Hack & Learn

Useful skills for your digital life. Start here if you are new.

1. 01Start with everyday securitySix small lessons. Real decisions. A safer digital life, one useful habit at a time.5 min
   6 lessons

   1. Spot the messageAn urgent text arrives. Practice the small pause that changes what happens next.5 min
   2. Stronger sign-insProtect the accounts you care about without turning every login into homework.5 min
   3. Safer browsingA secure connection and a trustworthy website are two different questions.5 min
   4. A safer phone or computerMake updates, screen locks, and app permissions do some of the work for you.5 min
   5. Keep what mattersYour photos and files deserve both a private home and a way back.5 min
   6. When things go wrongA calm next step is a skill. Practice recovering and asking for help.5 min

Meet your guide and find a route that fits your curiosity.

1. 02Why this is freeMeet the teacher, choose a comfortable route, and learn with free explanations and in-page practice.9 min
2. 03Find your way through the libraryChoose a starting point, learn one idea, and return when you have a question.9 min
3. 04Security frameworks: choose the right mapProcesses, controls, weakness names, and severity scores answer different questions.7 min

The stories behind the computers and ideas we use today.

1. 05Where hacking comes fromTrace changing systems, motives, and consequences, from telephone signaling to internet worms and industrial control.10 min
   2 lessons

   1. The Morris worm and the need to coordinateHow a 1988 disruption helped turn incident response into a shared organizational capability.8 min
   2. When one incident reaches many organizationsWannaCry, SolarWinds, and the shared dependencies that turn technical events into wider disruption.8 min
2. 06How computers got hereFollow the ideas that connect mechanical calculation, stored programs, shared machines, personal devices, and cloud systems.7 min
   4 lessons

   1. From punched cards to stored programsDiscover why recording data, representing instructions, and protecting changes are three different problems.7 min
   2. From transistors to personal computersFollow the shift from scarce shared equipment to personal machines, and discover who inherited the maintenance work.7 min
   3. From packet switching to the WebSeparate the network that carries information from the Web that makes linked information accessible.7 min
   4. Virtualization and the cloudSee how an old resource-sharing idea became on-demand infrastructure, with new management responsibilities.7 min
3. 07Operating systemsExplore how Unix, Windows, macOS, and mobile systems organize work, identities, and access to shared resources.7 min
   4 lessons

   1. Time-sharing and the invention of boundariesLearn why sharing an expensive computer made identity, isolation, and controlled cooperation central design problems.7 min
   2. Unix, portability, and open sourceUntangle design influence, code ancestry, compatibility, and the work required to maintain shared software.7 min
   3. From personal PCs to Windows NTUnderstand why familiar desktops can hide very different assumptions about users, applications, and authority.7 min
   4. Mobile sandboxes and the update promiseFollow the shift from a personal computer to a pocket platform full of separately trusted applications.7 min
4. 08A short history of AIExplore overlapping traditions in rules, learning, perception, and agents, and how to evaluate their real effects.10 min
5. 09Language modelsFrom local word statistics to neural representations, transformers, retrieval, and assistants, with clear limits on memory and trust.12 min

Understand the vocabulary, systems, and boundaries.

1. 10The words that make security clearerExplain what needs protection, what happened, and what the evidence supports.9 min
   2 lessons

   1. Assets, threats, and riskFollow one ordinary booking problem from what matters to what could help.8 min
   2. Evidence and security claimsLearn to say what happened, what you infer, and what you still need to know.7 min
2. 11Computers and networksConnect processes, identities, names, transport, and web requests without needing a terminal.12 min
   2 lessons

   1. Data, memory, and executionFollow a photo from storage into a running process, and see where its authority comes from.7 min
   2. Names, addresses, and portsSeparate finding a destination from reaching it and being allowed to use it.7 min
3. 12Network architecturesFollow a request through zones, gateways, and application controls without mistaking a diagram for a guarantee.9 min
   2 lessons

