Mentorship Program

★★★★★

(1,240 ratings) 8,500+ Student

6 Month Mentorship Program in Cyber Security

Basic to Advanced. Six specializations, one a month, 40 hours each — Networking & Linux Security | Ethical Hacking & Penetration Testing | SOC & SIEM Operations | Cloud Security | DevSecOps & Application Security | AI Security, Threat Hunting & Automation. The progression runs Networking → Linux → Security Fundamentals → VAPT → SOC/SIEM → Cloud Security → DevSecOps → Application Security → Threat Hunting → AI Security → Security Automation, across 40+ hands-on labs, 100+ assignments, 25+ mini projects, 6 major capstones and an integrated enterprise capstone. No prior Linux experience is required, and every track ends in job scenarios, troubleshooting exercises, technical documentation and mock interviews.

Radical Technologies

8,500+ English 6 Tracks · 6 Months · 240 Hours

Online / Classroom

Basic to Advanced | 6 Specializations | 40 Hours Each

Duration 240 Hours (6 Months)

Batch Type Weekdays / Weekends

Mode of Training Classroom / Online / Corporate

Locations Pune, Bangalore, Kochi

Language English

Certification Mentorship Certificate + Global Certification Roadmap

Tools you'll master

Wireshark Nmap tcpdump Netcat Zeek Suricata Ubuntu Kali Linux Bash SSH auditd SELinux Burp Suite OWASP ZAP Metasploit Nessus Nuclei OpenVAS SQLMap Microsoft Sentinel Splunk Elastic QRadar Defender CrowdStrike Sigma KQL SPL AWS Security Hub GuardDuty CloudTrail Defender for Cloud Entra ID Security Command Center Wiz Prisma Cloud GitHub GitLab Jenkins SonarQube Semgrep CodeQL Snyk Gitleaks Trivy Docker Kubernetes Terraform Checkov OPA MITRE ATT&CK VirusTotal AbuseIPDB AlienVault OTX MISP Python SOAR Cortex XSOAR

Next batch: 10/08/2026 · Online

Call Now

100% placement assistance

Enquire Now

Get course fees, batch dates & a callback

We never share your details.

Why This Course?

6 specialized tracks, one a month, 40 hours each

Approach: Concept → Hands-on Lab → Assignment → Mini Project → Job Scenario → Capstone → Mock Interview

40+ hands-on labs and 100+ assignments

25+ mini projects and exercises

6 major capstones plus an integrated enterprise capstone

Job scenarios, troubleshooting exercises and security investigations in every track

Mock interviews, portfolio and resume preparation throughout

Prerequisites

Basic Computer Knowledge

No Prior Linux Experience Required

Basic Mathematics and Logical Reasoning

Programme Overview

6 cyber security tracks, one a month — Networking & Linux Security, Ethical Hacking & Penetration Testing, SOC & SIEM Operations, Cloud Security, DevSecOps & Application Security, and AI Security, Threat Hunting & Automation. Each track follows Learn → Demonstrate → Perform → Investigate → Troubleshoot → Document → Present → Interview.

240 hrs

Training Hours

Specializations

Total Modules

4.8★

Average Rating

50K+

Students Trained

Track 1 — Networking & Linux Security

Build the foundation required for almost every cybersecurity role by mastering networking, Linux administration and security hardening. Job focus: Network/Security Analyst, Linux Security.

OSI & TCP/IP Subnetting Linux Administration SSH Hardening Firewall Log Analysis

Track 2 — Ethical Hacking & Penetration Testing

Develop practical skills for authorized vulnerability assessment and penetration testing. Job focus: VAPT Analyst, Ethical Hacker.

OSINT & Recon Nmap Burp Suite OWASP Top 10 Metasploit VAPT Reporting

Track 3 — SOC & SIEM Operations

Develop practical SOC analyst capabilities covering monitoring, alert triage, SIEM, detection, investigation, incident response and threat hunting. Job focus: SOC Analyst L1/L2, SIEM Analyst.

SIEM KQL / SPL Alert Triage Detection Rules MITRE ATT&CK Incident Response

Track 4 — Cloud Security

Develop practical cloud-security capabilities across AWS, Azure and GCP. Job focus: Cloud Security Analyst / Engineer.

IAM VPC / VNet Security KMS & Secrets CloudTrail CSPM CIS Benchmarks

Track 5 — DevSecOps & Application Security

Integrate application security throughout the software-development and cloud-deployment lifecycle. Job focus: DevSecOps, AppSec, Cloud Security.

OWASP Top 10 SAST & SCA Secret Scanning Container Security Kubernetes Security DAST

Track 6 — AI Security, Threat Hunting & Automation

An advanced track combining AI/GenAI security, LLM security, threat hunting, detection engineering and cybersecurity automation. Job focus: Threat Hunter, Security Automation, AI Security.

