Third-Party Risk: Vendor Selection, RFP, RFI, RFQ, EOI, Due Diligence, and Conflicts (5.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E107Transcript
Domain 5 · Security Program Management and Oversight
Agreements and Monitoring: SLA, SLO, MOU, MOA, NDA, MSA, SOW, and Right to Audit (5.3)
Listen to Agreements and Monitoring: SLA, SLO, MOU, MOA, NDA, MSA, SOW, and Right to Audit (5.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E108Transcript
Domain 5 · Security Program Management and Oversight
Vendor Constraints and Rules of Engagement: Jurisdiction, ROI, Lock-In, and Assurance Mechanisms (5.3)
Listen to Vendor Constraints and Rules of Engagement: Jurisdiction, ROI, Lock-In, and Assurance Mechanisms (5.3) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E109Transcript
Domain 5 · Security Program Management and Oversight
Compliance Training and Monitoring: Data Handling, AML/CTF, Anti-Bribery, and Attestations (5.4)
Listen to Compliance Training and Monitoring: Data Handling, AML/CTF, Anti-Bribery, and Attestations (5.4) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E110Transcript
Domain 5 · Security Program Management and Oversight
Non-Compliance, Privacy Rights, Legal Holds, Legal Orders, and Retention (5.4)
Listen to Non-Compliance, Privacy Rights, Legal Holds, Legal Orders, and Retention (5.4) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E111Transcript
Domain 5 · Security Program Management and Oversight
Audit Data Gathering: Sampling, Questionnaires, Interviews, Assertions, and Reference Sources (5.5)
Listen to Audit Data Gathering: Sampling, Questionnaires, Interviews, Assertions, and Reference Sources (5.5) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E112Transcript
Domain 5 · Security Program Management and Oversight
Audit Scope and Engagements: Charters, Gap Analysis, Internal Reviews, External Reviews, and Benchmarking (5.5)
Listen to Audit Scope and Engagements: Charters, Gap Analysis, Internal Reviews, External Reviews, and Benchmarking (5.5) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E113Transcript
Domain 5 · Security Program Management and Oversight
Penetration Testing, Reconnaissance, Frameworks, Functional Testing, and Behavioral Testing (5.5)
Listen to Penetration Testing, Reconnaissance, Frameworks, Functional Testing, and Behavioral Testing (5.5) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E114Transcript
Domain 5 · Security Program Management and Oversight
Security Awareness Training: Onboarding, Ongoing, Targeted, and Corrective Training (5.6)
Listen to Security Awareness Training: Onboarding, Ongoing, Targeted, and Corrective Training (5.6) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E115Transcript
Domain 5 · Security Program Management and Oversight
Awareness Delivery and Effectiveness: LMS, Self-Service, Metrics, Behavior Risk Scoring, BEC, BYOD, and Remote Work (5.6)
Listen to Awareness Delivery and Effectiveness: LMS, Self-Service, Metrics, Behavior Risk Scoring, BEC, BYOD, and Remote Work (5.6) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E116Transcript
Course Review and Updates
PBQ Strategy: Turning Objectives into Scenario Decisions (Review)
Listen to PBQ Strategy: Turning Objectives into Scenario Decisions (Review) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E117Transcript
Course Review and Updates
Full-Course Review: The SY0-801 Memory Map (Review)
Listen to Full-Course Review: The SY0-801 Memory Map (Review) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
S02E118Transcript
Course Review and Updates
Final Objectives Update: What Changed When CompTIA Finalized SY0-801 (Update)
Listen to Final Objectives Update: What Changed When CompTIA Finalized SY0-801 (Update) in the CompTIA Security+ audio course.
Transcript availableJuly 15, 2026
Season 1 · Earlier editionEarlier course archive
S01E01Transcript
Getting Started
What Is the CompTIA Security Plus Certification?
This episode kicks off the Certify – Security Plus podcast series by introducing the CompTIA Security+ certification. You’ll learn what this credential is, why it's such a popular choice for cybersecurity beginners, and what makes it a foundational part of many career paths.…
Transcript availableJune 15, 2025
S01E02Transcript
Getting Started
How the Security Plus SY0-701 Exam Is Organized
Understanding the structure of the SY0-701 exam is crucial before you dive into study mode. This episode provides a domain-by-domain walkthrough of the Security+ certification exam layout.…
Transcript availableJune 15, 2025
S01E03Transcript
Getting Started
Preparing for the Security Plus Exam: Study Strategies That Work
In this episode, we tackle the biggest early challenge: how to study for the Security+ exam effectively. We'll guide you through building a realistic, sustainable study plan that adapts to your personal schedule and learning style.…
Transcript availableJune 15, 2025
S01E04Transcript
Getting Started
What to Expect on Exam Day—and Beyond
Exam day can be nerve-wracking, but this episode prepares you for everything you’ll face—from check-in to the final click of the mouse.…
Transcript availableJune 15, 2025
S01E05Transcript
Course Lessons
Introduction to Domain One — General Security Concepts
Domain One sets the tone for the entire Security+ exam, introducing key cybersecurity principles like confidentiality, integrity, and availability. This episode breaks down control types, the CIA triad, authentication models, and concepts like Zero Trust and AAA.…
Transcript availableJune 15, 2025
S01E06Transcript
Domain 1 · General Security Concepts
Introduction to Security Controls (Domain 1)
Security controls are the foundation of every cybersecurity strategy, providing the rules, tools, and enforcement mechanisms that protect data, systems, and operations from internal and external threats.…
Transcript availableJune 15, 2025
S01E07Transcript
Domain 1 · General Security Concepts
Security Control Categories Deep Dive (Domain 1)
Security controls can be grouped into several major categories—technical, managerial, and operational—each playing a distinct but complementary role in securing modern enterprise environments.…
Transcript availableJune 15, 2025
S01E08Transcript
Domain 1 · General Security Concepts
Physical Controls and Their Implementation (Domain 1)
While cybersecurity often emphasizes digital threats, physical security controls are just as vital, forming the first line of defense against unauthorized access to systems, data centers, and critical infrastructure.…
Transcript availableJune 15, 2025
S01E09Transcript
Domain 1 · General Security Concepts
Security Control Types Explained (Part 1) (Domain 1)
Security controls are not only categorized by function, but also by the role they play in the security lifecycle—specifically, whether they are preventive, deterrent, detective, corrective, compensating, or directive.…
Transcript availableJune 15, 2025
S01E10Transcript
Domain 1 · General Security Concepts
Security Control Types Explained (Part 2) (Domain 1)
In the second half of our discussion on control types, we explore detective, corrective, compensating, and directive controls—each of which plays a crucial role in identifying and responding to security incidents.…
Transcript availableJune 15, 2025
S01E11Transcript
Domain 1 · General Security Concepts
Compensating and Directive Controls (Domain 1)
Compensating and directive controls often serve as the bridge between policy and practice, offering essential flexibility and guidance in environments where standard controls may not be viable.…
Transcript availableJune 15, 2025
S01E12Transcript
Domain 1 · General Security Concepts
Confidentiality, Integrity, and Availability (CIA Triad) (Domain 1)
The CIA Triad—Confidentiality, Integrity, and Availability—forms the foundational model upon which nearly all cybersecurity principles and practices are built.…
Transcript availableJune 15, 2025
S01E13Transcript
Domain 1 · General Security Concepts
Non-Repudiation and AAA (Authentication, Authorization, Accounting) (Domain 1)
Cybersecurity is not only about prevention—it’s also about proof, accountability, and enforcement. In this episode, we examine non-repudiation and the AAA model—Authentication, Authorization, and Accounting—as cornerstones of digital trust.…
Transcript availableJune 15, 2025
S01E14Transcript
Domain 1 · General Security Concepts
Gap Analysis and Zero Trust Security (Domain 1)
Security programs are only as strong as their weakest uncovered areas—and that’s where gap analysis and Zero Trust come into play.…
Transcript availableJune 15, 2025
S01E15Transcript
Domain 1 · General Security Concepts
Physical Security Essentials (Domain 1)
Physical security remains a vital—if sometimes overlooked—component of cybersecurity, especially when protecting facilities, data centers, and physical access points.…
Transcript availableJune 15, 2025
S01E16Transcript
Domain 1 · General Security Concepts
Deception and Disruption Technologies (Domain 1)
Deception technologies play a unique and powerful role in cybersecurity by proactively misleading, confusing, or delaying attackers while providing valuable insight into their methods and intentions.…
Transcript availableJune 15, 2025
S01E17Transcript
Domain 1 · General Security Concepts
Introduction to Change Management (Domain 1)
Change is inevitable in IT environments, but without structure, even small adjustments can introduce security gaps or operational disruptions.…
Transcript availableJune 15, 2025
S01E18Transcript
