Welcome to Breaking Into the Security Mindset

Welcome! We’re glad you’re here.

Probably something about the current security landscape has caught your attention - whether that is the rate at which exploits appear now that offensive research models are mainstream, or the way agentic tools are reshaping both attack and defence. You might be feeling the unease of shipping products without really knowing what’s underneath them. You know there is more to pay attention to, but you aren’t sure yet where your attention should go.

The good news: this isn’t magic, and it isn’t just for lifelong hackers. Secure software is engineering, which means you can learn how it works.

What this course is

Breaking Into the Security Mindset is an eight-week, async course for engineers and engineering managers who want to bring security competency into their engineering work. Four modules, each with written content, a two-host audio conversation per module, and exercises you submit for personalised feedback.

It’s a starting point rather than a comprehensive curriculum: enough grounding in the personae, the practices, and the current state of the art that you can intentionally develop secure products in the agentic era, and know where to keep learning from here.

Why we’re doing this

Halle kept having two versions of the same conversation. With engineers and engineering managers, it was about the threat from agentic offensive security tools. With other security practitioners, it was about moving security consciousness earlier in product development - to defend against exactly those tools. She built this course to bring the two together: to answer the questions engineers and EMs are actually asking, and to give them a security lens they can apply to their projects from the outset.

Cate’s here as the co-host who represents the experienced engineer trying to figure this out alongside you.

Who we are

Halle Winkler: a veteran indie software engineer and end-user privacy advocate who became an offensive security researcher and a consulting application security engineer. Certified Ethical Hacker, with 12 Apple Security credits spanning all Apple devices, including a macOS remote-control camera exploit and a macOS Lock Screen password keylogger, both packaged as sandboxed App Store apps. Also certified in iOS app pentesting and GitHub Security. Lives in Berlin.

Cate Huston: engineering leadership coach and co-founder of DRI Your Career. Author of The Engineering Leader. Fractional CTO at Twill; previously DuckDuckGo and Automattic. Based in Ireland.

How to engage with each module

Modules release on a schedule, and you’ll get an email when each is available.

Read first. The written content lays out the frameworks and concepts for the module and grounds your learning.

Then listen. Each module has a ~45 minute audio conversation between Halle and Cate. We use it to add colour, examples, and the messier real-talk that doesn’t fit in writing. Listen to it on walks, whilst commuting, or washing the dishes.

Do the exercises. This is where you really get into the thinking and trying out the techniques. Each module has a Google doc workbook. Make a copy, fill it in, share it back when you’re ready for feedback. We typically respond within 3 working days on on-time submissions.

How to get the most out of this

Give yourself time to think. The reading and the exercises work best when you have space - not squeezed between meetings. Block at least 60 minutes a week, although you might enjoy the project so much you spend more time on it!

Unpolished and honest beats polished and guarded. We’re not grading you. We’re reading to understand where you are and what would actually be useful. A rough, real answer is more valuable than a careful, safe one.

The project is central to the experience. Modules 2 and 3 build a small tool and use it in a safe, synthetic context. The instincts you’re developing about what an attacker can see, what a defender can do, where a vulnerability is found, come from doing, not reading. Don’t skip it.

Engineering skepticism is welcome. If a concept feels hand-wavy, or if a vendor or pundit claim doesn’t add up, write that down. Skepticism that surfaces real questions is more useful than passive agreement, and it’s a core practice of security work itself.

It’s a toolkit, not an exam. You can be wrong. You can change your mind. You can try something that doesn’t work and write about that. This is a place to try, fail, and try again.

Reach out if you’re stuck. If something doesn’t make sense or you’re struggling with an exercise, reply to any course email or ping us in Slack and we’ll come back to you. There’s no wrong question.

Slack community

We have a Slack community for course participants: introductions, questions, and connecting with each other if you want. Invites go out close to the start date.

Looking forward to working with you.

Halle and Cate