TCM Security Courses

AI Hacking 101 teaches students the fundamentals of penetration testing for AI/LLM-based applications through self-paced video instruction and guided hands-on labs. Students will learn to detect and exploit common AI vulnerabilities, with practical exercises using a custom-built lab environment featuring a vulnerable chatbot that uses Retrieval-Augmented Generation (RAG) and integrates with a company knowledge base.

This course is designed to introduce students to the fundamentals of AI including neural networks and transformer large language models (LLMs). Beginning with the math behind neural networks and how they are trained, students will learn how these networks are used for natural language processing and the architecture of modern transform LLMs, providing a full picture of how neural networks and LLMs actually work. This course does not focus on how to use AI tools.

Security Operations (SOC) 201 is an intermediate security operations course designed to enhance your skills in detecting, investigating, and responding to complex cyber threats at scale. After establishing fundamental security operations knowledge and practical skills in SOC 101, the next logical step is to progress your career by applying advanced investigation methodologies and grasping the responsibilities of an Incident Responder and Threat Hunter. The SOC 201 curriculum teaches analysts how to identify, hunt, and respond to real-world adversary tactics and techniques. With a practical, hands-on focus, the curriculum provides realistic scenarios where students investigate sophisticated threats across multiple systems, learning to detect and respond effectively in enterprise-scale environments. The course also integrates proactive threat hunting as part of a continuous detection and response cycle, giving analysts the mental models to identify active threats, uncover gaps, and feed insights back into investigative processes to improve future detection and response efforts.

Advanced Web Hacking is designed to take your web penetration testing skills to the next level. This course dives deep into advanced topics, exploring edge-case vulnerabilities, sophisticated attacks, and complex scenarios faced in modern web applications. Each module will offer in-depth exploration through code review, debugging, and hands-on labs.

Assembly 101 will teach you how computers work down to the lowest level and how to write and read the human readable version of the 1s and 0s they speak in – Assembly. The course starts with an introduction on how computers perform computations using transistors, logic gates and machine code (1s and 0s), then moves on to writing your own assembly programs. Students will start writing x86-16 assembly in a beginner-friendly 8086 emulator to learn the fundamentals and then move on to writing modern x86-64 assembly.

Go beyond the course materials with bi-monthly livestreamed workshops taught by your favorite Academy instructors. These interactive sessions will be hosted on the Academy platform and will not be available on our public social media channels. Topics for the workshops will rotate, please check the curriculum below for the upcoming schedule.

Welcome to the Governance, Risk, and Compliance (GRC) Analyst Master Class. This class assumes no prior background knowledge and is setup to give you a full scope understanding and the practical skills needed to be an effective GRC Analyst. Cybersecurity workforce development is focused on red team and blue team skills, but GRC is terribly underserved for training. This course fills that gap by offering practical application of risk, audit, policy development, and security awareness skills needed for modern GRC analysts.

Detection Engineering for Beginners teaches core concepts and skills to start thinking and working as a Detection Engineer! This course will first teach the theory behind security operations and detection engineering. We’ll then start building out our home lab using VirtualBox and Elastic’s security offering. Then we’ll run through three different attack scenarios, each more complex than the one prior. We’ll make detections off of our attacks, and learn how to document our detections. Next we’ll dive more into coding and Python by writing validation scripts and learning out to interact with Elastic through their API. Wrapping everything up, we’ll host all our detections on GitHub and sync with Elastic through our own GitHub Action automations. As a cherry on top, we’ll have a final section on how to write scripts to gather important metrics and visualizations.

The objective of this course is to show students how to perform a full digital forensic investigation of a Windows system in a complete DIY setup. The course covers a full digital forensic investigation of a Windows system. It begins with the simple preparation of our lab, which consists of setting up a “victim” VM and a forensic workstation. We’ll then run an attack simulation script on the victim VM that simulates attack patterns as commonly observed by threat actors in the industry to create a realistic setting for our investigation. From there, we’ll kick off the forensic process, beginning with the data collection, examination and extraction before diving deeper into the analysis of the information at hand.

This specialized and comprehensive course is designed to provide an in-depth understanding of cybersecurity practices, with a focus on ethical hacking techniques to safeguard digital infrastructure. Through a series of detailed modules, participants will delve into modern security architectures, learn how to set up and manage phishing simulations using tools like GoPhish, bypass multi-factor authentication with Evilginx, and explore advanced phishing and vishing strategies. The curriculum also covers essential setup procedures for domain and email registration, configurations for AWS EC2 instances, and the use of SMS phishing (smishing) for security testing. Furthermore, the course emphasizes the importance of reporting, documentation, and ethical considerations in cybersecurity operations.

Welcome to this course on Practical Web Hacking. This course follows on from the Practical Bug Bounty course and will take you deeper into the world of finding and exploiting vulnerabilities in web applications. It’s recommended that you have completed the Practical Bug Bounty course or at least one year’s worth of experience in hacking web applications before you take this course. In this course, you will develop a deeper understanding of how web attacks work, learn to craft custom payloads and build a methodology for finding and exploiting more complex vulnerabilities.

Practical Web Application Security and Testing is an entry-level course on web application technologies, security considerations for web application development, and the web application penetration testing process. We begin with the basics of HTTP, servers, and clients, before moving through the OWASP Top 10 on our way to a full demonstration penetration test. We also cover the reporting process for web application assessments, so you’re prepared not only to conduct security assessments on web applications but also clearly and effectively communicate your findings.