Prompt Injection RAG Security Agent Security Threat Hunting Detection Engineering Python Automation

Who is this programme for?

Whether you're a fresher, an IT or network administrator, a cloud or DevOps engineer or already working in support — this mentorship is built to take you into a Cybersecurity Analyst, SOC Analyst, VAPT Analyst, Cloud Security Engineer, DevSecOps Engineer, Threat Hunter or AI Security Analyst role.

Students & Freshers

No prior Linux experience needed — Track 1 starts at networking and Linux fundamentals and builds towards Cybersecurity Analyst and SOC Analyst L1 roles.

IT & Network Administrators

Move into Network Security Analyst, Security Operations Engineer and Junior Incident Response Analyst roles.

Aspiring Ethical Hackers

Train for VAPT Analyst, Penetration Tester and Application Security Analyst roles through authorized, methodology-driven testing.

Cloud & DevOps Engineers

Specialise as a Cloud Security Analyst, Cloud Security Engineer or DevSecOps Engineer across AWS, Azure and GCP.

SOC & Support Teams

Progress from alert triage into SIEM Analyst, Threat Hunter and Detection Engineer roles.

AI-Focused Engineers

Target AI Security Analyst and Security Automation Engineer roles with LLM, RAG and agent security plus Python automation.

Course Curriculum

240 total hours · 6 months

6 tracks • 33 modules • 40 hours a track, with labs, assignments and a capstone in each

Track 01 of 06 4 Modules Track 1 · 40 Hours

Networking & Linux Security

Build the foundation required for almost every cybersecurity role by mastering networking, Linux administration and security hardening.

Course Content

— Prerequisites

— Module 1: Fundamentals

Topics:

CIA Triad
Cybersecurity terminology
OSI Model
TCP/IP Model
IP addressing
Subnetting
TCP/UDP
DNS
DHCP
HTTP/HTTPS
SSH
FTP
SMTP
VPN
Firewall fundamentals

— Module 2: Networking

Topics:

IPv4/IPv6
Subnetting
Routing
Switching
VLANs
NAT
DNS
DHCP
ARP
ICMP
TCP/UDP
Network troubleshooting
Network segmentation

— Module 3: Linux

Topics:

Linux architecture
Filesystem
Users and groups
Permissions
Processes
Services
Package management
SSH
Cron
System logs
Bash
Networking commands
Storage
System monitoring

— Module 4: Linux Security

Topics:

File permissions
sudo security
SSH hardening
Firewall
SELinux concepts
Audit logs
Secure services
Patch management
Security baselines
Linux incident investigation

— Hands-On Labs

Labs:

Linux Security Lab Setup
TCP/IP Analysis Lab
Subnetting Lab
DNS Investigation Lab
Wireshark Packet Analysis Lab
Linux User & Group Security Lab
Linux Permission Security Lab
SSH Hardening Lab
Linux Firewall Lab
Linux Log Analysis Lab
Process Investigation Lab
Service Hardening Lab
Bash Security Automation Lab
Linux Incident Investigation Lab

— Assignments

Assignments:

Design an enterprise network
Perform subnetting exercises
Analyze packets using Wireshark
Configure Linux users/groups
Implement secure permissions
Harden SSH
Configure firewall rules
Analyze authentication logs
Create Linux security checklist
Prepare Linux security assessment report

— Mini Projects

Mini Projects:

Linux Server Hardening
Enterprise Network Security Assessment
Secure SSH Server
Linux Log Monitoring System

— Capstone Enterprise Linux & Network Security Assessment

Deliverables:

Network diagram
Security architecture
Linux hardening report
Firewall configuration
Log analysis
Vulnerability findings
Remediation report

— Job-Oriented Scenarios

Scenarios:

Investigate suspicious SSH logins
Troubleshoot network connectivity
Identify an unauthorized Linux user
Investigate failed authentication
Analyze suspicious network traffic
Harden an internet-facing Linux server
Troubleshoot DNS failure

— Troubleshooting Scenarios

Troubleshooting:

DNS resolution failure
Routing problems
SSH connection failure
Firewall blocking legitimate traffic
Permission denied
Service failure
High CPU/memory
Disk full
Network interface failure
Incorrect routing

— Industry Tools

Tools:

Linux
Ubuntu
Kali Linux
Wireshark
Nmap
Netcat
tcpdump
iptables/nftables
SSH
Bash
Syslog
auditd

— Best Practices

Best Practices:

Least privilege
SSH hardening
Strong authentication
Secure permissions
Patch management
Network segmentation
Centralized logging
Secure firewall configuration
Regular security auditing

Mock Interviews

› OSI/TCP-IP questions
› Subnetting exercises
› Linux troubleshooting
› SSH/security scenarios
› Firewall troubleshooting
› Real-world Linux administration scenarios

— Certifications

Certifications:

CompTIA Network+
CompTIA Security+
Linux+
LPIC-1
RHCSA

Track 02 of 06 6 Modules Track 2 · 40 Hours

Ethical Hacking & Penetration Testing

Develop practical skills for authorized vulnerability assessment and penetration testing.

