REMNANTSECURITY ACADEMY
Menu

Academy / Cybersecurity Bootcamp

Flagship course

Remnant Security Cybersecurity Bootcamp

A practitioner-led cybersecurity program covering security fundamentals, networking, Linux, secure architecture, vulnerability management, detection, and applied labs.

Launch access — $97See all modules
32Outlined lessons
9Portfolio artifacts
6Role paths
80%Knowledge and portfolio pass mark

Module map

The complete curriculum.

Every module ends with inspectable proof. Final published lessons are focused units; raw class recordings are never exposed directly.

01
Module 1

Security Essentials

CIA triad, data states, threat actors, risk, shared responsibility, and cybersecurity careers.

SECURITYPLUS3 lessonsPortfolio project
What you will be able to do
  • Connect assets, threats, vulnerabilities, controls, and evidence to a business mission.
  • Classify security decisions by confidentiality, integrity, availability, and data state.
  • Write a bounded risk statement without overstating certainty.
01.1
Security Missions and AssetsStart with what the organization must protect and why.
01.2
Threats, Vulnerabilities, and ControlsTrace how a threat reaches an asset and where preventive, detective, and corrective controls change the outcome.
01.3
Shared Responsibility and Career LanesMap responsibility across people, providers, operators, and security roles.
Build proof

Mission and Risk Snapshot

A one-page asset, threat, control, and evidence map for a fictional small organization.

  • Mission and critical-asset statement
  • Three bounded risk statements
  • Control and evidence map
  • Executive summary
02
Module 2

System and Network Security

Addressing, switching, VLANs, routing, segmentation, wireless, WAN, and secure remote access.

SECURITYPLUS4 lessonsPortfolio project
What you will be able to do
  • Trace traffic through addressing, switching, routing, DNS, and application protocols.
  • Explain how segmentation and secure remote access reduce blast radius.
  • Capture and annotate network evidence from an isolated lab.
02.1
Addresses, Ports, and ProtocolsBuild a packet-to-application mental model using DNS, TCP, TLS, and HTTP.
02.2
Switching, Routing, and SegmentationFollow traffic across subnets, VLANs, gateways, and security boundaries.
02.3
Wireless, WAN, and Secure Remote AccessCompare wireless safeguards, VPN models, zero-trust access, and remote-user evidence.
02.4
Network Evidence LabCapture a safe connection, identify the major protocol steps, and explain the defensive value of each field.
Build proof

Segmented Network Evidence Pack

A lab diagram, annotated traffic flow, and short segmentation decision memo.

  • Authorized lab scope
  • Network diagram
  • Annotated packet or connection evidence
  • Segmentation decision memo
03
Module 3

Linux Essentials

Filesystem navigation, permissions, identity, packages, logs, networking tools, scripting, and scheduling.

SECURITYPLUS3 lessonsPortfolio project
What you will be able to do
  • Navigate and inspect a Linux system using least privilege.
  • Explain users, groups, permissions, services, processes, packages, and scheduled work.
  • Collect and interpret Linux authentication and process evidence.
03.1
Filesystem, Identity, and PermissionsUse paths, ownership, modes, users, groups, and sudo safely.
03.2
Processes, Services, and PackagesInspect running work, service state, startup behavior, and software sources.
03.3
Logs, Networking, and AutomationFind authentication evidence, inspect connections, and automate a safe collection task.
Build proof

Linux Incident Notebook

A reproducible evidence collection notebook for a synthetic suspicious-login scenario.

  • Collection script
  • Safe sample output
  • Investigation timeline
  • Permissions and limitations note
04
Module 4

Controls, IAM, and Cryptography

Security controls, threat actors, cryptography, PKI, identity, access, and authorization models.

SECURITYPLUSCISSP3 lessonsPortfolio project
What you will be able to do
  • Choose administrative, technical, physical, preventive, detective, and corrective controls for a stated risk.
  • Trace identity lifecycle, authentication, authorization, and privileged access.
  • Explain where encryption, hashing, signatures, certificates, and PKI provide different guarantees.
04.1
Control Types and SelectionMatch controls to risk, evidence, operating constraints, and failure modes.
04.2
Identity Lifecycle and AccessJoiners, movers, leavers, MFA, federation, RBAC, ABAC, and privileged access.
04.3
Cryptography, Hashing, and PKISelect the right primitive and verify what it does and does not prove.
Build proof

Identity and PKI Decision Pack

A least-privilege access matrix and certificate-backed service design for a fictional organization.

  • Identity lifecycle diagram
  • Role or attribute access matrix
  • Cryptographic control selection
  • Failure and recovery analysis
05
Module 5

Secure Architecture and Operations

Enterprise and cloud architecture, segmentation, containers, endpoints, applications, malware, and MITRE ATT&CK.

SECURITYPLUSCYSA4 lessonsPortfolio project
What you will be able to do
  • Review an enterprise or cloud design using trust boundaries, shared responsibility, and defense in depth.
  • Connect endpoint, application, container, and network telemetry to likely attack behaviors.
  • Map observed behavior to MITRE ATT&CK without claiming unsupported attribution.
05.1
Enterprise, Cloud, and Zero TrustCompare trust boundaries, shared responsibility, resilience, and policy enforcement.
05.2
Endpoints, Applications, and ContainersReview attack surface, hardening, telemetry, secrets, and software lifecycle risks.
05.3
Malware Behavior and ATT&CK MappingTranslate safe behavior evidence into tactics, techniques, detections, and response questions.
05.4
Architecture Threat-Model WorkshopIdentify assets, entry points, trust boundaries, misuse cases, controls, and residual risk.
Build proof

Secure Architecture Threat Model

A system diagram and defensible threat model with ATT&CK-aware monitoring requirements.