Domain 1 · General Security Concepts
Business Processes in Change Management (Domain 1)
Security is not just a technical concern—it’s deeply intertwined with business processes, especially when it comes to change management. In this episode, we examine key business elements that drive secure change: the approval process, stakeholder roles, ownership, and impact analysis.…
Transcript availableJune 15, 2025
S01E19Transcript
Domain 1 · General Security Concepts
Effective Implementation and Maintenance in Change Management (Domain 1)
A successful change doesn’t end with approval—it must be implemented carefully and maintained with consistency.…
Transcript availableJune 15, 2025
S01E20Transcript
Domain 1 · General Security Concepts
Technical Implications of Change Management (Domain 1)
Change at the technical level affects more than just configurations—it can ripple through applications, dependencies, and user experiences in complex and unexpected ways.…
Transcript availableJune 15, 2025
S01E21Transcript
Domain 1 · General Security Concepts
Documentation and Version Control (Domain 1)
Documentation is the connective tissue that holds a secure environment together, enabling repeatability, accountability, and informed decision-making across teams and time.…
Transcript availableJune 15, 2025
S01E22Transcript
Domain 1 · General Security Concepts
Introduction to Cryptography and PKI (Domain 1)
Cryptography is the bedrock of secure communication, and understanding its principles is essential for every cybersecurity professional.…
Transcript availableJune 15, 2025
S01E23Transcript
Domain 1 · General Security Concepts
Comprehensive Encryption Techniques (Domain 1)
Encryption is the most widely used method for ensuring data confidentiality, but its implementation must be tailored to the context in which data exists.…
Transcript availableJune 15, 2025
S01E24Transcript
Domain 1 · General Security Concepts
Cryptographic Hardware and Secure Storage (Domain 1)
Software-based encryption can be effective, but for high-assurance environments, hardware-based cryptography adds critical layers of tamper resistance and performance optimization.…
Transcript availableJune 15, 2025
S01E25Transcript
Domain 1 · General Security Concepts
Obfuscation and Data Protection Techniques (Domain 1)
While encryption is the gold standard for confidentiality, it’s not the only method for protecting sensitive information—especially in use cases like software development, privacy regulation, or fraud prevention.…
Transcript availableJune 15, 2025
S01E26Transcript
Domain 1 · General Security Concepts
Hashing, Salting, and Digital Signatures (Domain 1)
Data integrity and authenticity are two foundational pillars of cybersecurity, and in this episode, we explore how hashing, salting, and digital signatures help uphold both.…
Transcript availableJune 15, 2025
S01E27Transcript
Domain 1 · General Security Concepts
Advanced Cryptographic Techniques (Domain 1)
Modern threats require advanced cryptographic responses, and in this episode, we explore the techniques that strengthen authentication, protect weak credentials, and secure transactional data at scale.…
Transcript availableJune 15, 2025
S01E28Transcript
Domain 1 · General Security Concepts
Certificates, Authorities, and Management (Domain 1)
Digital certificates are the backbone of online trust, providing the mechanism for authenticating websites, users, devices, and software in a secure, scalable manner.…
Transcript availableJune 15, 2025
S01E29Transcript
Course Lessons
Introduction to Domain Two — Threats, Vulnerabilities, and Mitigations
If Domain One is the foundation of cybersecurity—built on core principles and frameworks—then Domain Two is where we start applying that knowledge to real-world threats. This is the domain where you learn what we’re actually defending against.…
Transcript availableJune 15, 2025
S01E30Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Understanding Threat Actors (Domain 2)
Cyber threats come in many forms, and to defend effectively, you must understand the adversaries behind the attacks.…
Transcript availableJune 15, 2025
S01E31Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Insider Threats, Organized Crime, and Shadow IT (Domain 2)
Some of the most damaging cybersecurity incidents originate not from unknown hackers, but from within—through employees, vendors, or unmanaged systems operating outside official channels.…
Transcript availableJune 15, 2025
S01E32Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Attributes and Capabilities of Threat Actors (Domain 2)
To effectively model risk and defend systems, cybersecurity professionals must understand not just who the attackers are, but what they are capable of.…
Transcript availableJune 15, 2025
S01E33Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Motivations Behind Cyber Attacks (Part 1) (Domain 2)
Behind every cyberattack is a motive, and understanding why attackers do what they do is essential for predicting and preventing their behavior.…
Transcript availableJune 15, 2025
S01E34Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Motivations Behind Cyber Attacks (Part 2) (Domain 2)
Cyber threats aren’t always driven by stealth or sophistication—sometimes they are fueled by money, ideology, or ethics.…
Transcript availableJune 15, 2025
S01E35Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Motivations Behind Cyber Attacks (Part 3) (Domain 2)
Not all cyberattacks are launched for money or politics—some are driven by emotion, chaos, or war. In this episode, we examine three additional motivations: revenge, disruption, and warfare.…
Transcript availableJune 15, 2025
S01E36Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Introduction to Threat Vectors and Attack Surfaces (Domain 2)
Cybersecurity is not just about knowing your enemy—it’s about understanding the paths they take to reach you. This episode introduces threat vectors and attack surfaces, two essential concepts for identifying exposure and hardening defenses.…
Transcript availableJune 15, 2025
S01E37Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Message-Based and Communication Threat Vectors (Domain 2)
Attackers frequently exploit messaging channels—email, SMS, and instant messaging—to deliver payloads, harvest credentials, or manipulate users into making harmful decisions.…
Transcript availableJune 15, 2025
S01E38Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Image, File, and Voice-Based Threats (Domain 2)
While emails and text messages are well-known vectors, attackers also exploit images, file attachments, and voice communication to bypass traditional security controls.…
Transcript availableJune 15, 2025
S01E39Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Vulnerable Systems, Software, and Devices (Domain 2)
Many attacks succeed not because of advanced hacking techniques, but because of outdated, misconfigured, or unsupported systems that haven’t been properly maintained.…
Transcript availableJune 15, 2025
S01E40Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Network-Based Attack Surfaces (Domain 2)
Your network is the digital highway that connects everything in your organization—and if not properly secured, it becomes the perfect path for attackers.…
Transcript availableJune 15, 2025
S01E41Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Open Ports, Default Credentials, and Supply Chain Risks (Domain 2)
Even the best-configured systems can fall victim to the most basic security oversights—like open ports and unchanged default passwords.…
Transcript availableJune 15, 2025
S01E42Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Human Vectors and Social Engineering (Part 1) (Domain 2)
People are often the weakest link in cybersecurity, and attackers exploit this through carefully crafted manipulation tactics known as social engineering.…
Transcript availableJune 15, 2025
S01E43Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Human Vectors and Social Engineering (Part 2) (Domain 2)
While basic social engineering relies on message-based deception, more advanced techniques target identity, credibility, and digital presence through impersonation, pretexting, and domain spoofing.…
Transcript availableJune 15, 2025
S01E44Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Application-Level Vulnerabilities (Domain 2)
Applications serve as the user-facing layer of most digital environments, and they are frequently targeted by attackers exploiting poor coding practices and flawed design.…
Transcript availableJune 15, 2025
S01E45Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Operating System and Web-Based Vulnerabilities (Domain 2)
Operating systems and web applications form the backbone of IT infrastructure, and when left unpatched or misconfigured, they present rich targets for exploitation.…
Transcript availableJune 15, 2025
S01E46Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Hardware and Firmware Vulnerabilities (Domain 2)
Cybersecurity doesn’t stop at software—hardware and firmware vulnerabilities can offer attackers deep, long-term access to systems in ways that are difficult to detect and even harder to fix.…
Transcript availableJune 15, 2025
S01E47Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Virtualization and Cloud-Specific Vulnerabilities (Domain 2)
Virtualization and cloud computing introduce powerful efficiencies—but they also open up new categories of vulnerabilities that traditional security models often fail to address.…