Course Content

— Prerequisites

— Module 1: Fundamentals

Topics:

Ethical hacking
VAPT
Attack surface
Vulnerability vs exploit
Black/White/Grey Box
Rules of engagement
OWASP methodology
MITRE ATT&CK fundamentals

— Module 2: Reconnaissance

Topics:

Passive reconnaissance
Active reconnaissance
OSINT
DNS enumeration
Subdomain discovery

— Module 3: Scanning

Topics:

Host discovery
Port scanning
Service enumeration
Vulnerability assessment

— Module 4: Web Security

Topics:

Authentication
Authorization
SQL injection
XSS
CSRF
File upload
Path traversal
SSRF
API security
Security misconfiguration

— Module 5: Exploitation

Topics:

Exploitation fundamentals
Metasploit
Shell concepts
Privilege escalation
Post-exploitation fundamentals

— Module 6: Reporting

Topics:

Evidence
CVSS
Business impact
Remediation
Retesting

— Hands-On Labs

Labs:

Kali Linux setup
Nmap scanning
DNS enumeration
Web reconnaissance
SMB enumeration
Vulnerability scanning
Burp Suite
SQL injection lab
XSS lab
Authentication testing
API security lab
Metasploit lab
Linux privilege escalation
Windows privilege escalation
VAPT reporting lab

— Assignments

Assignments:

Reconnaissance report
Nmap analysis
Vulnerability classification
Web application assessment
SQL injection analysis
XSS analysis
API security assessment
Linux privilege assessment
Windows privilege assessment
VAPT report

— Mini Projects

Mini Projects:

Network VAPT
Web Application VAPT
API Security Assessment
Linux Security Assessment
Windows Security Assessment

— Capstone Enterprise Network + Web Application Penetration Test

— Job Scenarios

Scenarios:

External VAPT
Web application assessment
Vulnerability validation
Authentication testing
API testing
Privilege assessment
Security report preparation

— Troubleshooting

Troubleshooting:

Nmap results
Burp proxy problems
Authentication issues
False-positive vulnerabilities
Scanner failures
Lab connectivity
Exploit validation issues

— Industry Tools

Tools:

Kali Linux
Nmap
Burp Suite
OWASP ZAP
Metasploit
Nessus
OpenVAS/Greenbone
Nuclei
Wireshark
SQLMap
Hashcat
John the Ripper

— Best Practices

Best Practices:

Written authorization
Scope control
Non-destructive testing
Evidence preservation
Manual validation
Secure reporting
Responsible disclosure

Mock Interviews

› Nmap output analysis
› OWASP questions
› VAPT methodology
› Burp Suite practical
› Vulnerability-report analysis
› Penetration-testing scenarios

— Certifications

Certifications:

CEH
eJPT
PNPT
CompTIA PenTest+
OSCP

Track 03 of 06 3 Modules Track 3 · 40 Hours

SOC & SIEM Operations

Develop practical SOC analyst capabilities covering monitoring, alert triage, SIEM, detection, investigation, incident response and threat hunting.

Course Content

— Prerequisites

— Module 1: Fundamentals

Topics:

SOC architecture
SOC L1/L2/L3
Event vs alert vs incident
Incident lifecycle
Security monitoring
Logs
IOCs
IOAs
MITRE ATT&CK

— Module 2: Log Sources

Topics:

Windows logs
Linux logs
Firewall logs
DNS logs
VPN logs
Endpoint logs

— Module 3: SIEM, Detection & Response

Topics:

SIEM architecture
Log ingestion
Parsing
Correlation
Detection rules
Alert triage
False positives
Threat intelligence
Threat hunting
Incident response
MITRE ATT&CK
Security reporting
SOAR fundamentals

— Hands-On Labs

Labs:

Windows Event Log Analysis
Linux Log Analysis
Firewall Log Analysis
DNS Investigation
SIEM Setup
Log Ingestion
SIEM Queries
Dashboard Creation
Alert Creation
Correlation Rules
Brute-Force Detection
PowerShell Detection
Phishing Investigation
Compromised Account Investigation
Threat Hunting
MITRE ATT&CK Mapping
Incident Timeline
SOC Incident Report

— Assignments

Assignments:

SOC architecture
Log analysis
SIEM queries
Dashboard creation
Detection rule
Brute-force investigation
Phishing investigation
IOC analysis
MITRE mapping
Incident report

— Mini Projects

Mini Projects:

