Curriculum taxonomy
Cybersecurity domains
13 sections and 135 topic titles for advanced study — mapped to specialization roadmap levels 28–42, labs, and quizzes.
Visual tracks
Same art language across Learn — each domain keeps a unique identity.
Cybersecurity Fundamentals
CIA triad, threats, and security mindset
Ethical Hacking & Pentest
Authorized recon → exploit → report
Web Application Security
OWASP, APIs, and secure fixes
Bug Bounty Hunting
Scope, validation, pro reports
SOC Analyst & Blue Team
SIEM, triage, detection craft
Network Security
Packets, firewalls, hardening
Cloud Security
IAM, misconfigs, containers
Mobile App Security
Android / iOS analysis labs
AI & ML Security
LLM risks and model defenses
Agentic AI Security
Tool-calling agents & swarms
DFIR
Forensics and incident response
Certifications Prep
Security+, CEH, OSCP-style prep
Specialization roadmap
- Level 28API Security Specialist
- Level 29Identity & Access Management
- Level 30Advanced DevSecOps & CI/CD Security
- Level 31Docker & Kubernetes Security
- Level 32Wireless & Bluetooth Security
- Level 33IoT, ICS & SCADA Security
- Level 34Governance, Risk & Compliance
- Level 35Threat Modeling & Secure Architecture
- Level 36Advanced Detection Engineering
- Level 37Enterprise Security Architecture
- Level 38AI & LLM Application Security
- Level 39Agentic & Multi-Agent Security
- Level 40Software Supply Chain Security
- Level 41Purple Team & Adversary Emulation
- Level 42Enterprise Security Operations
Application & API Security
- REST API Security
- GraphQL Security
- API Authentication
- OAuth 2.0 Security
- OpenID Connect
- JWT Advanced Security
- API Rate Limiting
- API Authorization
- API Gateway Security
- WebSocket Security
- Microservices Security
- Serverless Application Security
- Business Logic Vulnerability Testing
- Source Code Security Review
Advanced Web Security
- DOM-Based XSS
- Blind SQL Injection
- Second-Order SQL Injection
- XXE
- HTTP Request Smuggling
- HTTP Response Splitting
- Cache Poisoning
- Cache Deception
- Prototype Pollution
- Race Conditions
- Web Cache Security
- CORS Misconfiguration
- CSP Bypass Concepts
- OAuth Vulnerability Testing
- Web Application Threat Modeling
Identity & Access Management
- Identity and Access Management Fundamentals
- Privileged Access Management
- Identity Federation
- SAML Security
- Multi-Factor Authentication Security
- Passwordless Authentication
- Zero Trust Architecture
- Identity Governance
- Service Account Security
- Secrets Management
- Identity Attack Detection
Advanced Network Defense
- VLAN Security
- Network Segmentation
- NAC
- SDN Security
- DNS Security
- DNSSEC
- Email Security
- SPF, DKIM and DMARC
- DDoS Defense
- Secure Network Architecture
- Network Traffic Anomaly Detection
- Network Detection and Response
Endpoint & Enterprise Security
- Endpoint Security Fundamentals
- EDR and XDR
- Endpoint Hardening
- Application Control
- Patch Management
- Endpoint Detection Engineering
- Enterprise Asset Management
- Device Security
- Endpoint Incident Investigation
Cloud-Native & DevSecOps
- Cloud Threat Modeling
- Infrastructure as Code Security
- Terraform Security
- CI/CD Pipeline Security
- GitHub Actions Security
- Software Composition Analysis
- SAST and DAST
- Software Supply Chain Security
- SBOM
- Secrets Detection
- Cloud Incident Response
Container & Supply Chain Security
- Container Image Security
- Docker Image Scanning
- Kubernetes RBAC
- Kubernetes Network Policies
- Container Runtime Security
- Kubernetes Threat Detection
- Software Dependency Security
- Dependency Confusion
- Code Signing
- Software Provenance
- Secure Build Pipelines
Wireless, IoT & OT Security
- Wi-Fi Security Architecture
- WPA2 and WPA3
- Bluetooth Security
- IoT Device Security
- Firmware Security
- ICS Security
- SCADA Security
- OT Network Security
- Critical Infrastructure Protection
Digital Forensics & Malware Advanced
- Windows Forensics
- Linux Forensics
- Memory Acquisition
- Timeline Analysis
- Malware Static Analysis
- Malware Dynamic Analysis
- YARA Rule Development
- Reverse Engineering Fundamentals
- Ransomware Analysis
Governance, Risk & Compliance
- GRC Fundamentals
- ISO 27001
- SOC 2
- NIST Cybersecurity Framework
- CIS Controls
- PCI DSS
- GDPR Security and Privacy
- Indian DPDP Act
- Third-Party Risk Management
- Business Continuity
Security Architecture & Engineering
- Threat Modeling
- STRIDE
- Attack Surface Management
- Secure SDLC
- Zero Trust Design
- Enterprise Security Architecture
Threat Intelligence & Advanced Defense
- Cyber Threat Intelligence Lifecycle
- MITRE ATT&CK Advanced
- MITRE D3FEND
- STIX and TAXII
- Sigma Rule Development
- Detection Engineering
- Purple Team Operations
- Adversary Emulation
- Security Automation and SOAR
AI & Emerging Technology Security
- LLM Application Security
- Prompt Injection Defense
- RAG Security
- Vector Database Security
- AI Agent Tool Permissions
- Multi-Agent Security
- AI Red Teaming
- OWASP Top 10 for LLM Applications
- OWASP Top 10 for Agentic Applications
Practice in Labs, CTF practice, and Roadmap.