Transcript availableJune 15, 2025
S01E48Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Supply Chain and Cryptographic Vulnerabilities (Domain 2)
Modern cybersecurity is deeply interconnected, and vulnerabilities in your vendors, partners, or third-party software can easily become vulnerabilities in your own environment.…
Transcript availableJune 15, 2025
S01E49Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Misconfiguration and Mobile Device Vulnerabilities (Domain 2)
Misconfiguration is one of the most common and preventable causes of security breaches, and mobile devices amplify this risk due to their ubiquity and inconsistent management.…
Transcript availableJune 15, 2025
S01E50Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Understanding Zero-Day Vulnerabilities (Domain 2)
Zero-day vulnerabilities are software flaws that are unknown to the vendor and, critically, to defenders—giving attackers a window of opportunity to exploit systems with no available patch or signature-based detection.…
Transcript availableJune 15, 2025
S01E51Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Indicators of Malware Attacks (Domain 2)
Malware comes in many forms—ransomware, spyware, trojans, worms—and each leaves behind unique indicators that can help defenders detect infections early and respond effectively.…
Transcript availableJune 15, 2025
S01E52Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Physical Security Attacks and Indicators (Domain 2)
While cybersecurity often focuses on virtual threats, physical attacks on facilities, hardware, and access points remain a serious and sometimes overlooked risk.…
Transcript availableJune 15, 2025
S01E53Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Network-Based Indicators (Part 1) (Domain 2)
The network is often where the first signs of an attack emerge—if you know what to look for.…
Transcript availableJune 15, 2025
S01E54Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Network-Based Indicators (Part 2) (Domain 2)
Continuing our focus on network-based threats, this episode explores wireless-specific attacks and credential replay tactics that compromise network integrity and user accounts.…
Transcript availableJune 15, 2025
S01E55Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Application-Level Attack Indicators (Domain 2)
Applications are often targeted because they represent the gateway to sensitive data and services, and attackers leave behind subtle but detectable signs when they exploit them.…
Transcript availableJune 15, 2025
S01E56Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Cryptographic Attack Indicators (Domain 2)
Even strong encryption systems can be undermined by poor implementation, weak configurations, or direct cryptographic attacks—and recognizing the signs is vital.…
Transcript availableJune 15, 2025
S01E57Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Password Attack Indicators (Domain 2)
Password attacks are among the most common initial access vectors, and recognizing their early indicators is key to stopping intrusions before they escalate.…
Transcript availableJune 15, 2025
S01E58Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
General Indicators of Malicious Activity (Domain 2)
Not every security breach begins with a smoking gun—many start with subtle shifts in system behavior that point to something being off.…
Transcript availableJune 15, 2025
S01E59Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Segmentation and Access Control (Domain 2)
Network segmentation and access control are two of the most powerful tools for limiting the scope and impact of an attack, especially once a threat actor gains initial access.…
Transcript availableJune 15, 2025
S01E60Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Application Allow Lists and Isolation (Domain 2)
Controlling what software is allowed to run—and isolating it when needed—is a fundamental principle of endpoint security. In this episode, we examine application allow lists, which explicitly define which executables, scripts, and libraries are permitted to run in a given environment.…
Transcript availableJune 15, 2025
S01E61Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Patching and Encryption (Domain 2)
Patching and encryption are two of the most basic yet essential components of any security strategy—one protects against known vulnerabilities, the other safeguards data from unauthorized access.…
Transcript availableJune 15, 2025
S01E62Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Monitoring and Least Privilege (Domain 2)
Monitoring and the principle of least privilege are two complementary pillars of proactive cybersecurity, enabling both visibility and access limitation.…
Transcript availableJune 15, 2025
S01E63Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
Configuration Enforcement and Decommissioning (Domain 2)
Keeping systems secure isn’t just about building them right—it’s about making sure they stay that way, and knowing how to shut them down properly when they’re no longer needed.…
Transcript availableJune 15, 2025
S01E64Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
System Hardening Techniques (Part 1) (Domain 2)
System hardening is about reducing the attack surface by eliminating unnecessary features, closing open ports, and enforcing strict policies across endpoints, servers, and network devices.…
Transcript availableJune 15, 2025
S01E65Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
System Hardening Techniques (Part 2) (Domain 2)
Continuing our exploration of system hardening, this episode focuses on host-based firewalls and intrusion prevention systems (HIPS), which defend individual devices by monitoring and controlling inbound and outbound network traffic.…
Transcript availableJune 15, 2025
S01E66Transcript
Domain 2 · Threats, Vulnerabilities, and Mitigations
System Hardening Techniques (Part 3) (Domain 2)
In the final part of our system hardening series, we tackle some of the most overlooked but impactful practices: disabling unnecessary ports and services, replacing default credentials, and removing unused software.…
Transcript availableJune 15, 2025
S01E67Transcript
Course Lessons
Introduction to Domain Three — Security Architecture
Cybersecurity isn’t just about stopping threats as they happen—it’s also about designing systems that are harder to attack in the first place. And that’s the focus of Domain Three: Security Architecture.…
Transcript availableJune 15, 2025
S01E68Transcript
Domain 3 · Security Architecture
Cloud Architecture and Responsibilities (Domain 3)
Cloud computing changes the game for infrastructure design and security responsibility, requiring organizations to understand not just how services work—but who is accountable for securing them.…
Transcript availableJune 15, 2025
S01E69Transcript
Domain 3 · Security Architecture
Network Infrastructure Security Models (Domain 3)
Modern networks are no longer simple, flat environments—they are segmented, layered, and increasingly software-defined.…
Transcript availableJune 15, 2025
S01E70Transcript
Domain 3 · Security Architecture
On-Premises, Centralized, and Decentralized Architectures (Domain 3)
Security must adapt to the architecture of the environment it protects, and that starts with understanding how infrastructure is organized. In this episode, we compare on-premises, centralized, and decentralized architectures, explaining the security implications of each.…
Transcript availableJune 15, 2025
S01E71Transcript
Domain 3 · Security Architecture
Specialized Architecture Models (Domain 3)
Some systems require specialized architectural models due to their operational roles, legacy constraints, or real-time performance needs.…
Transcript availableJune 15, 2025
S01E72Transcript
Domain 3 · Security Architecture
High Availability Architectures (Domain 3)
Availability is one of the core tenets of cybersecurity, and in mission-critical environments, downtime is simply not an option. In this episode, we focus on high availability (HA) architectures—design strategies that ensure systems remain operational even when components fail.…
Transcript availableJune 15, 2025
S01E73Transcript
Domain 3 · Security Architecture
Architecture Security Considerations (Part 1) (Domain 3)
Designing secure systems means weighing a variety of architectural considerations, and in this episode, we begin by focusing on availability, resilience, and cost.…
Transcript availableJune 15, 2025
S01E74Transcript
Domain 3 · Security Architecture
Architecture Security Considerations (Part 2) (Domain 3)
Responsiveness, scalability, and ease of deployment are three more pillars that heavily influence secure architecture decisions, especially in environments where adaptability is key.…
Transcript availableJune 15, 2025
S01E75Transcript
Domain 3 · Security Architecture
Architecture Security Considerations (Part 3) (Domain 3)
In this final installment on architectural considerations, we focus on risk transference, ease of recovery, and the practical realities of patch availability and compute resources.…
Transcript availableJune 15, 2025
S01E76Transcript
Domain 3 · Security Architecture
Infrastructure Security Foundations (Domain 3)
Securing infrastructure starts with design decisions about where and how devices are placed, how data flows, and where trust boundaries begin and end.…
Transcript availableJune 15, 2025
S01E77Transcript
Domain 3 · Security Architecture
Connectivity and Failure Modes (Domain 3)