Failed Login Detection
Phishing Investigation
Windows Threat Monitoring
Network Security Monitoring
MITRE ATT&CK Detection Project

— Capstone Enterprise SOC & SIEM Investigation

— Job Scenarios

Scenarios:

Brute-force attack
Phishing alert
Compromised account
Suspicious PowerShell
Malware alert
Impossible travel
Suspicious DNS
Data-exfiltration indicators
Lateral-movement indicators

— Troubleshooting

Troubleshooting:

Missing logs
Incorrect parsing
SIEM query problems
False positives
Missing alerts
Agent offline
Dashboard problems
Detection rule failures

— Industry Tools

Tools:

Microsoft Sentinel
Splunk
Elastic Security
QRadar
Defender for Endpoint
CrowdStrike
SentinelOne
Wireshark
Zeek
Suricata
Sigma
KQL
SPL

— Best Practices

Best Practices:

Alert validation
Evidence preservation
Detection tuning
MITRE mapping
Incident documentation
Proper escalation
Continuous monitoring
Shift handover

Mock Interviews

› SIEM query exercises
› Alert-triage scenarios
› Phishing investigation
› MITRE ATT&CK
› Incident-response questions
› L1/L2 SOC scenarios

— Certifications

Certifications:

SC-200
CompTIA CySA+
Splunk certifications
EC-Council CSA
GSEC
GCIH

Track 04 of 06 6 Modules Track 4 · 40 Hours

Cloud Security

Develop practical cloud-security capabilities across AWS, Azure and GCP.

Course Content

— Prerequisites

Prerequisites:

Networking
Linux
Security fundamentals
Basic cloud knowledge

— Module 1: Fundamentals

Topics:

Cloud computing
IaaS/PaaS/SaaS
Shared Responsibility Model
Cloud attack surface
IAM
Encryption
Zero Trust
Cloud networking

— Module 2: IAM

Topics:

AWS IAM
Entra ID
Azure RBAC
GCP IAM
MFA
Least privilege
Managed identities
Privileged access

— Module 3: Network Security

Topics:

VPC/VNet
Subnets
Security Groups
NSGs
Firewalls
WAF
Private endpoints
VPN
Network segmentation

— Module 4: Data Security

Topics:

KMS
Key Vault
Cloud KMS
Secrets management
Encryption
Storage security

— Module 5: Monitoring

Topics:

CloudTrail
Azure Activity Logs
GCP Audit Logs
GuardDuty
Defender for Cloud
Security Command Center
SIEM integration

— Module 6: CSPM

Topics:

Misconfiguration
Vulnerability management
Compliance
CIS Benchmarks

— Hands-On Labs

Labs:

AWS IAM
Azure Entra/RBAC
GCP IAM
Least-Privilege Lab
VPC Security
VNet Security
Security Group/NSG
Cloud Firewall
WAF
Storage Security
KMS
Secrets Manager
VM Hardening
CloudTrail
Azure Activity Logs
GCP Audit Logs
CSPM Assessment
Cloud Incident Investigation

— Assignments

Assignments:

Secure cloud architecture
IAM assessment
VPC/VNet security
Storage security
Encryption
Cloud logging
CSPM assessment
Cloud incident-response plan

— Mini Projects

Mini Projects:

Secure Cloud Landing Zone
Cloud IAM Assessment
Cloud Network Security Assessment
Cloud Storage Security
Cloud SIEM Monitoring

— Capstone Enterprise Multi-Cloud Security Assessment

Coverage:

IAM
Network
Compute
Storage
Encryption
Logging
Monitoring
Compliance
Incident response

— Job Scenarios

Scenarios:

Public storage exposure
Compromised cloud credentials
Excessive IAM privileges
Public database
Open security group
Suspicious API calls
Cryptomining
Cloud audit-log investigation

— Troubleshooting

Troubleshooting:

IAM denial
Cross-account access
Security-group blockage
Private endpoint failure
DNS problems
Missing audit logs
WAF false positives
KMS access problems

— Industry Tools

Tools:

AWS IAM
AWS Security Hub
GuardDuty
CloudTrail
AWS KMS
Microsoft Entra ID
Defender for Cloud
Sentinel
Azure Key Vault
GCP IAM
Security Command Center
Wiz
Prisma Cloud
Checkov

— Best Practices

Best Practices:

Least privilege
MFA
Zero Trust
Centralized logging
Encryption
Secure secrets
Network segmentation
Continuous posture management
Secure cloud architecture

Mock Interviews

› IAM scenarios
› Cloud architecture
› Cloud incident response
› Security-group troubleshooting
› Cloud misconfiguration scenarios

— Certifications

Certifications:

AWS Certified Security – Specialty
AZ-500
Google Cloud Professional Cloud Security Engineer
CCSP
Security+

Track 05 of 06 10 Modules Track 5 · 40 Hours

DevSecOps & Application Security

Teach students how to integrate application security throughout the software-development and cloud-deployment lifecycle.