   1. A packet’s journeyFollow one fictional message across links without mixing up local delivery and the final destination.8 min
   2. Segments, routes, and policyTurn a colorful network drawing into explicit decisions about who can communicate and why.7 min
4. 13Web application architecturesSee how browser, application, and data services cooperate, and where each must enforce its own rules.9 min
   2 lessons

   1. From click to responseFollow a ticket booking through presentation, transport, service decisions, and durable data.7 min
   2. State, cookies, and sessionsExplain how a site remembers a visit without confusing browser storage with identity or permission.7 min
5. 14AuthenticationSeparate proving account control, maintaining a session, and deciding what an account may do.9 min
   2 lessons

   1. Identity, credentials, and sessionsFollow a fictional account from registration to sign-in, return visits, and recovery.7 min
   2. Authentication versus authorizationA valid account still needs permission for the particular action, object, and moment.7 min
6. 15CryptographyMatch encryption, hashes, signatures, and key establishment to the guarantees your information needs.8 min
   2 lessons

   1. Hashes, MACs, and signaturesChoose the evidence needed to check a file, a shared-secret message, or a public announcement.7 min
   2. Encryption, keys, and trustFollow the decisions behind private communication and recoverable encrypted data.7 min
7. 16Layer 2 and wirelessUnderstand local links, VLANs, network admission, and Wi-Fi protection as different controls with different limits.9 min
   2 lessons

   1. Switches, ARP, and broadcastsSeparate a switch’s forwarding memory from an endpoint’s address-resolution memory.7 min
   2. Wireless authentication and encryptionSeparate joining a radio network, protecting a link, and trusting an application.7 min
8. 17Learn with care: permission, people, and AISimple habits that keep curiosity useful and give you room to learn safely.11 min
   2 lessons

   1. Scope, consent, and dataMake a learning activity clear enough that everyone understands the environment, the limits, and what happens to information.7 min
   2. Checking AI explanationsTurn a fluent answer into separate claims that you can compare with evidence and context.8 min

Understand the mechanisms, design better controls, and make informed decisions.

1. Reconnaissance: building an evidence-based mapTurn names, service observations, and inventory records into a useful map without mistaking clues for conclusions.ATT&CK TA0043 Reconnaissance9 min
   8 lessons

   1. Inventory starts with a decisionChoose inventory fields that let a responsible team make a maintenance decision.3 min
   2. Scope has inclusions and exclusionsMatch assets, activities, timing, and exclusions to a written review agreement.3 min
   3. Keep observations attached to sourcesPreserve source relationships so copied observations do not look like independent confirmation.3 min
   4. DNS answers are time-bound evidenceInterpret resolver timing and caching without turning a DNS answer into an ownership claim.3 min
   5. A banner is a clue, not a verdictConnect a reported version to the distributor’s fix record and the software actually running.3 min
   6. Ownership changes over timeKeep proposed ownership transfers separate from accepted operational responsibility.3 min
   7. Exposure is a property to verifyDescribe reachability using the observed path and layer, with untested contexts left unknown.3 min
   8. Separate unknown from absentApply explicit evidence rules to fresh, stale, and retired inventory records.4 min
2. Initial access and credentialsUnderstand how network services recognize accounts, protect credentials, and limit the authority of a session.ATT&CK TA0001 Initial Access · TA0006 Credential Access11 min
   8 lessons

   1. Ports do not authenticate a serviceDistinguish a familiar port number from evidence of an authenticated connection.3 min
   2. A connection is not an authorizationUse a layered record to distinguish a connection problem from an expected permission decision.3 min
   3. TLS protects between its endpointsReview each protected connection and the separate handling of decrypted data.3 min
   4. Store verifiers, not reusable passwordsSeparate salt, password-hashing cost, and account recovery when reviewing stored credentials.3 min
   5. Recovery belongs in the MFA designDistinguish recovery notifications from evidence that factor replacement was authorized.3 min
   6. A token needs an intended recipientUse a simplified token-validation record to keep issuer trust, audience, and application permission separate.3 min
   7. Reuse joins separate failure boundariesCompare credential material and accepted authority instead of relying on account names.3 min
   8. Revocation is a defined behaviorUse a retirement timeline to distinguish blocked new sign-ins from continuing application sessions.3 min
3. Web applicationsFollow a request through identity checks, resource permissions, interpreters, and browser protections.ATT&CK TA0001 Initial Access11 min
   27 lessons