Connectivity powers modern organizations, but with it comes risk—especially when failure modes are not considered in the security design. In this episode, we explore what happens when devices or services fail, and how the design of fail-open vs.…
Transcript availableJune 15, 2025
S01E78Transcript
Domain 3 · Security Architecture
Device Attributes and Network Appliances (Domain 3)
Security isn’t just about policies and firewalls—it’s also about the capabilities and placement of the physical and virtual devices enforcing them. In this episode, we explore key device attributes such as active vs.…
Transcript availableJune 15, 2025
S01E79Transcript
Domain 3 · Security Architecture
Load Balancers and Sensors (Domain 3)
Load balancers and network sensors are often associated with performance and visibility—but they are just as critical to your security architecture.…
Transcript availableJune 15, 2025
S01E80Transcript
Domain 3 · Security Architecture
Port Security and Authentication Protocols (Domain 3)
Every port on your network is a potential doorway, and port security ensures those doors stay locked unless explicitly authorized.…
Transcript availableJune 15, 2025
S01E81Transcript
Domain 3 · Security Architecture
Firewalls and Security Gateways (Domain 3)
Firewalls are one of the oldest and most trusted tools in network defense, but today’s environments require more than just simple packet filtering.…
Transcript availableJune 15, 2025
S01E82Transcript
Domain 3 · Security Architecture
Secure Communication and Remote Access (Domain 3)
As remote work and distributed systems become the norm, securing communication across potentially hostile networks is more important than ever. In this episode, we explore secure communication methods including Virtual Private Networks (VPNs), TLS encryption, and IPSec tunneling.…
Transcript availableJune 15, 2025
S01E83Transcript
Domain 3 · Security Architecture
Advanced Secure Access Solutions (Domain 3)
Traditional perimeter security isn’t enough in a world of mobile users, cloud resources, and third-party integrations.…
Transcript availableJune 15, 2025
S01E84Transcript
Domain 3 · Security Architecture
Selecting Effective Security Controls (Domain 3)
Choosing the right security controls is not about applying everything—it’s about applying the right things, in the right places, at the right time.…
Transcript availableJune 15, 2025
S01E85Transcript
Domain 3 · Security Architecture
Data Types and Their Protection (Domain 3)
Data is not monolithic—its classification and context determine how it should be secured.…
Transcript availableJune 15, 2025
S01E86Transcript
Domain 3 · Security Architecture
Human vs. Non-human Readable Data (Domain 3)
Not all data is meant for human eyes, and in cybersecurity, understanding the distinction between human-readable and non-human-readable data formats is vital for applying the right protection.…
Transcript availableJune 15, 2025
S01E87Transcript
Domain 3 · Security Architecture
Data Classification Strategies (Part 1) (Domain 3)
Data classification provides the foundation for applying security controls based on risk and sensitivity, and in this episode, we examine the first part of a two-part discussion on classification strategy.…
Transcript availableJune 15, 2025
S01E88Transcript
Domain 3 · Security Architecture
Data Classification Strategies (Part 2) (Domain 3)
Building on the foundation from part one, this episode explores public and private data categories, the importance of policy-driven classification, and how to implement classification effectively across diverse environments.…
Transcript availableJune 15, 2025
S01E89Transcript
Domain 3 · Security Architecture
General Data Considerations – States of Data (Domain 3)
Data security isn’t just about what kind of data you’re protecting—it’s also about when and where that data is at any given time. In this episode, we explore the three states of data: at rest, in transit, and in use.…
Transcript availableJune 15, 2025
S01E90Transcript
Domain 3 · Security Architecture
Data Sovereignty and Geolocation (Domain 3)
Where data physically resides has become a legal and operational priority for organizations operating in an increasingly globalized and regulated world.…
Transcript availableJune 15, 2025
S01E91Transcript
Domain 3 · Security Architecture
Methods to Secure Data (Part 1) (Domain 3)
Protecting data effectively starts with strong core methods that control access and visibility, and in this episode, we focus on geographic restrictions and encryption as frontline tools.…
Transcript availableJune 15, 2025
S01E92Transcript
Domain 3 · Security Architecture
Methods to Secure Data (Part 2) (Domain 3)
Beyond encryption, organizations have additional tools to secure data in contexts where usability, compliance, or performance requirements call for alternatives.…
Transcript availableJune 15, 2025
S01E93Transcript
Domain 3 · Security Architecture
Methods to Secure Data (Part 2) (Domain 3)
Beyond encryption, organizations have additional tools to secure data in contexts where usability, compliance, or performance requirements call for alternatives.…
Transcript availableJune 15, 2025
S01E94Transcript
Domain 3 · Security Architecture
Methods to Secure Data (Part 3) (Domain 3)
In this final installment on data protection methods, we focus on segmentation and permission restrictions—two strategic approaches that limit both exposure and access.…
Transcript availableJune 15, 2025
S01E95Transcript
Domain 3 · Security Architecture
High Availability and System Resilience (Domain 3)
Security isn’t just about keeping attackers out—it’s also about keeping services running when they try to bring you down.…
Transcript availableJune 15, 2025
S01E96Transcript
Domain 3 · Security Architecture
Disaster Recovery Site Considerations (Domain 3)
Disaster recovery planning ensures that when critical infrastructure goes offline—whether due to cyberattack, natural disaster, or hardware failure—business operations can resume with minimal disruption.…
Transcript availableJune 15, 2025
S01E97Transcript
Domain 3 · Security Architecture
Platform Diversity and Multi-cloud Architecture (Domain 3)
Relying on a single technology stack or vendor can introduce systemic risk, and in this episode, we explore how platform diversity and multi-cloud strategies enhance both security and resilience.…
Transcript availableJune 15, 2025
S01E98Transcript
Domain 3 · Security Architecture
Continuity of Operations and Capacity Planning (Domain 3)
Even the most secure systems are useless if they can’t operate under pressure, and this episode explores the intersection of cybersecurity with business resilience through Continuity of Operations Planning (COOP) and capacity planning.…
Transcript availableJune 15, 2025
S01E99Transcript
Domain 3 · Security Architecture
Comprehensive Testing for Resilience (Domain 3)
Preparation is only as good as its ability to withstand the unexpected, and resilience testing is how you find out whether your systems, processes, and people are truly ready.…
Transcript availableJune 15, 2025
S01E100Transcript
Domain 3 · Security Architecture
Backup Strategies and Best Practices (Part 1) (Domain 3)
Backups form the last line of defense when everything else fails, and a good strategy turns potential disaster into a recoverable event.…
Transcript availableJune 15, 2025
S01E101Transcript
Domain 3 · Security Architecture
Backup Strategies and Best Practices (Part 2) (Domain 3)
Continuing our discussion on backups, this episode explores encryption, snapshots, and backup lifecycle management—three critical components of a secure, efficient, and resilient backup system.…
Transcript availableJune 15, 2025
S01E102Transcript
Domain 3 · Security Architecture
Data Recovery Techniques (Domain 3)
Backups are only half of the story—the other half is how effectively you can recover from them.…
Transcript availableJune 15, 2025
S01E103Transcript
Domain 3 · Security Architecture
Power Resilience and Continuity (Domain 3)
Without reliable power, even the most secure systems are at risk of failure—and in many environments, loss of power is both a security and safety issue.…
Transcript availableJune 15, 2025
S01E104Transcript
Course Lessons
Introduction to Domain Four — Security Operations
If Domains One through Three are about understanding the principles and design of cybersecurity, then Domain Four is about the actual day-to-day work that keeps systems secure.…
Transcript availableJune 15, 2025
S01E105Transcript
Domain 4 · Security Operations
Secure Baselines and System Management (Domain 4)
Establishing a secure baseline is one of the most fundamental—and often overlooked—steps in managing system security.…
Transcript availableJune 15, 2025
S01E106Transcript
Domain 4 · Security Operations
Hardening Computing Resources (Part 1) (Domain 4)
Hardening is the practice of stripping down systems to only what they need to function securely, and this episode focuses on doing just that for mobile devices, workstations, switches, and routers.…
Transcript availableJune 15, 2025
S01E107Transcript
Domain 4 · Security Operations
Hardening Computing Resources (Part 2) (Domain 4)
Continuing our discussion on hardening, this episode shifts focus to cloud infrastructure, servers, and industrial systems—each of which requires a tailored approach based on operational roles, architecture, and threat exposure.…
Transcript availableJune 15, 2025
S01E108Transcript
Domain 4 · Security Operations
Hardening Embedded Systems and IoT Devices (Domain 4)