Course Content

— Prerequisites

Prerequisites:

Linux
Git
Basic programming
Basic cloud concepts

— Module 1: Fundamentals

Topics:

DevSecOps
Secure SDLC
Shift Left
Shift Right
OWASP
Threat modeling
Security as Code
Policy as Code

— Module 2: Application Security

Topics:

OWASP Top 10
API Security
Authentication
Authorization
Secure coding

— Module 3: SAST

— Module 4: SCA

Topics:

Dependency scanning
CVE/CVSS
SBOM
Supply-chain security

— Module 5: Secrets

— Module 6: CI/CD

Topics:

Jenkins
GitHub Actions
GitLab
Azure DevOps
Security gates

— Module 7: Containers

— Module 8: Kubernetes

Topics:

RBAC
Network Policies
Pod Security
Falco

— Module 9: IaC

Topics:

Terraform
Checkov
OPA
Policy-as-Code

— Module 10: DAST

— Hands-On Labs

Labs:

Secure SDLC
Threat Modeling
Git Security
Gitleaks
SonarQube
Semgrep
CodeQL
Dependency scanning
SBOM
Jenkins Security Pipeline
GitHub Actions Security
Docker Security
Trivy
Container Signing
Kubernetes RBAC
Kubernetes Network Policies
Terraform Security
Checkov
DAST
API Security
End-to-End DevSecOps Pipeline

— Assignments

Assignments:

Secure SDLC
OWASP assessment
Git security
Secret detection
SAST analysis
SCA assessment
SBOM
CI/CD security
Docker security
Kubernetes security
IaC security
DAST assessment

— Mini Projects

Mini Projects:

Secure CI/CD Pipeline
Application Security Assessment
Container Security
Kubernetes Security
Terraform Security

— Capstone Enterprise DevSecOps Security Pipeline

— Job Scenarios

Scenarios:

Secret committed to Git
Critical dependency
Vulnerable Docker image
Kubernetes privilege issue
Terraform misconfiguration
DAST vulnerability
CI/CD security gate
Compromised build pipeline

— Troubleshooting

Troubleshooting:

SAST failure
False positives
Pipeline credential failure
Docker build failure
Kubernetes RBAC failure
NetworkPolicy blocking traffic
Terraform policy failure
DAST authentication failure

— Industry Tools

Tools:

GitHub
GitLab
Jenkins
Azure DevOps
SonarQube
Semgrep
CodeQL
Snyk
Gitleaks
Trivy
Docker
Kubernetes
Falco
Terraform
Checkov
OPA
Burp Suite
OWASP ZAP

— Best Practices

Best Practices:

Security by design
Shift-left
Automated security testing
Secrets protection
Dependency management
SBOM
Container hardening
IaC scanning
Secure CI/CD
Security gates
Continuous monitoring

Mock Interviews

› SAST vs DAST
› SCA
› SBOM
› CI/CD security
› Docker/Kubernetes
› IaC security
› OWASP
› DevSecOps architecture

— Certifications

Certifications:

Security+
AWS Security Specialty
AZ-500
CKS
OSWE
GIAC application-security certifications
DevSecOps certifications

Track 06 of 06 4 Modules Track 6 · 40 Hours

AI Security, Threat Hunting & Automation

An advanced security track combining AI/GenAI security, LLM security, threat hunting, detection engineering and cybersecurity automation.

Course Content

— Prerequisites

Prerequisites:

Cybersecurity fundamentals
Networking
Linux
SOC concepts
Basic Python
Basic cloud concepts

— Module 1: Fundamentals

Topics:

AI/ML security fundamentals
GenAI security
LLM fundamentals
Threat hunting
Detection engineering
Security automation
MITRE ATT&CK
IOC/IOA
Security analytics

— Module 2: AI Security

Topics:

AI security architecture
LLM security
Prompt security
Prompt injection
Indirect prompt injection
Data leakage
Sensitive-data exposure
Model abuse
Model access control
AI supply-chain security
AI application security
RAG security
Vector database security
Agent security
Tool/API security for AI agents

— Module 3: Threat Hunting

Topics:

Hunting methodology
Hypothesis-driven hunting
IOC hunting
Behavioral hunting
Identity hunting
Endpoint hunting
Network hunting
Cloud hunting
MITRE ATT&CK mapping
Detection engineering

— Module 4: Automation

Topics:

Python for security
API integration
IOC enrichment
Automated investigation
SOAR concepts
Automated alert triage
Security reporting
Threat-intelligence automation

— Hands-On Labs

Labs:

