Technology & security
Ethical Hacking & Defensive Security
Learn the authorised, ethical and defensive foundations of security testing and reporting.
Learn the legal, authorised and defensive foundations of security testing and vulnerability management.
About this course
This course teaches the professional boundaries, reporting standards and defensive thinking behind ethical security work. All learning is limited to authorised practice environments and simulated scenarios, never real systems, accounts or networks without explicit written permission.
Career relevance
Where this can take you
Useful for learners preparing for defensive-security, security-analyst and authorised testing career paths.
Portfolio project: Write a simulated authorised security-review report with scope, evidence, prioritised findings and remediation.
Skills you will gain
Practical skills, not just theory
What you will learn
Explain authorisation, scope and responsible disclosure requirements.
Identify high-level security weaknesses in a safe simulated environment.
Document findings with evidence, impact and remediation priorities.
Work within legal, ethical and organisational boundaries at all times.
Objective map
A numbered, measurable syllabus
Every lesson, knowledge check and practical activity maps to the objectives below. Domain weights show how much of the programme each area represents.
Domain 1
Authorisation, scope and ethics to Safe reconnaissance in practice environments
- 1.1Demonstrate authorisation, scope and ethics in a realistic ethical hacking & defensive security context: learn the legal limits that separate authorised testing from unauthorised access.
- 1.2Demonstrate threat modelling and asset awareness in a realistic ethical hacking & defensive security context: identify what needs protection and how a defender prioritises risk.
- 1.3Demonstrate safe reconnaissance in practice environments in a realistic ethical hacking & defensive security context: use simulated, authorised scenarios to understand exposed information and risk.
Domain 2
Vulnerability management and validation to Reporting, remediation and responsible disclosure
- 2.1Apply and control vulnerability management and validation in a realistic ethical hacking & defensive security context: understand how weaknesses are identified, verified and prioritised safely.
- 2.2Explain and distinguish web and network security concepts in a realistic ethical hacking & defensive security context: recognise common defensive control gaps without attacking real targets.
- 2.3Demonstrate reporting, remediation and responsible disclosure in a realistic ethical hacking & defensive security context: write a professional finding that helps an organisation fix a risk.
Domain 3
Capstone: authorised security review report
- 3.1Analyse and evaluate capstone: authorised security review report in a realistic ethical hacking & defensive security context: produce a safe simulated assessment report with scope, findings and controls.
How the programme works
Learn, practise, explain and prove it
This is a long-form, eight-week guided programme rather than a stack of short articles. Each module contains six substantial lessons that move from concepts and methods into a worked case, a quality clinic, a workplace lab and assessed reflection.
1. Guided learning
Study the purpose, process, risks and professional standard through structured readings and active notes.
2. Worked cases
Compare plausible options, expose missing evidence and defend a decision under realistic constraints.
3. Quality clinics and labs
Diagnose weak work, revise it against a rubric and create portfolio evidence with a full audit trail.
4. Hard assessment
Pass applied checks and the final assessment at 85%, with no unresolved critical-error questions.
Curriculum
A complete programme, module by module
The curriculum below shows the actual learning pathway, objective and evidence for every module. Full lessons remain locked until enrolment.
Build the base
Standards, vocabulary and the core method you will use throughout the programme.
01Authorisation, scope and ethicsLearn the legal limits that separate authorised testing from unauthorised access.+
Measured objectiveDemonstrate authorisation, scope and ethics in a realistic ethical hacking & defensive security context: learn the legal limits that separate authorised testing from unauthorised access.
Evidence you will produceA technical authorisation, scope and ethics brief with requirements, safe method, sample output or architecture, validation evidence and handover notes.
Six guided lessons + worked case + quality clinic + workplace lab + hard knowledge check
02Threat modelling and asset awarenessIdentify what needs protection and how a defender prioritises risk.+
Measured objectiveDemonstrate threat modelling and asset awareness in a realistic ethical hacking & defensive security context: identify what needs protection and how a defender prioritises risk.
Evidence you will produceA technical threat modelling and asset awareness brief with requirements, safe method, sample output or architecture, validation evidence and handover notes.
Six guided lessons + worked case + quality clinic + workplace lab + hard knowledge check
Milestone: You can explain the fundamentals and complete a first guided task.
