Zero Trust Architecture & Maturity Model
CISA & NIST
Authoritative guidance on implementing Zero Trust Architecture (NIST SP 800-207) and the CISA Zero Trust Maturity Model across identity, devices, networks, and workloads.
Federal Virtual Training Environment (FedVTE)
CISA / FedVTE
Free public cybersecurity training courses provided by CISA covering cybersecurity fundamentals, network assurance, risk management, and cloud defenses.
SANS Cyber Aces Online
SANS Institute
Open-access security tutorials covering core concepts of operating systems, networking fundamentals, and system administration security.
AWS Cloud Security Learning Pathways
AWS Training
Free digital cloud security training pathways covering the AWS shared responsibility model, IAM policies, KMS encryption, VPC security, and CloudTrail auditing.
Cybersecurity Incident Response Playbooks
CISA & NIST
Federal incident response playbooks and structured response methodologies based on NIST SP 800-61r2 for containment, analysis, evidence gathering, and recovery.
MITRE ATT&CK Training & Resources
MITRE ATT&CK
Free training curriculum and resources on applying the MITRE ATT&CK framework for defensive cyber operations, threat intelligence, and detection mapping.
OT & Critical Infrastructure Cyber Defense
Dave Roy Cyber Guy (In-Repo Track)
Interactive in-browser training syllabus covering ICS/SCADA architectures, Purdue model levels, GRC standards, and industrial incident response.
Cross-Sector Cybersecurity Performance Goals (CPGs)
CISA
Prioritized baseline cybersecurity practices and implementation guidance developed by CISA and NIST to help organizations reduce risk across IT and OT environments.
PortSwigger Web Security Academy
PortSwigger
Free interactive web security training with realistic vulnerability labs covering SQL injection, XSS, CSRF, SSRF, authentication flaws, and API vulnerabilities.
OWASP Web Security Testing Guide (WSTG)
OWASP Foundation
The premier open-source cybersecurity testing guide for web application security professionals and penetration testers.
OWASP Top 10 Security Risks
OWASP Foundation
Globally recognized standard awareness document for developers and web application security detailing the top critical security risks.
OWASP Juice Shop Vulnerable Web Application
OWASP Foundation
Intentionally insecure web application for security training, awareness demos, CTFs, and testing security tools covering all OWASP Top 10 vulnerabilities.
TryHackMe Hands-on Security Labs
TryHackMe
Browser-based hands-on cybersecurity training rooms and guided paths covering security fundamentals, junior penetration testing, and defensive SOC analysis.
Hack The Box Starting Point
Hack The Box
Guided walkthroughs and tiered vulnerable machines designed to introduce fundamental penetration testing and offensive security techniques.
OverTheWire Wargames (Bandit)
OverTheWire
Classic command-line wargames that teach security concepts, shell navigation, SSH, file permissions, and Linux fundamentals through progressive challenges.
picoCTF Cybersecurity Education Platform
Carnegie Mellon University
Free computer security education program with year-round gamified challenges covering forensics, web exploitation, cryptography, and binary analysis.
CryptoHack - Modern Cryptography Labs
CryptoHack
Fun, free platform for learning modern cryptography through practical CTF-style challenges covering AES, RSA, elliptic curves, and public-key cryptosystems.
pwn.college Binary & System Security
Arizona State University
Open cybersecurity education platform created by ASU instructors teaching system security, binary reverse engineering, program exploitation, and debugging.
CyberDefenders Blue Team DFIR Labs
CyberDefenders
Community-driven blue team training platform featuring realistic digital forensics, incident response, network packet analysis, and threat hunting investigations.
Root-Me Hacking & InfoSec Practice
Root-Me
Fast-growing security platform offering hundreds of virtual challenges across web client/server, network, forensic analysis, cryptography, and real environments.
ISC2 Certified in Cybersecurity (CC) One Million Certified in Cybersecurity
ISC2
Free foundational cybersecurity certification training pathway and exam vouchers provided through the global ISC2 1MCC initiative.
Google Cybersecurity Certificate (Free Audit Mode)
Google / Coursera
Comprehensive 8-course professional certificate covering network security, Linux and SQL, Python automation, SIEM triage, and incident detection.
Cisco Introduction to Cybersecurity
Cisco Skills For All
Introductory course exploring cyber trends, threat vectors, network security concepts, and organizational privacy defenses.
Fortinet Free Security Training (NSE 1-3)
Fortinet Training Institute
Free self-paced cybersecurity certification modules covering the threat landscape, evolution of cybersecurity, and technical security gateway products.