Embedded systems and IoT devices often operate in environments where security is either underprioritized or extremely difficult to implement, making them prime targets for persistent threats.…
Transcript availableJune 15, 2025
S01E109Transcript
Domain 4 · Security Operations
Securing Wireless Networks (Part 1) (Domain 4)
Wireless networks offer convenience, but they also expand the attack surface by broadcasting connectivity beyond physical boundaries, making them inherently riskier than wired alternatives.…
Transcript availableJune 15, 2025
S01E110Transcript
Domain 4 · Security Operations
Securing Mobile Solutions (Domain 4)
Mobile devices have become indispensable for productivity, but they also introduce unique security challenges due to their portability, connectivity, and often personal ownership.…
Transcript availableJune 15, 2025
S01E111Transcript
Domain 4 · Security Operations
Securing Mobile Connectivity (Domain 4)
Mobile devices connect through a variety of channels—cellular networks, Wi-Fi, and Bluetooth—each with its own risks and requirements for secure operation.…
Transcript availableJune 15, 2025
S01E112Transcript
Domain 4 · Security Operations
Advanced Wireless Security Techniques (Domain 4)
As wireless threats become more sophisticated, organizations must move beyond basic security measures and implement advanced techniques to protect access points and users.…
Transcript availableJune 15, 2025
S01E113Transcript
Domain 4 · Security Operations
Application Security Essentials (Domain 4)
Applications are often the most exposed layer of an organization’s attack surface, and defending them requires both proactive development practices and reactive protection mechanisms.…
Transcript availableJune 15, 2025
S01E114Transcript
Domain 4 · Security Operations
Isolation and Monitoring Techniques (Domain 4)
Isolation and monitoring form a defensive pairing that not only limits the spread of threats but enables rapid detection and response.…
Transcript availableJune 15, 2025
S01E115Transcript
Domain 4 · Security Operations
Acquisition and Procurement Security (Domain 4)
Security doesn’t start when a system is installed—it begins during the procurement process.…
Transcript availableJune 15, 2025
S01E116Transcript
Domain 4 · Security Operations
Assignment, Ownership, and Classification (Domain 4)
To manage risk effectively, organizations must know what they own, who is responsible for it, and how critical it is—this is the basis of asset assignment, ownership, and classification.…
Transcript availableJune 15, 2025
S01E117Transcript
Domain 4 · Security Operations
Asset Monitoring and Tracking (Domain 4)
Security begins with visibility, and that means knowing what devices, systems, and software exist within your environment at all times.…
Transcript availableJune 15, 2025
S01E118Transcript
Domain 4 · Security Operations
Secure Asset Disposal and Decommissioning (Domain 4)
When assets reach the end of their lifecycle, they don’t just disappear—they become potential liabilities if not securely decommissioned.…
Transcript availableJune 15, 2025
S01E119Transcript
Domain 4 · Security Operations
Data Retention and Secure Management Practices (Domain 4)
Data retention policies define what data must be kept, for how long, and under what security controls—and when they’re done right, they strike a balance between legal obligations, operational needs, and security.…
Transcript availableJune 15, 2025
S01E120Transcript
Domain 4 · Security Operations
Vulnerability Identification Methods (Part 1) (Domain 4)
Finding vulnerabilities before attackers do is a core function of modern cybersecurity, and this episode explores the technical methods used to identify them early and accurately.…
Transcript availableJune 15, 2025
S01E121Transcript
Domain 4 · Security Operations
Vulnerability Identification Methods (Part 2) (Domain 4)
Continuing our exploration of how vulnerabilities are identified, this episode focuses on external and community-driven methods, including penetration testing, bug bounty programs, responsible disclosure, and open-source intelligence (OSINT).…
Transcript availableJune 15, 2025
S01E122Transcript
Domain 4 · Security Operations
System and Process Auditing (Domain 4)
Auditing is how security teams verify that controls are working, policies are being followed, and no one is operating outside expected behavior—and in this episode, we explore both system and process auditing in depth.…
Transcript availableJune 15, 2025
S01E123Transcript
Domain 4 · Security Operations
Vulnerability Analysis and Prioritization (Part 1) (Domain 4)
Once vulnerabilities are identified, the next challenge is determining which ones require immediate action—and that’s where vulnerability analysis and prioritization come in.…
Transcript availableJune 15, 2025
S01E124Transcript
Domain 4 · Security Operations
Vulnerability Analysis and Prioritization (Part 2) (Domain 4)
Expanding on the concepts of vulnerability prioritization, this episode introduces industry-standard scoring and classification systems like CVSS (Common Vulnerability Scoring System) and CVE (Common Vulnerabilities and Exposures), which provide a structured way to quantify and compare risks.…
Transcript availableJune 15, 2025
S01E125Transcript
Domain 4 · Security Operations
Vulnerability Response and Remediation (Part 1) (Domain 4)
Finding vulnerabilities is only useful if you have a plan to fix them—and this episode dives into the critical processes of response and remediation. We begin with patching, one of the most effective and often underutilized defenses in cybersecurity.…
Transcript availableJune 15, 2025
S01E126Transcript
Domain 4 · Security Operations
Vulnerability Response and Remediation (Part 2) (Domain 4)
Not all vulnerabilities can be patched right away, and in these cases, compensating controls, segmentation, and exceptions become essential components of a realistic remediation strategy.…
Transcript availableJune 15, 2025
S01E127Transcript
Domain 4 · Security Operations
Validation of Remediation Efforts (Domain 4)
Fixing a vulnerability doesn’t mean it’s gone—it means it needs to be verified.…
Transcript availableJune 15, 2025
S01E128Transcript
Domain 4 · Security Operations
Effective Vulnerability Reporting (Domain 4)
Clear, actionable reporting is the bridge between technical discovery and organizational response, and in this episode, we explore what makes vulnerability reports useful and credible.…
Transcript availableJune 16, 2025
S01E129Transcript
Domain 4 · Security Operations
Monitoring Computing Resources (Domain 4)
Monitoring is the heartbeat of any modern security operation, providing real-time visibility into systems, applications, and infrastructure.…
Transcript availableJune 16, 2025
S01E130Transcript
Domain 4 · Security Operations
Key Security Monitoring Activities (Part 1) (Domain 4)
Monitoring is most valuable when it drives action, and in this episode, we explore foundational activities that turn data into defense—starting with log aggregation, alerting, and scanning.…
Transcript availableJune 16, 2025
S01E131Transcript
Domain 4 · Security Operations
Key Security Monitoring Activities (Part 2) (Domain 4)
Beyond real-time alerting, monitoring supports long-term visibility, compliance, and forensics through disciplined reporting and archiving practices.…
Transcript availableJune 16, 2025
S01E132Transcript
Domain 4 · Security Operations
Alert Response and Validation (Domain 4)
Alerts are only effective when they result in meaningful, timely responses—and this episode explores how organizations structure alert triage, validation, and remediation workflows.…
Transcript availableJune 16, 2025
S01E133Transcript
Domain 4 · Security Operations
Security Monitoring Tools (Part 1) (Domain 4)
Choosing the right tools shapes how effectively you can detect, understand, and respond to threats.…
Transcript availableJune 16, 2025
S01E134Transcript
Domain 4 · Security Operations
Security Monitoring Tools (Part 2) (Domain 4)
Building on our previous discussion, this episode explores more advanced and specialized monitoring tools—starting with Security Information and Event Management (SIEM) systems.…
Transcript availableJune 16, 2025
S01E135Transcript
Domain 4 · Security Operations
Endpoint and Data Security Monitoring Tools (Domain 4)
Endpoints—laptops, desktops, mobile devices—are where most cyberattacks begin, making endpoint security monitoring a frontline defense.…
Transcript availableJune 16, 2025
S01E136Transcript
Domain 4 · Security Operations
Network-Based Monitoring Tools (Domain 4)
The network is where everything intersects—making it one of the most important vantage points for threat detection.…
Transcript availableJune 16, 2025
S01E137Transcript
Domain 4 · Security Operations
Vulnerability Scanning Tools and Practices (Domain 4)
Proactive security means finding and fixing weaknesses before attackers do, and vulnerability scanning is the tool that makes that possible at scale.…
Transcript availableJune 16, 2025
S01E138Transcript
Domain 4 · Security Operations
Enhancing Firewall Capabilities (Domain 4)
Firewalls are often the first line of defense—but they’re only as effective as the rules, architecture, and tuning behind them.…
Transcript availableJune 16, 2025
S01E139Transcript
Domain 4 · Security Operations
Enhancing IDS/IPS Effectiveness (Domain 4)
Intrusion Detection and Prevention Systems (IDS/IPS) are powerful tools—but their effectiveness depends entirely on tuning, context, and visibility.…
Transcript availableJune 16, 2025