   1. HTTP and proxiesRead requests, understand cookies, and separate transport protection from application permissions.11 min
   2. Mapping a web surfaceBuild a useful inventory of resources, identities, data flows, and uncertainty.9 min
   3. Understanding client-side JavaScriptFollow data through browser code and distinguish public configuration from privileged secrets.9 min
   4. Cross-site scriptingUnderstand browser parsing contexts, safe rendering, and why one encoding rule cannot fit every destination.11 min
   5. SQL injectionKeep query structure separate from values, and distinguish prevention from permission and impact.9 min
   6. Command and argument injectionUnderstand the difference between shell parsing and a program interpreting its arguments.9 min
   7. Files, uploads, and path boundariesFollow uploaded content from naming to storage, processing, and authorized retrieval.9 min
   8. Server-side trust boundariesUnderstand URL fetchers, templates, XML, and deserialization as distinct trust decisions.9 min
   9. Authentication and accessSeparate identity, sessions, token validation, and permission for each resource.9 min
   10. APIs and GraphQLReview object permissions, property permissions, and resource cost across different API styles.9 min
   11. Securing common applicationsConnect product inventory, identity, advisories, and maintainable hardening decisions.9 min
   12. Sessions: what happens after sign-inFollow a login from a fresh session to renewal, revocation, and a safe goodbye.11 min
   13. Browser boundaries: origins, CORS, and CSRFSeparate who may read a response from who may send a request.11 min
   14. Authorization: a decision for every objectWhy a valid login and an unpredictable identifier still do not establish permission.11 min
   15. Keep data separate from instructionsFollow one piece of text through validation, a database query, and a page.11 min
   16. Business logic: valid steps, invalid outcomesReason about money, workflow state, repeated requests, and the rules a business must preserve.11 min
   17. Every request crosses a boundaryReview a booking change by separating accepted data from permitted actions.3 min
   18. Output safety depends on contextDecide why a safe display name does not automatically make a profile link safe.4 min
   19. Query structure and values are differentReview a search design without confusing bound values with selectable query structure.3 min
   20. Uploads are a lifecycle, not a checkboxFollow one uploaded document through acceptance, processing, and retrieval.4 min
   21. Server fetches need destination policySeparate permission to import a picture from permission to use the server’s network.4 min
   22. Cookies do not prove action intentReview a cookie-based change without treating session recognition as proof of intent.3 min
   23. Caches must preserve privacy boundariesChoose a cache policy that preserves a personalized page’s intended audience.3 min
   24. Retries should not repeat consequencesUse a reservation ledger to reason about retries after an uncertain response.4 min
   25. Check and update must agreeRead a two-worker timeline and protect the last available seat.4 min
   26. Errors need useful but limited detailTurn an uncertain booking failure into useful messages for two audiences.4 min
   27. Case study: review a document-access policyUse supplied roles, documents, and review notes to decide what the server should permit and what evidence is missing.11 min
4. Memory safety: boundaries and lifetimesUnderstand what a program may access, why memory errors differ, and how developers prevent them.ATT&CK TA0002 Execution9 min
   6 lessons

   1. A length must fit the destinationCheck a text conversion against a byte budget, including its terminator.4 min
   2. Objects have lifetimesUse a job timeline to distinguish a saved reference from a live object.4 min
   3. Arithmetic has representation limitsCheck a derived allocation size against arithmetic and application limits.4 min
   4. Mitigations do not repair the defectSeparate protection settings, a candidate correction, and verified deployment.4 min
   5. Fuzzing explores input behaviorInterpret a clean test run using what the test actually exercised.4 min
   6. Memory safety is not all securityMap memory guarantees, native dependencies, and document permissions separately.4 min
5. Privilege escalationUnderstand how process identity, permissions, and trusted dependencies determine effective authority.ATT&CK TA0004 Privilege Escalation10 min
   44 lessons

