Fundamentals of applied threat intelligence: the MITRE ATT&CK framework, TTP analysis, APT group profiling, advanced OSINT, and the development of actionable threat intelligence. Students learn to think like an adversary before building any defenses.

Offensive security with direct application to defense: penetration testing methodologies, vulnerability exploitation, post-exploitation techniques, pivoting, and detection evasion. Extensive use of cyber ranges to simulate attacks in controlled environments. Based on the PTES standard and OWASP frameworks.

Designing resilient security architectures: Zero Trust principles, microsegmentation, identity and privileged access management (PAM/IAM), system hardening, and cloud-native security (AWS, Azure, GCP).

Detection engineering based on real threats: development of SIEM rules (Sigma, Splunk SPL, KQL), proactive threat hunting, behavioral analysis (UEBA), and response orchestration (SOAR).

Digital forensics with procedural rigor: memory analysis, disk forensics, network forensics, and cloud forensics. DFIR methodologies for containment, eradication, and recovery. Preservation of evidence with legal admissibility and preparation of technical and executive reports.

An integrative project that simulates a real-world security scenario, drawing on skills from all previous modules. It may include red team/blue team exercises, forensic investigation of a complex incident, or implementation of a Zero Trust architecture.