Learn how security teams use data and AI to catch attacks, without ever writing an attack. In eight hands-on Python labs, you defend Riverbend Community Credit Union, a made-up bank, by building rules, machine-learning detectors and an alert-triage pipeline on synthetic data.
Level: Intermediate
Ages: 15–18
Time: about 16 hours
Format: Self-paced labs with self-check questions
Before you start: know basic cybersecurity ideas (our Cybersecurity Foundations (9–12) course covers them). Python experience helps, but Lab 1 teaches what you need.
Accounts and safety: labs run in Google Colab in your browser, which needs a Google account (Google requires US account holders to be 13 or older), or in Python 3 on your own computer with pandas and scikit-learn. All data is synthetic and created inside the code. This course is defensive only: detection, triage and analysis.
Outcomes
- Explore security logs with Python and pandas
- Write and tune rule-based detections for brute-force and spraying attacks
- Train and test phishing, URL and anomaly detectors with scikit-learn
- Measure detectors with precision, recall and alert workload, not just accuracy
- Use AI assistants safely: spot prompt injection, redact secrets, verify outputs
- Build a ranked alert-triage queue and write a clear analyst report
Unit 1 — Data and Rules First
- Lab 1: Python and Colab for security data — 2 hours
- Lab 2: Rule-based detection — catch brute-force logins — 2 hours
Unit 2 — Machine Learning Detectors
- Lab 3: Build a phishing email classifier — 2 hours
- Lab 4: Measuring detectors — precision, recall and alert fatigue — 2 hours
- Lab 5: Anomaly detection on login behavior — 2 hours
- Lab 6: Suspicious URL scoring with a random forest — 2 hours
Unit 3 — AI in the SOC and Capstone
- Lab 7: LLMs in the SOC — using AI assistants safely — 2 hours
- Lab 8: Capstone — build an alert-triage pipeline — 2 hours
Start the first lesson: Lab 1: Python and Colab for security data
Questions? Email support