   1. Linux privilege escalationUnderstand who can do what: identities, permissions, delegation, and the dependencies that make Linux privilege boundaries work.8 min
      Explore this topic21 lessons

      1. Linux process identityUse a process credential snapshot to explain a file-access decision.4 min
      2. Owner, group, and otherChoose the applicable class before evaluating a requested operation.3 min
      3. Directories control names and traversalSeparate listing a directory from resolving a file within it.3 min
      4. ACLs add named permissionsCalculate effective named-user rights from an entry and its mask.3 min
      5. Special bits need a purposeSeparate directory sticky-bit protection from file content permissions.4 min
      6. Capabilities split privileged authorityDistinguish a capability boundary setting from authority currently held.4 min
      7. Delegation is more than a command nameReview the task, target identity, and trusted inputs behind a delegation rule.4 min
      8. Give services their own identityCheck whether separate service identities actually have separate data access.4 min
      9. Scheduled work inherits a trust chainSeparate a timer firing from a successful job and a verified output.4 min
      10. Search paths are trust decisionsExplain what an explicit dependency location proves and what it leaves unresolved.4 min
      11. Loaded libraries share process authorityReview a native plugin separately from the trusted program that loads it.4 min
      12. Local secrets need a lifecycleSeparate deleting a local secret from ending the access it grants.3 min
      13. Container isolation has dimensionsJudge a container by its actual resource grants, not its isolation label.3 min
      14. Mandatory policy adds another boundaryCheck whether mandatory policy actually constrains the process in your record.3 min
      15. Kernel updates need completion evidenceConnect a vendor correction to the kernel code actually running.3 min
      16. Review a Linux boundary as a wholeRead a hardening score alongside the checks and identities it actually covers.3 min
      17. New files begin with a permission decisionWork out a new file’s permissions and identify what a default change leaves untouched.3 min
      18. A local socket is still an access boundarySeparate permission to contact a local service from permission to change its policy.3 min
      19. A management group can carry broad powerTreat management-group membership as delegated authority, including existing sessions.3 min
      20. Mount options have specific jobsMatch mount restrictions to the exact path and operation being reviewed.4 min
      21. Case: review an archive's Linux permissionsRead an ACL, separate old files from new defaults, and propose the smallest justified correction.10 min
   2. Windows privilege escalationUnderstand tokens, access checks, and service authority through small decisions.11 min
      Explore this topic21 lessons

      1. Windows access tokensRead group attributes in the token used for a particular access check.3 min
      2. SIDs identify security principalsRead an account-lifecycle record without confusing a reused name with an existing identity.3 min
      3. DACLs describe permitted accessDistinguish a present empty DACL from an absent discretionary restriction.3 min
      4. Inherited access needs a reviewCompare inherited access with the actual confidentiality requirement.3 min
      5. UAC and administrative contextEvaluate an unexpected elevation request using the approved task, publisher, and execution context.3 min
      6. Integrity levels are another inputExplain different results for two same-user processes using a supplied integrity policy.3 min
      7. Service identities have different reachCompare service-account candidates against a supplied local and network resource requirement.3 min
      8. Service configuration is authoritySeparate viewing service status, controlling execution, and changing configuration.3 min
      9. Scheduled tasks need complete boundariesReview a monthly task using its principal, approved duties, and definition-management permissions.3 min
      10. DLL loading extends the trust boundaryAssess a supplied dependency inventory without treating an approved executable as approval for every loaded library.4 min
      11. Impersonation is scoped responsibilityRead a supplied request trace and distinguish client context from the service process identity.4 min
      12. User rights differ from file permissionsEvaluate a system privilege separately from folder access and its present token state.3 min
      13. Protect local credential copiesFollow a fictional credential copy from protected disk to a diagnostic bundle with broader readers.4 min
      14. Local administrator passwords need ownershipSeparate a successful managed-password rotation from retrieval rights and local administrator membership.3 min
      15. Credential isolation has a defined scopeRead a fleet snapshot without equating a requested Credential Guard policy with active, universal protection.4 min
      16. Patch state includes restarts and recoveryClassify three fictional update records using applicability, restart state, and observed service behavior.4 min
      17. Registry settings have their own permissionsCompare a configuration key's effective permissions with the distinct duties of support and release roles.3 min
      18. A network share adds another access checkCompare local and SMB access to the same file using supplied effective permissions.4 min
      19. Service SIDs make permissions more specificExplain why adding a service-specific grant does not remove a broader shared-account grant.3 min
      20. Boot integrity and disk secrecy differReview startup trust, encryption state, active protection, and recovery access as distinct travel-readiness requirements.4 min
      21. Case study: review a Windows service boundaryCompare a fictional service’s approved duties with supplied permissions, then write a correction and verification decision.9 min
6. Defenses and detectionConnect prevention, detection, response, and recovery to specific risks and evidence of effectiveness.ATT&CK TA0005 Defense Evasion (defender view)11 min
   14 lessons