S01E140Transcript
Domain 4 · Security Operations
Web Filtering and Content Security (Domain 4)
Web filtering and content security are essential for managing user behavior and blocking malicious or inappropriate content before it ever reaches the endpoint.…
Transcript availableJune 16, 2025
S01E141Transcript
Domain 4 · Security Operations
Operating System Security Enhancements (Domain 4)
The operating system is the beating heart of any computing device—and securing it properly lays the groundwork for all other defenses.…
Transcript availableJune 16, 2025
S01E142Transcript
Domain 4 · Security Operations
Secure Protocol Implementation (Domain 4)
Not all protocols are created equal—and using the wrong one can open a serious security hole in your environment. In this episode, we examine the implementation of secure communication protocols like TLS, SSH, and IPSec, which provide confidentiality and integrity for data in transit.…
Transcript availableJune 16, 2025
S01E143Transcript
Domain 4 · Security Operations
DNS Filtering and Email Security Enhancements (Domain 4)
DNS and email are two of the most commonly exploited services in cyberattacks—and securing them requires layered, policy-driven controls.…
Transcript availableJune 16, 2025
S01E144Transcript
Domain 4 · Security Operations
File Integrity Monitoring and Data Loss Prevention (Domain 4)
File Integrity Monitoring (FIM) and Data Loss Prevention (DLP) tools are essential for detecting tampering and protecting sensitive data from unauthorized exfiltration.…
Transcript availableJune 16, 2025
S01E145Transcript
Domain 4 · Security Operations
Network Access Control and Endpoint Protection (Domain 4)
Controlling access at the point of connection is one of the most effective ways to prevent unauthorized entry, and in this episode, we explore the implementation of Network Access Control (NAC) and endpoint protection systems.…
Transcript availableJune 16, 2025
S01E146Transcript
Domain 4 · Security Operations
User Behavior Analytics (Domain 4)
User Behavior Analytics (UBA) shifts the security paradigm from rules-based alerts to behavioral baselines, allowing defenders to spot anomalies that signal potential insider threats, account compromise, or malicious misuse.…
Transcript availableJune 16, 2025
S01E147Transcript
Domain 4 · Security Operations
User Account Provisioning and Permission Management (Domain 4)
Creating, modifying, and revoking user accounts may sound like routine IT work—but it’s a fundamental part of security control.…
Transcript availableJune 16, 2025
S01E148Transcript
Domain 4 · Security Operations
Identity Proofing and Federation (Domain 4)
Before you can secure access, you have to know who’s requesting it—and identity proofing ensures that the person behind a login is who they claim to be.…
Transcript availableJune 16, 2025
S01E149Transcript
Domain 4 · Security Operations
Single Sign-On (SSO) and Protocols (Domain 4)
Single Sign-On (SSO) allows users to access multiple systems with a single set of credentials, enhancing both convenience and security when implemented with care.…
Transcript availableJune 16, 2025
S01E150Transcript
Domain 4 · Security Operations
Interoperability and Attestation (Domain 4)
As organizations adopt more diverse platforms, cloud services, and third-party integrations, the ability for systems to work together securely—known as interoperability—becomes mission-critical.…
Transcript availableJune 16, 2025
S01E151Transcript
Domain 4 · Security Operations
Access Control Models (Part 1) (Domain 4)
Access control models define who can access what, under which conditions—and in this episode, we begin our exploration with Mandatory Access Control (MAC) and Discretionary Access Control (DAC).…
Transcript availableJune 16, 2025
S01E152Transcript
Domain 4 · Security Operations
Access Control Models (Part 2) (Domain 4)
In this second installment on access control models, we focus on more adaptive and scalable approaches: Role-Based Access Control (RBAC), Rule-Based Access Control, and Attribute-Based Access Control (ABAC).…
Transcript availableJune 16, 2025
S01E153Transcript
Domain 4 · Security Operations
Advanced Access Controls and Least Privilege (Domain 4)
Access controls must go beyond static roles to enforce the principle of least privilege in real time, and this episode explores how to implement more advanced models that do just that.…
Transcript availableJune 16, 2025
S01E154Transcript
Domain 4 · Security Operations
Multifactor Authentication (MFA) Implementations (Domain 4)
Multifactor Authentication (MFA) is one of the most effective ways to prevent unauthorized access, and in this episode, we break down how to implement it effectively across different environments.…
Transcript availableJune 16, 2025
S01E155Transcript
Domain 4 · Security Operations
MFA Authentication Factors (Domain 4)
Multifactor authentication is only as strong as the diversity and reliability of the factors it uses.…
Transcript availableJune 16, 2025
S01E156Transcript
Domain 4 · Security Operations
Secure Password Management (Domain 4)
Passwords continue to serve as a primary access method for many systems, and in this episode, we examine what secure password management really looks like—from user behavior to backend storage.…
Transcript availableJune 16, 2025
S01E157Transcript
Domain 4 · Security Operations
Privileged Access Management (PAM) (Domain 4)
Privileged accounts are the crown jewels of any IT environment, and their misuse—whether accidental or malicious—can lead to devastating breaches.…
Transcript availableJune 16, 2025
S01E158Transcript
Domain 4 · Security Operations
Automation and Scripting in Security (Domain 4)
In modern cybersecurity, manual processes can’t keep up with the scale and speed of threats—making automation and scripting essential for operational success.…
Transcript availableJune 16, 2025
S01E159Transcript
Domain 4 · Security Operations
Technical Debt in Automation (Domain 4)
As security teams automate more of their operations, they often accumulate technical debt—shortcuts, fragile code, or undocumented scripts that create long-term risk.…
Transcript availableJune 16, 2025
S01E160Transcript
Domain 4 · Security Operations
Continuous Integration and API Automation (Domain 4)
Security needs to move at the speed of development, and that’s where continuous integration (CI) and API-driven automation come in.…
Transcript availableJune 16, 2025
S01E161Transcript
Domain 4 · Security Operations
Benefits of Security Automation (Part 1) (Domain 4)
Security automation offers more than just saved time—it fundamentally transforms how teams operate by embedding consistency, speed, and scalability into their daily processes.…
Transcript availableJune 16, 2025
S01E162Transcript
Domain 4 · Security Operations
Benefits of Security Automation (Part 2) (Domain 4)
Building on the first part of our automation series, this episode explores how security automation improves scalability, incident reaction time, and team productivity.…
Transcript availableJune 16, 2025
S01E163Transcript
Domain 4 · Security Operations
Considerations for Security Automation (Part 1) (Domain 4)
As powerful as automation is, it’s not without challenges—and in this episode, we dive into the complexity and cost considerations that come with security automation projects.…
Transcript availableJune 16, 2025
S01E164Transcript
Domain 4 · Security Operations
Considerations for Security Automation (Part 2) (Domain 4)
Continuing our discussion on automation pitfalls, this episode focuses on the risk of single points of failure, technical debt, and long-term support challenges.…
Transcript availableJune 16, 2025
S01E165Transcript
Domain 4 · Security Operations
Incident Response Process (Part 1) (Domain 4)
A strong incident response process can mean the difference between a contained event and a catastrophic breach—and in this episode, we break down the first half of the response lifecycle: preparation, detection, and analysis.…
Transcript availableJune 16, 2025
S01E166Transcript
Domain 4 · Security Operations
Incident Response Process (Part 2) (Domain 4)
Following detection and analysis, the next phases in an incident response plan are containment, eradication, and recovery—critical steps that stop the spread of an attack and restore operations.…
Transcript availableJune 16, 2025
S01E167Transcript
Domain 4 · Security Operations
Incident Response – Lessons Learned (Domain 4)
Every incident is a learning opportunity, and the final step of the response lifecycle—lessons learned—ensures that your team emerges stronger, smarter, and better prepared.…
Transcript availableJune 16, 2025
S01E168Transcript
Domain 4 · Security Operations
Incident Response Training and Testing (Domain 4)
A well-written incident response plan is only useful if your team knows how to execute it—and the best way to build that confidence is through training and testing.…
Transcript availableJune 16, 2025
S01E169Transcript
Domain 4 · Security Operations
Root Cause Analysis and Threat Hunting (Domain 4)
Stopping an incident isn’t enough—you have to understand how it happened and whether something deeper is still lurking. This episode explores root cause analysis and threat hunting as advanced investigative tools that move teams from reaction to prevention.…
Transcript availableJune 16, 2025
S01E170Transcript
Domain 4 · Security Operations
Digital Forensics Foundations (Domain 4)