AI Security Lab Setup
Prompt Injection Testing Lab
LLM Data-Leakage Lab
RAG Security Lab
AI Agent Security Lab
AI API Security Lab
IOC Enrichment Lab
Threat-Hunting Lab
MITRE ATT&CK Hunting Lab
Authentication Hunting Lab
Endpoint Hunting Lab
Network Threat Hunting Lab
Cloud Threat Hunting Lab
Detection Engineering Lab
Sigma Rule Lab
Python Security Automation Lab
Threat Intelligence API Lab
Automated Alert Enrichment Lab
SOC Automation Lab
AI-Assisted Security Investigation Lab

— Assignments

Assignments:

AI threat model
LLM security assessment
Prompt-injection analysis
RAG security assessment
AI data-leakage assessment
Threat-hunting hypothesis
MITRE ATT&CK mapping
Detection rule creation
IOC enrichment script
Security automation script
Automated incident report
AI security assessment report

— Mini Project 1 — AI Application Security Assessment

Assess a simulated GenAI application for:

Prompt injection
Data leakage
Access control
Unsafe tool usage
Insecure API integration

— Mini Project 2 — Threat Hunting Platform

— Mini Project 3 — Security Automation

Build Python automation for:

IOC enrichment
IP/domain reputation
Hash analysis
Alert enrichment
Automated reporting

— Mini Project 4 — AI-Assisted SOC Investigation

Workflow assists analysts in:

Alert summarization
IOC extraction
Log analysis
MITRE mapping
Investigation documentation

— Capstone Capstone 1 — Enterprise Threat Hunting Program

Students Create:

Threat-hunting hypotheses
Data sources
Hunting queries
Detection rules
MITRE ATT&CK mapping
Investigation workflow
Final threat-hunting report

— Capstone Capstone 2 — AI Security Assessment

Assessment Path:

User → Application → LLM → RAG → Vector DB → Tools/APIs → Cloud

Assess

› Identity
› Prompt security
› Data security
› RAG security
› Agent security
› API security
› Logging
› Monitoring
› Abuse scenarios

— Capstone Capstone 3 — Automated SOC Investigation

— Real-Time Job Scenarios

Scenarios:

Investigate an advanced persistent threat hypothesis
Hunt for suspicious authentication patterns
Identify abnormal PowerShell activity
Hunt for suspicious DNS behavior
Investigate unusual cloud API activity
Develop a detection rule for a MITRE ATT&CK technique
Enrich suspicious IP addresses automatically
Automate IOC reputation checks
Build an automated SOC report
Investigate prompt injection against an LLM application
Investigate sensitive information leakage from an AI application
Assess an AI agent's access to external tools
Identify insecure RAG data access
Investigate suspicious API calls made by an AI application

— Troubleshooting Scenarios

Troubleshooting:

Threat-hunting query returns excessive results
Detection rule generates false positives
IOC enrichment API fails
Threat-intelligence feed is unavailable
Python automation fails
SIEM API authentication fails
AI model returns unsafe/unexpected output
Prompt-injection defense fails
RAG retrieves unauthorized information
AI agent accesses an unintended tool
Security automation creates duplicate incidents

— Industry Tools

Tools:

Microsoft Sentinel
Splunk
Elastic Security
KQL
SPL
Sigma
MITRE ATT&CK
VirusTotal
AbuseIPDB
AlienVault OTX
MISP
OWASP GenAI Security resources
LLM security testing frameworks
Python
REST APIs
PowerShell
SOAR platforms
Microsoft Logic Apps
Splunk SOAR
Cortex XSOAR

— Best Practices

Best Practices:

Treat AI output as untrusted
Apply least privilege to AI agents
Never expose secrets to models unnecessarily
Protect sensitive training/RAG data
Validate tool/API access
Log AI security events
Apply human approval to high-impact actions
Continuously test AI applications
Use threat-informed detection
Automate repetitive tasks while maintaining analyst oversight
Validate automated security actions before production use

Mock Interviews

› Threat-hunting scenarios
› MITRE ATT&CK
› Detection engineering
› Python automation
› AI security
› Prompt injection
› RAG security
› AI-agent security
› SOC automation scenarios

— Certification Names

Certifications:

GIAC Cyber Threat Intelligence (GCTI)
GIAC Certified Detection Engineer (GCDE)
GIAC Certified Incident Handler (GCIH)
CompTIA CySA+
Microsoft SC-200
Relevant cloud-security certifications
Vendor-specific AI/security certifications as available

Tools & Technologies

Every tool and library listed here is installed, configured and used in a hands-on lab session.