   1. How antivirus and EDR protect endpointsFollow an event from a device to a decision, and learn what a quiet dashboard can and cannot tell you.6 min
   2. Segmentation: make every connection earn its placeUnderstand network boundaries, identity checks, and the limits of a firewall.10 min
   3. Detection: why a good alert needs contextExplore signal, noise, base rates, and the evidence behind an alert.11 min
   4. Hardening: reduce what a device has to trustBuild a maintainable baseline for devices, services, and administrative access.10 min
   5. Recovery: how much time and data can you lose?Explore RPO, RTO, backup isolation, and the difference between a backup and a restore.11 min
   6. A control needs an objectiveMeasure whether a monitoring workflow meets its promised outcome.3 min
   7. Layers should not share every failureFind the shared dependency behind three apparently separate protections.3 min
   8. Log fields need defined meaningsUse an event dictionary before deciding that a queued job completed.3 min
   9. Monitor the monitoring pathExplain a quiet dashboard using source, collection, and parsing evidence.4 min
   10. Thresholds trade workload and coverageDoes lower volume alone prove a better rule?4 min
   11. Response actions need authorityUse an approval matrix before a response affects a shared service.4 min
   12. Recovery copies need separate protectionReview whether a protected backup still depends on unavailable production keys.3 min
   13. Exceptions need an end conditionDistinguish an expired approval from a control that was actually restored.4 min
   14. Case: a quieter queue, a missed changeCompare two fictional detection designs using labeled cases, review time, and missing coverage.10 min
7. Active DirectoryUnderstand directory objects, groups, domain controllers, and the relationships that produce effective access.ATT&CK TA0006 Credential Access · TA0008 Lateral Movement10 min
   14 lessons

   1. Reading an Active Directory environmentBuild a useful identity map without confusing what you can see with what you can change.7 min
   2. Understanding identity access pathsRead a chain of relationships, check its conditions, and choose a control that removes unnecessary authority.9 min
   3. Movement, sessions, and lasting accessSeparate reaching another system from keeping access over time, then reason about evidence and recovery.7 min
   4. Kerberos without the alphabet soupUnderstand the ticket office, the service ticket, and why time and naming matter.10 min
   5. Privilege is a responsibility with an expiry dateDesign administrative access around purpose, separation, approval, and removal.10 min
   6. Certificates: who gets to vouch for whom?Understand public keys, issuers, validation, and the difference between encryption and identity.11 min
   7. A directory describes; services enforceSeparate a recorded directory change from the decision a consuming application actually makes.4 min
   8. Nested groups change effective accessFollow a supported membership chain all the way to the resource permission it grants.4 min
   9. Delegate an operation, not a vague roleExpress administrative delegation as an operation on a defined set of directory objects.4 min
   10. A trust is not universal permissionRead trust direction separately from the permissions on a resource across that boundary.4 min
   11. Service names need accountable ownersConnect a Kerberos service name to its intended sign-in account before changing authority.3 min
   12. Configured policy is not applied policyUse scope, security filtering, and device evidence to distinguish policy intent from application.3 min
   13. Moving roles should remove old accessCompare a role-change approval with surviving access, including temporary handover exceptions.3 min
   14. Identity is a recovery dependencyFind circular recovery dependencies before treating a successful backup as a usable recovery plan.3 min
8. Cloud identityConnect cloud identities, role scope, token audiences, and credential lifecycles to effective resource access.ATT&CK TA0006 Credential Access · TA0008 Lateral Movement10 min
   12 lessons