When a security incident occurs, understanding what happened—and proving it—requires digital forensics. In this episode, we cover foundational concepts of digital forensics, including data acquisition, chain of custody, preservation, and documentation.…
Transcript availableJune 16, 2025
S01E171Transcript
Domain 4 · Security Operations
Forensics – Data Acquisition and Reporting (Domain 4)
Capturing and reporting digital evidence is a delicate process that must be repeatable, verifiable, and legally defensible.…
Transcript availableJune 16, 2025
S01E172Transcript
Domain 4 · Security Operations
Forensic Evidence Preservation and E-Discovery (Domain 4)
Once digital evidence is collected, preserving it and producing it responsibly are the next critical steps—and in this episode, we focus on maintaining evidentiary integrity through preservation and e-discovery.…
Transcript availableJune 16, 2025
S01E173Transcript
Domain 4 · Security Operations
Leveraging Log Data (Part 1) (Domain 4)
Logs are the record books of your infrastructure, capturing who did what, when, and where—and in this episode, we explore how to extract value from them.…
Transcript availableJune 16, 2025
S01E174Transcript
Domain 4 · Security Operations
Leveraging Log Data (Part 2) (Domain 4)
In this continuation of our log analysis discussion, we shift from collection to interpretation—examining how different data sources support threat detection, forensic investigation, and compliance reporting.…
Transcript availableJune 16, 2025
S01E175Transcript
Domain 4 · Security Operations
Vulnerability Scan Data and Automated Reporting (Domain 4)
Vulnerability scan data is only useful when it’s collected, organized, and presented in a way that drives action—and this episode explains how automated reporting transforms raw scan results into operational intelligence.…
Transcript availableJune 16, 2025
S01E176Transcript
Domain 4 · Security Operations
Dashboards and Visualization Tools (Domain 4)
A well-designed dashboard can turn complex security data into fast, actionable insight—and in this episode, we explore how visualization tools help analysts, engineers, and executives understand the health of their security environments at a glance.…
Transcript availableJune 16, 2025
S01E177Transcript
Domain 4 · Security Operations
Packet Captures in Investigations (Domain 4)
Packet captures are the most detailed and revealing form of network data available to defenders—showing not just what happened, but exactly how it happened, byte by byte.…
Transcript availableJune 16, 2025
S01E178Transcript
Course Lessons
Introduction to Domain Five — Security Program Management and Oversight
Cybersecurity isn’t just about blocking attacks and managing firewalls. It’s also about building policies, assessing risk, managing vendors, and aligning security with the overall goals of the business.…
Transcript availableJune 16, 2025
S01E179Transcript
Domain 5 · Security Program Management and Oversight
Introduction to Security Governance (Domain 5)
Security governance is the blueprint for how an organization manages its security strategy, aligns it with business goals, and ensures accountability across all levels of operation.…
Transcript availableJune 16, 2025
S01E180Transcript
Domain 5 · Security Program Management and Oversight
Key Security Policies and Standards (Domain 5)
Policies and standards are the written expression of an organization’s security expectations—and in this episode, we explore how they’re developed, communicated, and enforced.…
Transcript availableJune 16, 2025
S01E181Transcript
Domain 5 · Security Program Management and Oversight
Incident Response Policies and Procedures (Domain 5)
An effective incident response program starts with well-defined policies and procedures that guide every action, role, and escalation during a security event.…
Transcript availableJune 16, 2025
S01E182Transcript
Domain 5 · Security Program Management and Oversight
Security Standards and Physical Controls (Domain 5)
Standards and controls turn high-level policy into actionable, enforceable security, and in this episode, we explore how physical controls and documented standards create consistent, measurable protection.…
Transcript availableJune 16, 2025
S01E183Transcript
Domain 5 · Security Program Management and Oversight
Procedures and Playbooks (Domain 5)
Procedures and playbooks are the operational backbone of a mature security program—translating policy into detailed, repeatable steps for responding to specific threats or performing security tasks.…
Transcript availableJune 16, 2025
S01E184Transcript
Domain 5 · Security Program Management and Oversight
External Security Governance Considerations (Domain 5)
Security doesn't operate in a vacuum—organizations must navigate a complex web of external considerations that shape how security is governed.…
Transcript availableJune 16, 2025
S01E185Transcript
Domain 5 · Security Program Management and Oversight
Monitoring and Revising Governance Policies (Domain 5)
Security policies must evolve with technology, threat landscapes, and business goals—and that’s why continuous monitoring and revision are essential.…
Transcript availableJune 16, 2025
S01E186Transcript
Domain 5 · Security Program Management and Oversight
Governance Structures and Roles (Part 1) (Domain 5)
Security governance relies on a clear structure that defines how decisions are made, who enforces them, and how oversight is maintained.…
Transcript availableJune 16, 2025
S01E187Transcript
Domain 5 · Security Program Management and Oversight
Governance Structures and Roles (Part 2) (Domain 5)
Having a governance structure is only the beginning—the real value comes from clearly defining roles and responsibilities within that structure.…
Transcript availableJune 16, 2025
S01E188Transcript
Domain 5 · Security Program Management and Oversight
Risk Management Fundamentals (Domain 5)
Risk management is the engine that drives strategic decision-making in security, helping organizations focus their efforts on what matters most.…
Transcript availableJune 16, 2025
S01E189Transcript
Domain 5 · Security Program Management and Oversight
Conducting Risk Assessments (Domain 5)
Risk assessments provide the data organizations need to make informed security decisions, and in this episode, we explore the different types of assessments and how they’re conducted.…
Transcript availableJune 16, 2025
S01E190Transcript
Domain 5 · Security Program Management and Oversight
Risk Analysis and Scoring (Domain 5)
After risks are identified, they need to be analyzed and prioritized—and that’s where risk scoring comes in.…
Transcript availableJune 16, 2025
S01E191Transcript
Domain 5 · Security Program Management and Oversight
Risk Registers and Key Risk Indicators (Domain 5)
Managing risk at scale requires tools that provide structure and visibility, and in this episode, we examine two of the most important: risk registers and key risk indicators (KRIs).…
Transcript availableJune 16, 2025
S01E192Transcript
Domain 5 · Security Program Management and Oversight
Risk Appetite, Tolerance, and Thresholds (Domain 5)
Every organization must decide how much risk it is willing to accept in pursuit of its goals—and this decision informs every security investment, policy, and control.…
Transcript availableJune 16, 2025
S01E193Transcript
Domain 5 · Security Program Management and Oversight
Risk Management Strategies (Domain 5)
Once risks are identified and analyzed, organizations must decide how to respond—and in this episode, we examine the five primary risk management strategies: mitigate, transfer, accept, avoid, and exempt.…
Transcript availableJune 16, 2025
S01E194Transcript
Domain 5 · Security Program Management and Oversight
Risk Reporting and Communication (Domain 5)
Risk is meaningless if it isn’t communicated effectively—and in this episode, we focus on how risk reporting bridges the gap between technical findings and business leadership.…
Transcript availableJune 16, 2025
S01E195Transcript
Domain 5 · Security Program Management and Oversight
Business Impact Analysis (Domain 5)
Business Impact Analysis (BIA) is the foundation of business continuity and disaster recovery planning, helping organizations understand which processes matter most and how downtime affects operations.…
Transcript availableJune 16, 2025
S01E196Transcript
Domain 5 · Security Program Management and Oversight
Understanding Recovery Objectives (Domain 5)
Recovery objectives define how quickly and how completely a system must return to functionality after a disruption—and in this episode, we explore two of the most critical metrics: Recovery Time Objective (RTO) and Recovery Point Objective (RPO).…
Transcript availableJune 16, 2025
S01E197Transcript
Domain 5 · Security Program Management and Oversight
Mean Time Metrics and System Resilience (Domain 5)
System resilience depends not only on planning but on measurable performance—and in this episode, we explore four key metrics that define how systems behave under failure: Mean Time to Repair (MTTR), Mean Time Between Failures (MTBF), Mean Time to Detect (MTTD), and Mean Time to Respond (MTTR—the other one).…
Transcript availableJune 16, 2025
S01E198Transcript
Domain 5 · Security Program Management and Oversight
Vendor Risk and Supply Chain Considerations (Domain 5)
A growing portion of cybersecurity risk now comes from outside the organization—specifically, through third-party vendors, suppliers, and service providers.…
Transcript availableJune 16, 2025
S01E199Transcript
Domain 5 · Security Program Management and Oversight
Agreement Types and Contractual Security (Domain 5)