Networking

Wireshark

Packet Analysis

Nmap

Host & Port Scanning

tcpdump

Traffic Capture

Netcat

Network Utility

Zeek

Network Security Monitoring

Suricata

IDS / IPS

Linux

Ubuntu

Linux Distribution

Kali Linux

Security Testing Distribution

Bash

Security Automation

SSH

Secure Remote Access

auditd

Audit Logging

SELinux

Mandatory Access Control

Penetration Testing

Burp Suite

Web Application Testing

OWASP ZAP

DAST Scanning

Metasploit

Exploitation Framework

Nessus

Vulnerability Scanning

Nuclei

Template-Based Scanning

SQLMap

SQL Injection Testing

SOC / SIEM

Microsoft Sentinel

Cloud-Native SIEM

Splunk

SIEM & Analytics

Elastic Security

Log Analytics & Detection

QRadar

Enterprise SIEM

Defender / CrowdStrike

Endpoint Detection & Response

Sigma, KQL & SPL

Detection Rules & Queries

Cloud Security

AWS Security Hub

Security Posture

GuardDuty

Threat Detection

CloudTrail

Audit Logging

Defender for Cloud

Azure Posture & Protection

Entra ID

Identity & Access

Wiz / Prisma Cloud

CSPM

DevSecOps

GitHub / GitLab

Source & Pipelines

Jenkins

CI/CD with Security Gates

SonarQube / Semgrep / CodeQL

SAST

Snyk & Gitleaks

SCA & Secret Scanning

Trivy & Docker

Container Security

Terraform, Checkov & OPA

IaC Security & Policy as Code

Threat Intelligence & AI Security

MITRE ATT&CK

Adversary Framework

VirusTotal & AbuseIPDB

IOC Reputation

AlienVault OTX & MISP

Threat Intelligence Sharing

Python & REST APIs

Security Automation

LLM Security Testing

Prompt, RAG & Agent Security

SOAR / Cortex XSOAR

Automated Response

58+

Tools & Libraries

33+

Hands-On Modules

Specializations

240

Training Hours

Six specializations, six capstones — and a security portfolio you can walk an interviewer through.

A major capstone in every track, three in Track 6, and one integrated enterprise capstone — from a Linux and network security assessment and an authorized penetration test to a SOC investigation, a multi-cloud security assessment, a DevSecOps pipeline, a threat-hunting program and an AI security assessment.

PROJECT // 01

Enterprise Linux & Network Security Assessment

→Network Diagram → Security Architecture

→Linux Hardening → Firewall Configuration

→Log Analysis → Findings → Remediation

Track 1 Capstone Foundation

Job focus: Network / Security Analyst, Linux Security

Map and assess an enterprise network and its Linux estate, then document what you hardened, what you found and how it should be fixed.

Network diagram

Security architecture

Linux hardening report

Firewall configuration

Log analysis

Vulnerability findings

Remediation report

Stack Linux Wireshark Nmap

PROJECT // 02

Enterprise Network + Web Application Penetration Test

→Recon → Scan → Enumerate

→Validate → Authorized Exploitation

→Evidence → Report → Remediation

Track 2 Capstone Intermediate

Job focus: VAPT Analyst, Ethical Hacker

A full authorized engagement, from reconnaissance through validated exploitation to an evidence-backed report and remediation guidance.

Network VAPT

Web Application VAPT

API Security Assessment

Linux Security Assessment

Windows Security Assessment

Stack Kali Burp Suite Metasploit

PROJECT // 03

Enterprise SOC & SIEM Investigation

→Collect → Detect → Triage

→Investigate → Correlate

→Respond → Report

Track 3 Capstone Intermediate

Job focus: SOC Analyst L1/L2, SIEM Analyst

Run the full SOC lifecycle on a simulated environment — collect the logs, build the detections, triage the alerts and take an incident through to a written report.

Failed Login Detection

Phishing Investigation

Windows Threat Monitoring

Network Security Monitoring

MITRE ATT&CK Detection Project

Stack Sentinel Splunk Sigma

PROJECT // 04

Enterprise Multi-Cloud Security Assessment

→IAM → Network → Compute → Storage

→Encryption → Logging → Monitoring

→Compliance → Incident Response

Track 4 Capstone Advanced

Job focus: Cloud Security Analyst / Engineer

Assess a multi-cloud estate end to end, from identity and network through to compliance and incident response.

Secure Cloud Landing Zone

Cloud IAM Assessment

Cloud Network Security Assessment

Cloud Storage Security

Cloud SIEM Monitoring

Stack AWS Azure GCP

PROJECT // 05

Enterprise DevSecOps Security Pipeline

→Git → SAST → SCA → Secret Scan

→Build → Container Scan → IaC Scan → DAST

→Kubernetes → Cloud → Monitoring

Track 5 Capstone Advanced

Job focus: DevSecOps, AppSec, Cloud Security

Security gates at every stage of delivery — source, dependencies, secrets, images, infrastructure and the running application.