   1. Cloud security: who owns which problem?Compare virtual machines, managed services, and SaaS without assuming the provider does everything.11 min
   2. Machines need identities tooGive applications limited, renewable access without treating a long-lived secret as a permanent solution.11 min
   3. Protect data through its whole lifeConnect classification, encryption, access, retention, and deletion.11 min
   4. Responsibility follows the service modelUse a migration record to assign database security work without leaving an ownership gap.3 min
   5. Management and data paths differDecide whether seeing a storage account’s settings authorizes reading its reports.4 min
   6. Resource policies need concrete scopeCompare two permission records to find why a narrow role still has a broad grant.4 min
   7. Temporary credentials still carry authorityCompare a job’s allowed actions with its credential lifetime and renewal eligibility.4 min
   8. Federation needs a specific subjectDecide whether a valid external token represents the particular job your trust record accepts.4 min
   9. Metadata can be an identity dependencyReview whether two processes on one cloud instance should share its attached identity.4 min
   10. Audit events need identity contextDecide what an empty data-read search means when the trail collected management events only.4 min
   11. Deleting compute does not retire everythingReview a retirement package containing terminated compute, retained storage, and a shared identity.4 min
   12. Case: review a cloud permission proposalTurn a fictional identity inventory and approved workflows into a narrow, reviewable access plan.10 min
9. Pivoting, proxies, and network boundariesFollow how connections cross intermediaries, while keeping routes, policy, and application identity separate.ATT&CK TA0008 Lateral Movement9 min
   4 lessons

   1. A route is not a permissionRead three access checks without confusing connectivity, identity, and resource authority.4 min
   2. A bastion concentrates a boundaryReview a recovery access plan without losing the controls a gateway normally provides.4 min
   3. Temporary access needs closureCompare a support deadline with the actual closure of access and sessions.4 min
   4. Observe the whole access pathBuild a careful explanation from gateway and destination records with different meanings.4 min
10. AI on offenseUnderstand AI application risks across models, data, generated output, tool permissions, and operational controls.MITRE ATLAS11 min
    11 lessons

    1. Prompt injection and instruction boundariesUnderstand why a document is not an instruction from the user, and where an AI application must enforce that distinction.8 min
    2. AI data, retrieval, and safe outputFollow information into and out of an AI feature, with separate controls for source integrity, permissions, and rendering.7 min
    3. AI reliability and privacy risksSeparate misleading a prediction from learning about its data, and understand what evidence supports each claim.7 min
    4. Designing layered AI defensesGive an AI feature a useful job, a limited identity, and checks that remain effective when its answer is wrong.7 min
    5. AI systems: suggestions and authorityUnderstand untrusted content, tool permissions, output handling, and human review.11 min
    6. Retrieved text is evidence, not authoritySeparate a relevant document from a source authorized to change a workflow.4 min
    7. Tools need independent permission checksEvaluate a proposed tool action against the caller’s actual resource permissions.4 min
    8. Generated output still needs validationReview generated content separately for structure, factual support, and disclosure.4 min
    9. Evaluation needs failure casesBreak down an impressive average to find a failed critical requirement.4 min
    10. Give the model only needed contextSelect the context needed for one task even when the caller can read much more.4 min
    11. Approval needs a reviewable actionCompare an approved draft with the exact action that is about to happen.4 min
11. Threat modeling: ask before buildingMap a system, identify trust boundaries, and choose controls for realistic failure stories.11 min
    11 lessons