Contracts are one of the most powerful tools in managing cybersecurity obligations, and in this episode, we break down the types of agreements that define roles, responsibilities, and expectations with external parties.…
Transcript availableJune 16, 2025
S01E200Transcript
Domain 5 · Security Program Management and Oversight
Ongoing Vendor Monitoring and Engagement (Domain 5)
Vendor risk doesn’t stop after the contract is signed—ongoing monitoring and relationship management are critical for maintaining visibility and accountability.…
Transcript availableJune 16, 2025
S01E201Transcript
Domain 5 · Security Program Management and Oversight
Effective Compliance Reporting (Domain 5)
Compliance reporting ensures that an organization can demonstrate adherence to regulatory, contractual, and internal security requirements—and in this episode, we explore how to make it both accurate and efficient.…
Transcript availableJune 16, 2025
S01E202Transcript
Domain 5 · Security Program Management and Oversight
Consequences of Non-Compliance (Domain 5)
Failing to meet regulatory or contractual obligations can carry severe consequences, both financially and reputationally.…
Transcript availableJune 16, 2025
S01E203Transcript
Domain 5 · Security Program Management and Oversight
Attestation and Acknowledgement in Compliance (Domain 5)
Attestation and acknowledgement are critical for ensuring that individuals and third parties formally understand and accept their roles in maintaining security and compliance.…
Transcript availableJune 16, 2025
S01E204Transcript
Domain 5 · Security Program Management and Oversight
Privacy Laws and Global Compliance (Domain 5)
Data privacy is no longer just a legal issue—it’s a global business imperative, and this episode explores the complex and evolving landscape of privacy laws.…
Transcript availableJune 16, 2025
S01E205Transcript
Domain 5 · Security Program Management and Oversight
Data Inventory, Retention, and the Right to Be Forgotten (Domain 5)
Managing personal data effectively starts with knowing exactly what you have, where it lives, how long you keep it, and what rights users have over it.…
Transcript availableJune 16, 2025
S01E206Transcript
Domain 5 · Security Program Management and Oversight
Privacy and Legal Implications of Compliance (Domain 5)
Privacy and compliance are deeply intertwined, especially as global regulations push organizations to safeguard personal data across jurisdictions.…
Transcript availableJune 16, 2025
S01E207Transcript
Domain 5 · Security Program Management and Oversight
Data Management and Compliance (Domain 5)
Effective data management is critical for both operational success and regulatory compliance, and in this episode, we explore how organizations maintain control over what they collect, where it’s stored, and how long it’s retained.…
Transcript availableJune 16, 2025
S01E208Transcript
Domain 5 · Security Program Management and Oversight
Attestation and Internal Audits (Domain 5)
Attestation and internal audits are two of the most powerful tools for ensuring your security program is functioning as intended. In this episode, we start by exploring attestation—formal declarations that certify compliance with policies, procedures, or external frameworks.…
Transcript availableJune 16, 2025
S01E209Transcript
Domain 5 · Security Program Management and Oversight
Internal Audit Structures (Domain 5)
The effectiveness of internal audits depends not just on what’s reviewed, but on how the audit function is structured within the organization.…
Transcript availableJune 16, 2025
S01E210Transcript
Domain 5 · Security Program Management and Oversight
External Audits and Assessments (Domain 5)
External audits provide an independent review of an organization’s security and compliance posture, often driven by regulatory mandates, certification requirements, or contractual obligations.…
Transcript availableJune 16, 2025
S01E211Transcript
Domain 5 · Security Program Management and Oversight
Fundamentals of Penetration Testing (Domain 5)
Penetration testing goes beyond identifying vulnerabilities—it simulates real-world attacks to see how systems, defenses, and teams hold up under pressure.…
Transcript availableJune 16, 2025
S01E212Transcript
Domain 5 · Security Program Management and Oversight
Penetration Testing Environments (Domain 5)
The value of a penetration test is closely tied to how realistic the environment is—and in this episode, we examine the types of environments in which pen tests are conducted: known, partially known, and unknown.…
Transcript availableJune 16, 2025
S01E213Transcript
Domain 5 · Security Program Management and Oversight
Reconnaissance Techniques (Domain 5)
Reconnaissance is the first phase of any attack—and the first opportunity for defenders to detect malicious intent. In this episode, we break down both passive and active reconnaissance techniques used by ethical hackers and adversaries alike.…
Transcript availableJune 16, 2025
S01E214Transcript
Domain 5 · Security Program Management and Oversight
Effective Phishing Awareness (Domain 5)
Phishing remains one of the most effective—and dangerous—forms of cyberattack because it targets people, not systems.…
Transcript availableJune 16, 2025
S01E215Transcript
Domain 5 · Security Program Management and Oversight
Anomalous Behavior Recognition (Domain 5)
Cyber threats often hide in plain sight, masquerading as normal user activity until they trigger something unexpected—and that’s why recognizing anomalous behavior is such a valuable skill.…
Transcript availableJune 16, 2025
S01E216Transcript
Domain 5 · Security Program Management and Oversight
User Guidance and Training (Part 1) (Domain 5)
Users are often the first and last line of defense in cybersecurity, and their success depends on clear guidance and ongoing training.…
Transcript availableJune 16, 2025
S01E217Transcript
Domain 5 · Security Program Management and Oversight
User Guidance and Training (Part 2) (Domain 5)
Beyond basic policy understanding, users need targeted training in key risk areas that attackers frequently exploit—especially insiders, passwords, and privileged access.…
Transcript availableJune 16, 2025
S01E218Transcript
Domain 5 · Security Program Management and Oversight
User Guidance and Training (Part 3) (Domain 5)
Security training must evolve with the threat landscape—and that means addressing common but high-risk topics like removable media, social engineering, and operational security (OPSEC).…
Transcript availableJune 16, 2025
S01E219Transcript
Domain 5 · Security Program Management and Oversight
Hybrid and Remote Work Security Awareness (Domain 5)
Remote and hybrid work models create new layers of security complexity—blending corporate environments with home networks, personal devices, and cloud-first workflows.…
Transcript availableJune 16, 2025
S01E220Transcript
Domain 5 · Security Program Management and Oversight
Security Reporting and Monitoring (Domain 5)
A well-informed workforce should be empowered not just to avoid risk—but to report it.…
Transcript availableJune 16, 2025
S01E221Transcript
Domain 5 · Security Program Management and Oversight
Developing and Executing Security Awareness Programs (Domain 5)
Security awareness programs don’t happen by accident—they’re built with intent, tested with feedback, and refined over time.…
Transcript availableJune 16, 2025
No matching lessons
Try another term or clear one of the filters.
A Practical Study Routine
Listen, read, and review in the order that works for you.
Listen
Use the free audio course during a commute, walk, workout, or focused study session.
Read
Use the study guide to organize the material, annotate key ideas, and build a reference you can return to.
Review
Use the flashcards book to practice active recall and quickly revisit weak areas.
Related Magazine Features
Connect the course to current cybersecurity analysis.
Issue 49 · December 9, 2026Metrics That Move Money: Turning Security Data into Budget DecisionsRead the feature →
Issue 46 · November 18, 2026Access Broker Auction House: The Market Where Your Network Gets SoldRead the feature →
Issue 45 · November 11, 2026M&A Malware: Security Debt Hidden Inside AcquisitionsRead the feature →
Related Cyber Wiki
Continue with the concepts behind the course.
Identity and access concept
802.1X Network Access Control
802.1X Network Access Control is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.
ATT&CK Software AnalysisAADInternals (S0677)
A defensive guide to the Enterprise ATT&CK software record S0677, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a PowerShell framework used to administer, enumerate, and test Azure Active Directory environments.
ATT&CK Software AnalysisACAD/Medre.A (S1000)
A defensive guide to the Enterprise ATT&CK software record S1000, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a worm that collects AutoCAD drawings and can expose operational or engineering information.
AI policyAI Acceptable Use Policy
An AI acceptable use policy defines approved, restricted, and prohibited uses of AI services, models, data, accounts, and generated content.
Agentic AIAI Agents and Tool Use
An AI agent selects actions and invokes tools, services, or workflows to pursue a goal across multiple steps.
AI assuranceAI Audit Evidence Integrity
AI audit evidence integrity is the ability to show that logs, model artifacts, data extracts, test results, approvals, and screenshots are authentic, complete, attributable, and unchanged.