ECEH-100 / FOUNDATION
Build.
Design the network, virtualize the environment, deploy Active Directory and security controls.
00
The ECEH program
Build it.Operate it.Defend it.
A hands-on cybersecurity engineering pathway where every layer you build becomes the environment you later learn to defend.
Scroll through the system
01
Mission architecture
Three stages. One continuous environment.
No disconnected modules. No reset between courses. You keep adding operational depth to the same enterprise system.
ECEH-200 / OPERATIONS
Operate.
Run services, databases, endpoints, identity and the day-to-day systems that keep an enterprise alive.
ECEH-300 / DEFENSE
Defend.
Analyse malware, hunt threats, detect attacks and respond inside the environment you already understand.
02
ECEH-100 / flagship
The enterprise starts here.
Eight weeks. Twelve hands-on labs. You finish with a working enterprise you built yourself and a management-grade vulnerability assessment report you can explain to an employer.
00 / INTROFoundation
Understanding Technology
OSI model and the core security technologies around modern infrastructure.
01 / NETWORK1 lab
Networking
Design and build a network intended to support 500 hosts.
02 / VIRTUAL1 lab
Virtualization
Stand up the compute environment the enterprise will run on.
03 / IDENTITY6 labs
Enterprise Network & AD
Active Directory, Group Policy, PowerShell and identity at enterprise scale.
04 / MALWARE2 labs
Malware Analysis
Foundational static triage with MITRE ATT&CK context.
05 / VULN2 labs
Vulnerability Management
Discover, assess, prioritize and report vulnerabilities to standard.
03
ECEH-200 / operate
Make the enterprise run.
ECEH-100 gives you the environment. ECEH-200 teaches you to operate it: enterprise software, databases, web services, endpoint management, remote access, and solving real customer use-cases.
Managing an Enterprise Network
Network administration, enterprise software implementation and support, enterprise assets and resources, and remote access management.
Managing Cybersecurity Solutions
Translate customer use-cases into fit-for-purpose security solutions, then implement and support them in the environment.
CONTINUITY / ECEH-300
Wazuh is introduced here as a working SIEM and becomes the detection backbone for the blue-team stage.
01
Database Services
Microsoft SQL Server, instances, authentication and enterprise users.
02
Web Application & Certificates
IIS, self-signed and domain certificates, A-records and CNAMEs.
03
Endpoint Protection
Kaspersky Security Center, agent deployment, reports and health checks.
04
Vulnerability Scanning at Scale
Nexpose deployment, Windows agents through GPO, scanning and reporting.
05
Remote Application Publishing
Remote Desktop Services and HTTPS application publishing.
06
SIEM Foundations / Wazuh
Ingest telemetry, build simple dashboards and generate reports.
04
ECEH-300 / defend
ECEH-300.
Blue Team Operations.
You take the enterprise you built and learn to defend it: analyse malware, attack the domain, create visibility, hunt the intrusion and respond with the discipline of a real security operations team.
01AnalyseMalware
02AttackDomain
03DetectTelemetry
04HuntThreats
05RespondIncident
05
What you leave with
Proof of work, not just attendance.
01
A working enterprise build
Infrastructure you can walk through, troubleshoot, operate and defend.
02
An operational services stack
Databases, web services, endpoint protection, remote access and SIEM foundations running in your lab.
03
A management-grade vulnerability report
Evidence that you can translate technical findings into business-relevant reporting.
04
Blue-team capstone reports
Malware triage and incident-response artifacts that show how you investigate, explain and respond.
Enterprise environment / built by you
06
Founding cohort
Fifteen seats.Founding rate.
Small class. Direct instructor access. The first version of the experience.