  • Architecture and trust-boundary diagram
  • Five misuse cases
  • Control and telemetry plan
  • Residual-risk decision memo
06
Module 6

Vulnerability and Risk Management

Attack-surface discovery, asset inventory, vulnerability prioritization, risk registers, and patching.

SECURITYPLUSCYSA3 lessonsPortfolio project
What you will be able to do
  • Build an asset inventory that supports ownership, exposure, criticality, and patch decisions.
  • Prioritize vulnerabilities using exploitability, business context, exposure, and compensating controls.
  • Write a risk register entry that distinguishes evidence, inference, treatment, owner, and due date.
06.1
Asset Inventory and Attack SurfaceDiscover what exists, who owns it, where it is exposed, and what evidence is missing.
06.2
Vulnerability PrioritizationMove beyond base severity by adding exploitation, exposure, criticality, and control context.
06.3
Risk Registers and RemediationAssign owners, select treatment, track evidence, and verify closure.
Build proof

Vulnerability Prioritization Brief

A safe synthetic asset inventory, prioritized remediation backlog, and executive risk brief.

  • Asset and ownership inventory
  • Prioritization model
  • Top-ten remediation backlog
  • Risk register and executive brief
07
Module 7

Detection and Analysis

Threat intelligence, indicators, baselining, detection engineering, assume-breach operations, and forensics.

CYSASECURITYPLUS4 lessonsPortfolio project
What you will be able to do
  • Correlate threat-intelligence sources while preserving confidence, provenance, and uncertainty.
  • Turn a hunt hypothesis into required telemetry, a query, expected results, and tuning notes.
  • Document an investigation timeline that distinguishes evidence from inference.
07.1
Threat Intelligence and IOC EnrichmentNormalize indicators, correlate sources, score risk, and explain incomplete or conflicting results.
07.2
Baselines, Hypotheses, and HuntsDefine normal, state a testable hypothesis, and identify required evidence before writing a query.
07.3
Detection Engineering and TuningValidate positive, negative, boundary, and missing-data cases while documenting false positives.
07.4
Forensic Timeline and Analyst HandoffBuild a defensible timeline, preserve provenance, and communicate next collection steps.
Build proof

Threat Intel CLI

Extend the Remnant threat-intelligence CLI with a source, scoring rule, report format, or reliability improvement.

  • Working CLI change
  • Safe IOC and provider fixtures
  • JSON and analyst reports
  • Tests, limitations, and two-minute demo
08
Module 8

Applied Security Labs

Clean, instructor-only walkthroughs for lab setup, scanning, exploitation, remediation, and the final CTF.

PENTESTCYSAClean lab rebuild5 lessonsPortfolio project
What you will be able to do
  • Collect and normalize safe endpoint authentication telemetry.
  • Build a dashboard and investigation timeline from synthetic events.
  • Write and validate KQL hunts with MITRE ATT&CK context and false-positive tuning.
08.1
Authorized Lab OperationsScope the environment, protect secrets and personal data, capture evidence, and prove cleanup.
08.2
Event Collection and NormalizationCollect Windows or macOS authentication evidence and preserve field meaning and time.
08.3
Event Log DashboardVisualize a failed-login sequence, verify counts, and write a bounded anomaly summary.
08.4
SecureWatch KQL Hunt PackBuild hunts for failed logins, credential access, suspicious PowerShell, and data staging.
08.5
Detection Validation and HandoffRun test fixtures, tune thresholds, record false positives, and package analyst next steps.
Build proof

Event Dashboard and KQL Hunt Pack

Two linked portfolio milestones: a normalized authentication dashboard and four validated SecureWatch hunts.

  • Safe authentication-event fixture
  • Dashboard and investigation timeline
  • Four KQL queries with expected results
  • ATT&CK, false-positive, and tuning notes
09
Module 9

Security+ Review

Controls, threats, social engineering, cryptography, hashing, signatures, and PKI review.

SECURITYPLUS3 lessonsPortfolio project
What you will be able to do
  • Use exam objectives as a gap-analysis contract rather than a memorization checklist.
  • Explain controls, threats, cryptographic guarantees, and identity decisions with practical evidence.
  • Assemble a final defend-and-hunt repository and a credible interview walkthrough.
09.1
Objective Map and Gap AnalysisMap Security+ SY0-701 objectives to completed lessons, labs, and remaining gaps.
09.2
Scenario ReviewPractice control, threat, identity, cryptography, and operations decisions in context.
09.3
Portfolio DefenseDemonstrate what works, what failed, what remains uncertain, and how the artifacts support a target role.
Build proof

Defend-and-Hunt Portfolio Repository

A professional repository that connects the strongest bootcamp artifacts to one target security role.

  • Executive portfolio README
  • Three strongest technical artifacts
  • Validation and safety evidence
  • Five-minute recorded defense and next-step plan

Role routing

Study with an outcome in mind.

01

Full Bootcamp

The complete foundations-to-operations curriculum.

9 modules →02

SOC Analyst

Develop the Linux, architecture, vulnerability, detection, and analysis skills used in a SOC.

7 modules →03

Security Engineer

Focus on networking, identity, cryptography, secure architecture, risk, and implementation.

6 modules →04

Penetration Tester

Build the networking, Linux, vulnerability-discovery, and applied offensive foundations for ethical testing.

5 modules →05

Risk and GRC

Connect security controls and architecture to risk decisions, governance, and oversight.

5 modules →06

Security+ Preparation

Follow the lessons that align most closely to CompTIA Security+ SY0-701 objectives.

8 modules →