Learning Paths

Content is based on NIST’s NICE workforce framework, a pragmatic and popular approach focusing on job function, skills, and ability.
By assigning competency IDs, it’s easy to map to other standards and guidelines, including:

While many organizations have internally defined job roles, they often need to be tweaked for increased specialization. For example, front-end developers need different training than back-end developers because client-side vulnerabilities differ from those introduced by web services, APIs, and other back end technologies. Our learning paths reflect these subtle but important distinctions.

Learning Paths are organized by development language, deployment platform, application framework, and other technologies. Quarterly content releases ensure you are always equipped to defend against the latest attacks and implement digital strategies securely.

Fast track to excellence. Learning paths are sequenced such that each course builds upon concepts learned in previous ones. This ensures that security principles are understood before jumping into technology, language, or framework-specific courses.

While there are a few outliers, courses generally fall into 3 levels:

• 100 level – builds foundational “what needs to be done” knowledge with principle and awareness topics
• 200 level – focuses on “how to do it” in specific languages, platforms, environments, and deployments
• 300 level – advanced topics that warrant a deeper dive to a specific technology, methodology or vulnerability

The following courses are available in Chinese (S), Spanish (LA), and French (CF):

• OWASP Top Ten: Threats & Mitigations series (10 courses)
• How to Test for the OWASP Top Ten series (10 courses)
• Testing for CWE SANS Top 25 Software Errors
• Secure Software Concepts
• How to Perform a Security Code Review