Develop core skills
The working skills and tools of the role, practised one at a time.
03Safe reconnaissance in practice environmentsUse simulated, authorised scenarios to understand exposed information and risk.+
Measured objectiveDemonstrate safe reconnaissance in practice environments in a realistic ethical hacking & defensive security context: use simulated, authorised scenarios to understand exposed information and risk.
Evidence you will produceA technical safe reconnaissance in practice environments brief with requirements, safe method, sample output or architecture, validation evidence and handover notes.
Six guided lessons + worked case + quality clinic + workplace lab + hard knowledge check
04Vulnerability management and validationUnderstand how weaknesses are identified, verified and prioritised safely.+
Measured objectiveApply and control vulnerability management and validation in a realistic ethical hacking & defensive security context: understand how weaknesses are identified, verified and prioritised safely.
Evidence you will produceA technical vulnerability management and validation brief with requirements, safe method, sample output or architecture, validation evidence and handover notes.
Six guided lessons + worked case + quality clinic + workplace lab + hard knowledge check
Milestone: You can carry out routine work independently and check it properly.
Apply it in realistic scenarios
Case studies and simulations with competing priorities and incomplete information.
05Web and network security conceptsRecognise common defensive control gaps without attacking real targets.+
Measured objectiveExplain and distinguish web and network security concepts in a realistic ethical hacking & defensive security context: recognise common defensive control gaps without attacking real targets.
Evidence you will produceA technical web and network security concepts brief with requirements, safe method, sample output or architecture, validation evidence and handover notes.
Six guided lessons + worked case + quality clinic + workplace lab + hard knowledge check
06Reporting, remediation and responsible disclosureWrite a professional finding that helps an organisation fix a risk.+
Measured objectiveDemonstrate reporting, remediation and responsible disclosure in a realistic ethical hacking & defensive security context: write a professional finding that helps an organisation fix a risk.
Evidence you will produceA checked working paper, analysis or report for reporting, remediation and responsible disclosure, including source data, assumptions, calculations, findings and limitations.
Six guided lessons + worked case + quality clinic + workplace lab + hard knowledge check
Milestone: You can make and justify decisions in realistic situations.
Prove it and plan your next step
Portfolio evidence, final review and a development plan you can show an employer.
07Capstone: authorised security review reportProduce a safe simulated assessment report with scope, findings and controls.+
Measured objectiveAnalyse and evaluate capstone: authorised security review report in a realistic ethical hacking & defensive security context: produce a safe simulated assessment report with scope, findings and controls.
Evidence you will produceA checked working paper, analysis or report for capstone: authorised security review report, including source data, assumptions, calculations, findings and limitations.
Six guided lessons + worked case + quality clinic + workplace lab + hard knowledge check
Milestone: You have portfolio-ready evidence and a clear next step.
Suggested pace
Eight-week study plan
Plan for roughly 5–9 hours each week across readings, worked cases, practice, portfolio production and assessment remediation. Repeat a week when the knowledge checks show a gap.
Week 1
Authorisation, scope and ethics
- •Complete the six guided lessons for Authorisation, scope and ethics and build structured notes against the objective codes.
- •Analyse the worked case, compare two defensible options and submit a reasoned decision record.
- •Complete the quality clinic, correct the weak draft and document every revision against the rubric.
- •Produce the authorisation, scope and ethics portfolio evidence and complete the hard knowledge checks.
- •Review every incorrect answer, explain why each distractor fails and schedule targeted retrieval practice.
Checkpoint: Reach at least 85% on the week’s checks, resolve every critical error and save the reviewed portfolio evidence before continuing.
Week 2
Threat modelling and asset awareness
- •Complete the six guided lessons for Threat modelling and asset awareness and build structured notes against the objective codes.
- •Analyse the worked case, compare two defensible options and submit a reasoned decision record.
- •Complete the quality clinic, correct the weak draft and document every revision against the rubric.
- •Produce the threat modelling and asset awareness portfolio evidence and complete the hard knowledge checks.
- •Review every incorrect answer, explain why each distractor fails and schedule targeted retrieval practice.
Checkpoint: Reach at least 85% on the week’s checks, resolve every critical error and save the reviewed portfolio evidence before continuing.