    1. Secure development: requirements to evidenceCarry security requirements through design, implementation, testing, and maintenance.11 min
    2. Software supply chains: know what you are shippingDistinguish component inventory, build provenance, signatures, and trust.11 min
    3. Turn security wishes into requirementsTurn a privacy goal into an observable actor, action, and data rule.4 min
    4. A trust boundary is not a network lineDistinguish an authenticated relay from authority to approve a business decision.4 min
    5. Design what happens when checks failDefine a safe pending state when a document permission check is unavailable.4 min
    6. Make the initial choice a safe oneCheck the initial audience across ordinary creation and template-based creation.4 min
    7. Collect less, protect a smaller footprintChoose fields and retention from the job they serve, including copies outside the main form.4 min
    8. Name the rules that must always holdAttach a security rule to the protected state, including revisions and background work.4 min
    9. Ask how a useful feature could cause harmTurn a feature’s plausible unwanted outcome into a requirement that preserves its useful purpose.4 min
    10. A signature answers a limited questionKeep signature validity separate from release suitability, support, and software behavior.4 min
    11. Case study: decide whether a change is readyReview a fictional release packet for logging, session handling, dependency changes, and recovery before making an evidence-based decision.9 min
12. Incident response: decisions under uncertaintyConnect preparation, analysis, containment, recovery, and learning.11 min
    9 lessons

    1. Digital evidence: the story and its limitsUnderstand integrity, provenance, timelines, and confidence without overclaiming.11 min
    2. Tabletop: practice a security incident togetherRun a fictional scenario that reveals decision, communication, and recovery gaps.12 min
    3. Triage is a decision under uncertaintyPrioritize an unresolved account alert without declaring travel or compromise proven.4 min
    4. Containment changes the situationChoose a proportionate response using a supplied service-impact comparison.4 min
    5. Share the facts each audience needsPrepare a leadership update that supports a decision without inventing a cause.4 min
    6. A timestamp needs clock contextCompare event-time ranges before claiming which event happened first.3 min
    7. Some evidence disappears as systems changeBalance a temporary memory record against an explicitly documented harm deadline.4 min
    8. Define what makes recovery completeDecide whether a reachable service has met its agreed return-to-operation checks.4 min
    9. Case: the booking service is downSeparate service impact from compromise claims, then decide what counts as a verified recovery.10 min
13. Reporting: turn evidence into useful improvementsWrite findings people can understand, prioritize, and fix, while being clear about what the evidence actually shows.9 min
    11 lessons

    1. Prioritization: severity is not the whole riskCombine technical severity, exposure, exploitation evidence, and business consequences.11 min
    2. Write findings people can understand and fixSeparate observations, impact, uncertainty, and actionable recommendations.11 min
    3. Separate observation from inferenceReport a broad permission without claiming that somebody used it.4 min
    4. A clean result has a coverage boundaryUse a coverage matrix without turning a clean sample into a security guarantee.3 min
    5. Evidence needs enough context to reviewTurn an isolated screenshot into a record another reviewer can interpret.4 min
    6. Fix the cause behind the visible symptomSeparate a visible fix from evidence that a shared defect was corrected.4 min
    7. Severity is one input to a risk decisionGive two installations different priorities without rewriting their shared severity assessment.4 min
    8. A probability is not an incident verdictRead a 4% forecast and a 91st-percentile rank without inventing a local incident probability.4 min
    9. A recommendation needs an owner and outcomeTurn a “development complete” update into an accountable verification plan.4 min
    10. A retest answers a specific follow-upDoes a successful retest replace a full assessment?3 min
    11. Case: write a prioritized remediation briefUse a fictional evidence packet to recommend treatment, ownership, and meaningful closure criteria.10 min

Free in-page activities: predict, explore, and explain one idea.

1. 31The gym: practice one small ideaFree activities you can do here, with a phone, a few minutes, and your curiosity.9 min