Professional Certificate in Cybersecurity

No. Every exercise works with the free tiers of Claude, ChatGPT, or Gemini, plus free, public security resources — the NVD vulnerability database, the CISA KEV list, MITRE ATT&CK and ATLAS, CIS Benchmarks, Sigma, and the OWASP LLM Top 10. The tool-landscape lesson covers the paid security-native AI (Microsoft Security Copilot, CrowdStrike Charlotte, SentinelOne Purple AI) and agentic SOC platforms so you can evaluate them at work, but none are required for the program.

No — they sit at different levels and cover different work. The AI-Powered Security Auditing course teaches AI-assisted source-code security review for people who read code: finding injection, overflow, and RCE vulnerabilities in a codebase. This certificate is the operational defensive practice — environments, not codebases: threat and risk, hardening, detection, response, compliance, and securing deployed AI. They touch at exactly one seam (Module 3 notes that code-level auditing exists), and it's a signpost, not a lesson. If you want the code-audit craft specifically, take that course; if you want to defend a real organization end to end, this is the path.

The line is simple: if the question is 'is this AI system fair, lawful, and accountable?' — that's the Ethics & Governance certificate (bias audits, fairness, the EU AI Act, governance charters). If the question is 'can an attacker abuse this AI system, and would we notice?' — that's this one. This certificate owns the security controls: prompt-injection defense, shadow-AI discovery, AI asset inventory, OWASP-LLM reviews, and monitoring AI systems for abuse. Governance program design and AI-specific regulation live in the Ethics & Governance certificate.

No — that's the other side of the desk. Employee-awareness content is what our Cybersecurity Basics course delivers to end users, and what team-training short courses deliver to a workforce: being trained not to click links. This certificate trains the professional who practices cybersecurity — the analyst, the security-hatted sysadmin, the IT pro who owns the defense. You'll even learn to write the awareness layer with AI (Module 9), because real mid-level jobs include it — but writing and running the defense is the certificate; being trained not to click is Stage 0.

No — this is a defensive-practice pathway: hardening, detection, response, compliance, and securing AI. You'll learn attacker behavior as a map — MITRE ATT&CK, the shape of real intrusions, 'think like the attacker' threat modeling — because you can't triage what you can't recognize. But no lesson walks through offensive tooling: conducting penetration tests, developing exploits, or red-team tradecraft is a separate craft with its own legal and ethical envelope, flagged for the Master tier and adjacent tracks. Here, verification means 'confirm the patch took,' not 'pop the box.'

The evidence points the other way. AI absorbs the mechanical work — enriching alerts, drafting detection rules, reconstructing timelines — but it's confidently, silently wrong in ways that matter in security: it invents CVE numbers, delivers wrong verdicts with full confidence, and can be steered by instructions hidden in the very logs it reads. On realistic full-investigation benchmarks, top AI models complete 61-67% of the tasks alone; top humans working with AI hit 73-85%. That gap is the job. This program trains exactly that human-plus-AI combination — and the verification habit that catches what AI can't see it's getting wrong — which is why it's more durable than tool skills alone.

Three short courses: Cybersecurity Basics (the end-user security layer), Don't Trust Your AI Agent (threat modeling for AI agents), and AI for Security & DevOps (hands-on AI for scanning, hardening, and monitoring). Together they give you the security hygiene, AI-risk intuition, and practical fluency this program builds on. The Module 0 self-assessment tells you honestly whether you can skip any of them.

You need security literacy and comfort using AI tools — not programming. In 2026 you describe what you need in plain English and AI drafts the detection rule, the triage analysis, or the incident timeline; your job is to direct it, read the output, and verify it against authoritative sources. You'll read a Sigma rule and a log, not hand-write code. The certificate is calibrated for a security-literate practitioner (a SOC analyst, a security-hatted sysadmin, an IT pro moving into defense), and Modules 0-1 build the AI operating model before any deep work.

Your primary tool is a general-LLM workbench — Claude, ChatGPT, or Gemini — used across every function: threat modeling, vulnerability triage, hardening audits, detection-rule drafting, incident investigation, and reporting. Alongside it you'll use the free authoritative sources you trace AI's claims against (NVD, CISA KEV, MITRE ATT&CK/ATLAS) and the open standards you work in (CIS Benchmarks, Sigma, OWASP LLM Top 10). The paid security-native tools are covered so you can evaluate them, not required to complete the program.

About 6 weeks at 4-5 hours per week — roughly 26 hours total, split between the lessons and the hands-on defensive practice. Fully self-paced, and the capstone rewards learners who don't rush it. Two cumulative reviews (at the one-third and two-thirds marks) consolidate the practice before the final stretch.

You defend one realistic organization — Coastal Supply, a ~150-person distributor — across Modules 2-9: mapping its threats and risks, running its vulnerability pipeline, hardening it, detecting and hunting in its logs, responding to an incident, securing its AI systems, and proving its compliance. You assemble a personal AI-defender playbook along the way. Then the capstone hands you a completely different organization — Verdant Grocers, a grocery chain with e-commerce and two unreviewed AI systems — to assess solo and self-score against a professional rubric. You finish with a full practice, a reusable playbook, and a capstone assessment.

The courses teach individual skills in a couple of hours each — security hygiene, AI-agent risk, hands-on scanning and hardening. This certificate integrates everything into a working defensive practice across 44 lessons: the complete lifecycle on a realistic organization, from threat and risk through detection, response, securing AI, and compliance, with the verification habit running through all of it and a capstone you run solo. It's the difference between knowing the pieces and being able to defend an environment end to end.

The certificate carries a verifiable credential ID. More practically, it's built to the shape of the mid-level defensive craft the industry already recognizes — its modules mirror the domain weights of CompTIA's CySA+ (Security Operations, Vulnerability Management, Incident Response, Reporting), the mid-level anchor. And it produces artifacts you can show: a risk register, a hardening plan, a tuned detection rule, an incident report, an AI-security review, and a capstone assessment scored against a professional rubric. In interviews, walking through how you caught an AI-hallucinated CVE before it drove a patch cycle lands harder than any certificate line.

This takes you to practitioner (mid) level — running the defensive practice for a real environment. To go deeper, the pathway continues to the Master Certification: designing the defense program, detection strategy, SOC architecture, and incident command at org scale. To go wider, adjacent tracks cover the code-level craft (the AI-Powered Security Auditing course) and AI governance (the Ethics & Governance certificate). Module 0 shows the full map, and the capstone's final lesson marks exactly where you stand and every next climb.