Week 3
Safe reconnaissance in practice environments
- •Complete the six guided lessons for Safe reconnaissance in practice environments and build structured notes against the objective codes.
- •Analyse the worked case, compare two defensible options and submit a reasoned decision record.
- •Complete the quality clinic, correct the weak draft and document every revision against the rubric.
- •Produce the safe reconnaissance in practice environments portfolio evidence and complete the hard knowledge checks.
- •Review every incorrect answer, explain why each distractor fails and schedule targeted retrieval practice.
Checkpoint: Reach at least 85% on the week’s checks, resolve every critical error and save the reviewed portfolio evidence before continuing.
Week 4
Vulnerability management and validation
- •Complete the six guided lessons for Vulnerability management and validation and build structured notes against the objective codes.
- •Analyse the worked case, compare two defensible options and submit a reasoned decision record.
- •Complete the quality clinic, correct the weak draft and document every revision against the rubric.
- •Produce the vulnerability management and validation portfolio evidence and complete the hard knowledge checks.
- •Review every incorrect answer, explain why each distractor fails and schedule targeted retrieval practice.
Checkpoint: Reach at least 85% on the week’s checks, resolve every critical error and save the reviewed portfolio evidence before continuing.
Week 5
Web and network security concepts
- •Complete the six guided lessons for Web and network security concepts and build structured notes against the objective codes.
- •Analyse the worked case, compare two defensible options and submit a reasoned decision record.
- •Complete the quality clinic, correct the weak draft and document every revision against the rubric.
- •Produce the web and network security concepts portfolio evidence and complete the hard knowledge checks.
- •Review every incorrect answer, explain why each distractor fails and schedule targeted retrieval practice.
Checkpoint: Reach at least 85% on the week’s checks, resolve every critical error and save the reviewed portfolio evidence before continuing.
Week 6
Reporting, remediation and responsible disclosure
- •Complete the six guided lessons for Reporting, remediation and responsible disclosure and build structured notes against the objective codes.
- •Analyse the worked case, compare two defensible options and submit a reasoned decision record.
- •Complete the quality clinic, correct the weak draft and document every revision against the rubric.
- •Produce the reporting, remediation and responsible disclosure portfolio evidence and complete the hard knowledge checks.
- •Review every incorrect answer, explain why each distractor fails and schedule targeted retrieval practice.
Checkpoint: Reach at least 85% on the week’s checks, resolve every critical error and save the reviewed portfolio evidence before continuing.
Week 7
Capstone: authorised security review report
- •Complete the six guided lessons for Capstone: authorised security review report and build structured notes against the objective codes.
- •Analyse the worked case, compare two defensible options and submit a reasoned decision record.
- •Complete the quality clinic, correct the weak draft and document every revision against the rubric.
- •Produce the capstone: authorised security review report portfolio evidence and complete the hard knowledge checks.
- •Review every incorrect answer, explain why each distractor fails and schedule targeted retrieval practice.
Checkpoint: Reach at least 85% on the week’s checks, resolve every critical error and save the reviewed portfolio evidence before continuing.
Week 8
Review and consolidation
- •Complete a cumulative, closed-notes retrieval review across all objectives studied so far.
- •Repair incomplete portfolio evidence and repeat the two lowest-scoring knowledge checks.
- •Ask for structured feedback, record the feedback and revise one artefact to professional standard.
Checkpoint: Submit the capstone evidence pack, defend the key decision, remediate every weak objective and pass the final assessment at 85% with no critical misses.
Technology & security
Continue your learning path
AI for Work & Prompting
Use generative AI responsibly to research, write, analyse and improve everyday work.
60–72 hours
AI Product Management
Plan responsible AI-enabled products around people, value and risk.
50–60 hours
API & Integration Foundations
Understand how systems exchange information safely and reliably.
55–66 hours
Assessment and certificate
A simulated, authorised security-review scenario and knowledge assessment. No activity against real targets is taught, requested or permitted.
Who this is for
- ✓Learners with basic IT and cybersecurity knowledge.
- ✓Aspiring defensive-security analysts and ethical-security testers.
- ✓Professionals who need to understand vulnerability reporting and security controls.