Palo Alto Networks Cybersecurity Academy
Palo Alto Networks
Foundational coursework on network security fundamentals, cloud security technology, and security operations center principles.
Qualys Certified Training & Vulnerability Management
Qualys Training Academy
Free product certifications and technical modules on VMDR, global IT asset inventory, cloud security posture, container security, and policy compliance.
CS50 Introduction to Cybersecurity
Harvard University
College-level introduction to cybersecurity exploring encryption, secure password design, web security, reverse engineering, and threat modeling.
MIT Computer Systems Security (6.858)
MIT OpenCourseWare
Rigorous MIT university lecture series covering buffer overflows, privilege separation, web security models, cryptographic network protocols, and side-channel attacks.
Cybrary Free IT & Cybersecurity Foundations
Cybrary
Guided foundational pathway introducing security analyst careers, system administration, and network hardening principles.
AWS Security Engineer Advanced Learning Plan
AWS Skill Builder
Comprehensive advanced cloud security engineering path covering IAM policies, AWS KMS key management, AWS WAF rules, GuardDuty, and incident remediation.
Designing Network Security in Google Cloud
Google Cloud Skills Boost
Advanced network security path covering Cloud Armor, Cloud Next Generation Firewall (NGFW), Private Service Connect, and packet inspection.
IBM Cybersecurity Analyst Professional Certificate (Audit Mode)
IBM / Coursera
Professional curriculum on security compliance, endpoint protection, SIEM tools, penetration testing basics, and incident case studies.
Advanced Network Security Specialization
LearnQuest / Coursera
Deep dive into enterprise perimeter defense, intrusion prevention systems, next-generation firewall architectures, and hybrid cloud networking.
Semgrep Code & Rules Tutorial
Semgrep Dev
Interactive open-source static code analysis tutorials teaching security engineers how to write custom AST-based SAST rules to prevent vulnerabilities.
HackTricks Information Security Knowledge Base
Carlos Polop / HackTricks
Widely referenced technical documentation and methodology repository for cloud security, network pivot techniques, Windows/Linux privilege escalation, and active directory.
PayloadsAllTheThings Exploitation Reference
Swissky / GitHub
Curated technical cheat sheet and methodology guide for web application penetration testing, payload crafting, and bypassing security filters.
OWASP API Security Top 10 Reference
OWASP Foundation
Specialized security guide focused on strategies and vulnerabilities unique to APIs including object level authorization (BOLA) and excessive data exposure.
Professor Messer CompTIA Security+ Training
Professor Messer
Free comprehensive video training series covering every objective of the CompTIA Security+ certification exam.
John Hammond Malware Analysis & CTF Breakdowns
John Hammond
Educational YouTube videos breaking down modern malware, ransomware payloads, CTF challenges, threat hunting techniques, and defense strategies.
IppSec Penetration Testing & HTB Walkthroughs
IppSec
In-depth, unedited technical video walkthroughs of Hack The Box machines demonstrating real-world enumeration and privilege escalation methodology.
13Cubed Windows Forensics & DFIR
13Cubed / Richard Davis
Specialized video tutorials on memory forensics, incident response triage, EVTX log analysis, MFT records, and blue team investigations.
LiveOverflow Binary Exploitation & Security Engineering
LiveOverflow
Deep technical walkthroughs explaining how computer security bugs actually work at the binary, hardware, and web protocol levels.
Recommended Cybersecurity Podcasts & Audio Briefs
Curated practitioner audio feeds for threat intel, daily briefings, and incident investigations.
Darknet Diaries
True stories from the dark side of the internet — hackers, breaches, shadow government operations, and cybercrime investigations.
The CyberWire Daily
Essential weekday briefing covering global cybersecurity policy, high-profile breaches, vulnerability disclosures, and executive strategy.
Risky Business
High-signal, opinionated weekly industry news podcast for active cybersecurity practitioners, consultants, and leaders.
SANS Internet Storm Center Daily (Stormcast)
Short 5-10 minute daily morning threat briefings highlighting zero-days, exploit activity, and network attack telemetry.
Smashing Security
A lighthearted, informative take on computer security, identity theft, scams, and digital privacy.
Security Now
Long-running deep dive into cryptography, network protocols, hardware vulnerabilities, and digital privacy.
Explore Companion Training Tracks
Expand your defensive capabilities with our specialized tracks in AI threat defense, post-quantum cryptography, and industrial control systems.
AI Security Training
Adversarial machine learning, LLM prompt security, and model validation techniques.
Quantum Training
Post-quantum cryptography migration, quantum threats, and Qiskit programming fundamentals.
OT / ICS Defense
Operational technology security architectures, Purdue model levels, and critical infrastructure hardening.