Application security, no hoodie required.
For the experienced engineer. Secure software is engineering, not just something for specialists, so you can learn how it works. This course is eight weeks, async, and guided by a security researcher.
N° 04 / SEC
The landscape is vast, but you don't have to map all of it. Illustrations by Joe Groove.
Mythos and other offensive research models, the supply chain, CI breaches, CVEs, the collapse of the exploitation window from months into hours: the agentic era of software development is also the agentic era of vulnerability exploitation. You have product experience and technical skills, and you know the stakes, but understanding this fast-moving, jargon-rich field can feel like jumping onto a moving train.
It isn't magic, and it isn't just for lifelong hackers.
This course is for engineers and engineering managers who want to meet the security moment with new competencies. We'll get the train schedule, look at the map, and pack what we need for the trip, demystifying the landscape as we go. Then we'll dispense with the worry about who gets to do this, by doing it.
Most people who'd benefit from coaching never get it, because the price puts it out of reach, especially right now. This course is built to bridge that gap: structure, safe space, and personalised feedback, at a price that doesn't require a development budget.
A little reframing, the concepts you need, a hands-on project on a safe synthetic target, and support, with personal feedback on everything you turn in.
The fictional hacker archetype casts a long shadow: self-doubt about who's allowed to do security, and fatalism about whether it's even possible. We bring it back to reality through three personae: you as the defender, the adversary, and who you protect and why. That leads into threat modeling, a high-level look at the state of the art on both sides, how practitioners use frameworks to manage the cognitive load, and our ethics and safety practices.
We dispel some magic by designing and building a small tool. We'll make a fun-sized offensive research script or agent, in a safe and synthetic context, consider the guardrails, and direct it to a surface you're interested in viewing from the other side. We pair this with local LLM workflows for data privacy and sovereignty from the start, and write up a vulnerability report on what we found.
Based on your takeaways from the previous two modules, you'll locate your first sources of research information on your vulnerability, and learn how to remediate it. Then we develop a theory of how to prevent it being written in the first place, in a team context, and get more concrete about guardrails in agentic and human coding.
We pull the camera back from a single flaw to your multi-system environment: CI/CD and supply chain, secure coding as policy, which “shift-left” tooling applies to your products, how to keep noise low, the intersection of least effort and most improvement, and staying realistic and current, so you can sleep at night.
Self-paced and asynchronous, but you're never alone. You have a cohort, a project, and personal feedback on everything you turn in.
Self-paced, asynchronous content delivered over 8 weeks.
Audio on a walk, reading between meetings, project work at your own pace. The project is the biggest variable, so you might use more time if it pulls you in.
A conversation between Halle and Cate each module. An experienced security engineer and an experienced software engineer, exploring these topics alongside you.
Module content, frameworks, and the concepts you need, so the jargon is demystified.
Build a small tool and use it to find, then remediate, a real vulnerability, on a safe, synthetic target you can’t hurt anyone with.
Submit your exercises and project work and get personal written feedback on what you turn in.
Cate and Halle met at an iOS conference and have known each other for years. After discussing how difficult it's become as an engineer to get to grips with application security right now, they built the course they thought engineers actually needed, to make the current situation approachable, not mystifying.
Offensive Security Researcher · AppSec Engineer · Certified Ethical Hacker
A veteran indie software engineer and end-user privacy advocate who became an offensive security researcher and application security engineer. A Certified Ethical Hacker with 12 Apple Security credits spanning all Apple devices, with her CVE proofs of concept including a macOS remote-control camera and a Lock Screen keylogger, both packaged as sandboxed App Store apps. She lives in Berlin.
Author · Fractional CTO · Coach
Author of The Engineering Leader, fractional CTO at Twill, and engineering leadership coach. Previously in leadership roles at DuckDuckGo and Automattic.
More about Cate at cate.blog →Bring security into your engineering, with help from real humans. One-time payment, eight weeks, and personal feedback on your work.
We'll email you when new dates and scholarship rounds open up.