Secure CI/CD Pipeline

Application Security Assessment

Container Security

Kubernetes Security

Terraform Security

Stack SonarQube Trivy Checkov

PROJECT // 06

Enterprise Threat Hunting Program

→Hypotheses → Data Sources → Hunting Queries

→Detection Rules → MITRE ATT&CK Mapping

→Investigation Workflow → Report

Track 6 — Capstone 1 Advanced

Hypothesis-driven hunting, mapped to MITRE ATT&CK

Define the hypotheses and data sources, write the hunting queries and detection rules, then work an investigation through to a threat-hunting report.

Threat-hunting hypotheses

Data sources

Hunting queries

Detection rules

MITRE ATT&CK mapping

Investigation workflow

Final threat-hunting report

Stack KQL Sigma MITRE

PROJECT // 07

AI Security Assessment

→User → Application → LLM

→RAG → Vector DB → Tools / APIs

→Cloud → Logging → Monitoring

Track 6 — Capstone 2 Advanced

Assess an enterprise GenAI application end to end

Work the whole path from user to cloud — identity, prompt security, data and RAG security, agent and API security, logging, monitoring and abuse scenarios.

Identity

Prompt security

Data security

RAG security

Agent security

API security

Logging and monitoring

Abuse scenarios

Stack LLM RAG Vector DB

PROJECT // 08

Automated SOC Investigation

→SIEM Alert → Python / API

→IOC Enrichment → Threat Intelligence

→MITRE Mapping → Analyst Decision → Report

Track 6 — Capstone 3 Advanced

Python and APIs doing the enrichment, the analyst making the call

Take a SIEM alert through automated IOC enrichment and threat intelligence to a MITRE mapping, leaving the decision — and the report — with the analyst.

IOC enrichment

IP/domain reputation

Hash analysis

Alert enrichment

Automated reporting

Stack Python REST APIs SOAR

PROJECT // 09

Enterprise Cyber Defense & Security Operations Platform

→Users → Network → Linux/Windows → Web App

→Cloud → Containers → Kubernetes → CI/CD

→AI Application → SIEM

Integrated Final Capstone Flagship

All six tracks combined into one simulated enterprise

Users, network, Linux and Windows servers, a web application, cloud, containers, Kubernetes, CI/CD, an AI application and a SIEM — assessed, monitored, hunted and reported across network security, Linux security, penetration testing, SOC/SIEM, cloud security, DevSecOps, AI security, threat hunting and automation.

Enterprise Security Architecture, Network Diagram and Threat Model

Vulnerability Assessment and Penetration-Test Reports

SIEM Dashboard, Detection Rules and MITRE ATT&CK Mapping

Cloud Security Assessment and DevSecOps Security Pipeline

Container Security and IaC Security Reports

AI Security Assessment and Threat-Hunting Report

Incident-Response Report, Remediation Plan and Executive Security Presentation

Stack SIEM Cloud DevSecOps

All 9 projects go directly into your portfolio & resume — reviewed by mentors before you graduate.

See Sample Project Reports

Upcoming Batches

Start Date	Time	Day	Mode	Enroll
10/08/2026	08:00 PM – 09:30 PM	Weekday	Online	Enroll Now

Why Radical Technologies

Live Online Training

Highly practical oriented training
Installation support on your system
24/7 Email and Phone support
100% Placement Assistance
Global Certification Preparation
Trainer-Student Interactive Portal
Assignments and Projects by Mentors

Live Classroom Training

Weekend / Weekdays / Morning / Evening batches
80:20 Practical and Theory ratio
Real-life Case Studies
Easy make-up for missed sessions
PSI | Kryterion | Certification Test Centers
Lifetime Video Classroom Access (coming soon)
Resume Prep and Mock Interviews

Self-Paced Training

Learn 300+ courses at your own time
50,000+ Satisfied Learners
Course Completion Certificate
Practical Labs available
Mentor Support available
Doubt Clearing Session available
10% Discounted Global Certification

Like the Curriculum? Let's Get Started

Join 50,000+ students already enrolled at Radical Technologies

Enroll Now

Global Certification

Radical Technologies is the leading IT certification institute in Pune, offering globally recognized certifications across various domains. With expert trainers and comprehensive materials, we ensure students gain in-depth knowledge and hands-on experience to excel in their careers. Our certification programs are tailored to meet industry standards — this mentorship follows a certification roadmap from CompTIA Network+ and Security+ through CEH, OSCP, SC-200, CySA+, AWS Security Specialty, AZ-500 and CKS to GCIH, GCTI and GCDE, empowering individuals to stay ahead in the ever-evolving cyber security landscape.

Career Services

Our dedicated Placement Support Team works with you from day one — resume forwarding, technical interview preparation, HR interview preparation, career guidance, soft skills training, mock interviews and internship assistance, with access to 850+ Hiring Partners and placement assistance until you get hired.