✳ The learning field guide
You don’t need to know the vocabulary yet. Choose a path, build your understanding, and practice making decisions with imperfect information.
PATH 01 / 8 LESSONS
Eight lessons that teach a beginner to name assets and losses, judge risk under uncertainty, trace a request, handle identity, write scoped policies, plan recovery, read evidence, and connect those skills to frameworks and product categories.
Explore this path ↗PATH 02 / 4 LESSONS
Four lessons that take the foundations path into evidence-to-decision work: identity-alert triage, vulnerability prioritization, investigation with verified recovery, and an honest introduction to an Agentic SOC and IRIS. Each lesson lists the foundation skills it depends on.
Explore this path ↗Learn to name the things worth protecting and describe a concrete loss as a confidentiality, integrity, or availability failure before talking about products.
Learn why two similar weaknesses can receive different priorities by separating threat, vulnerability, exploitation evidence, impact, and what you still do not know.
Trace a browser request to a tracking portal and identify what the network, DNS, HTTP, and TLS each do and do not protect.
Distinguish proving who someone is from granting access, and treat account recovery as part of the same control system.
Choose a scoped access policy by naming trust boundaries and stacking independent controls instead of one powerful exception.
Build a small organization's prevention and recovery plan that covers classification, updates, backups, and what must still work when a warehouse is down.
Separate observed facts, hypotheses, and missing information when reading logs and alerts so a later decision can be defended.
Relate a named risk to an outcome, a control, the evidence you would collect, and the product category that might help—without treating a purchase as the outcome.
Practice stating what is known, what is hypothesized, and which evidence to request next when a synthetic identity alert fires.
Combine severity, exploitation evidence, exposure, and business context to order a synthetic vulnerability backlog without pretending a single score is enough.
Propose a scoped response with a human decision and postcondition checks, using a synthetic identity-and-export case.
Explain IRIS components as a reference architecture, complete a synthetic walkthrough, and keep human authority separate from model text.
