Start here: how attackers think

The other tracks built the locks: passkeys, tokens, sessions and recovery. This track shows how attackers try to pick those locks. You learn it to spot an attack early and stop it. Every lesson ends with the defense that wins.

Why study attacks?

You cannot guard a door you have never seen forced. Zara is our security operator. She pictures the attacker's next move. Then she builds the control that makes that move useless. You will do the same. This is a guide for defenders, not a how-to.

Some of these attacks are already in the news. A fake "bank officer" phones and asks for your OTP. A thief moves your mobile number to a new SIM. A caller pretends to be a staff member and talks the help desk into a reset. You will see how each one looks from the defender's side.

The journey

Each lesson pairs one real attack with the defense that wins. Then you learn to catch them in the logs. Last, you run a 2 a.m. incident as a drill.

1. Credential stuffing, password spraying and bots — bots try leaked and common passwords.
2. Adversary-in-the-middle — a phishing page passes on your one-time code.
3. MFA fatigue — prompts all night.
4. Device-code phishing — a code you did not start.
5. Consent phishing — a rogue app asks for too much.
6. Session hijacking — a stolen cookie.
7. Recovery attacks — SIM swap and weak account recovery.
8. Fake help-desk calls — a caller poses as staff.
9. Detection engineering — turning identity logs into alarms.
10. Incident tabletop — the 2 a.m. drill.
11. Cheat sheet & pop quiz — the track on one page.

How to use it

Take one lesson at a time. Your progress saves in your browser. Sign in to sync it across your devices. Most lessons end with a hands-on lab. This track builds on When things go wrong and Zero trust & context. New to phishing? Read Spotting phishing and fake logins first.

Locks exist because someone tries the handle. Start with credential stuffing.