Cyber Commons · Course guidesHow the work changes when agents do it.
Breakout time — how long it takes an attacker to get from first access to moving sideways — is now 29 minutes. The fastest on record is 27 seconds. Most security work is still done more slowly than that: architecture reviewed every few months, alerts read one at a time, controls checked once a year.
Six tracks. The first builds an agentic system, and the other five each take one part of a security organisation — architecture and infrastructure, application security, offensive security, the SOC and governance — and teach how that work changes when agents do it. You also learn how to secure the AI itself.
Every lesson answers three questions in order: Day 0, why this is worth doing; Day 1, the thing you build; Day 2, the number that tells you next quarter that it still works.
Open source: every tool named in the lessons is open source.
Runs on: your own computer. Nothing to install beyond Python and Git, no GPU, no licence — the one thing you need is a model.
Where to start: A0.0 — Set up your computer — what this is, who it is for, and the model every lesson runs on, whatever your job is.
The system the other five tracks are about. Set your machine up and build it. Start here whatever your job is.
For: Everyone, first · the system the other five tracks are about · 16 lessons
A0 Set Up — Your Machine, How to Use This, and the Words for an Agent (2) · A1 Build the Agent — From a Loop to a Running Platform (8) · A2 Harness Engineering — Making a Demo Into a System (6)
What changes in architecture and infrastructure security. Name every risk the system carries, then close them — identity and ingress first, then the runtime layer under both.
For: Architecture and infrastructure security · architects · engineers shipping an agentic feature · 39 lessons
B1 CyberTravels' Architecture, and Every Risk It Carries (20) · B2 Securing the Architecture — Identity and Ingress (8) · B3 Securing the Architecture — Runtime and the Gateway (11)
What changes in application security when agents write the code: a pipeline that keeps up, with a check that is not another model.
For: Application security · AppSec and product security engineers · penetration testers · 20 lessons
C2 The AI SDLC — an Agentic AppSec Pipeline, Before and After Deploy (20)
What changes in a red team. One lifecycle end to end, and findings that happen again rather than once.
For: Offensive security and evaluation · red team operators · AI security researchers · 12 lessons
What changes in a SOC, across five intervals of one clock: would you see it, could you stop it, and could you prove what happened.
For: Security operations · SOC analysts · detection engineers · incident responders · 31 lessons
E1 Discover — the Sensors, and the Agent-Shaped Hole in Them (4) · E2 Detect — the Lake, and Rules Mapped to MITRE (6) · E3 Understand — Correlation, Intel and the Hunt (10) · E4 Respond — From a Conclusion to the Actor Stopped (5) · E5 Recover and Root Cause — From Stopped to Back at Target (6)
What changes in governance. Framework controls become numbers somebody can compute, mapped out to the rules that apply to you, in a programme ordered to produce coverage rather than demos.
For: Governance, risk and compliance · risk owners · the CISO office · 31 lessons
F1 Building the Governance Framework — Risk and Control (14) · F2 Building the Governance Platform — Regulatory and Compliance (9) · F3 Running the Programme — the CISO Office (8)