Learn cybersecurity.

1.1 The chain, not the “hack”

Pop culture shows intrusions as a single dramatic “hack.” Reality is a checklist of small wins: reconnaissance (what can I learn publicly?), initial access (a password, a flaw, a person), execution (run my code), persistence (survive reboots and password resets), then lateral movement and the objective — money, data, or disruption. Defenders win by making any one link expensive enough that the attacker quits and picks an easier target.

In September 2026, Palo Alto Networks’ Unit 42 published an incident report that should reset your mental clock: an adversary used autonomous AI agents to compromise an enterprise network in under ten hours, chaining more than fifty MITRE ATT&CK techniques in automated loops — without a single zero-day. Internal reconnaissance, secret-hunting in code repositories, master-credential harvesting from a secrets manager: all known techniques, executed at machine speed. The lesson is not “AI is scary.” The lesson is: your detection and response timeline is now the product.

1.2 Why the edge gets hit first

Ask an attacker to rank targets and they will rank them by reachability × privilege × how nobody watches it. That is why September 2026 filled with VPN and management-platform incidents: SonicWall’s SMA1000 appliances were hit by two chained zero-days — a CVSS 10.0 pre-authentication flaw plus a command-injection flaw — handing attackers control of the box that controls an organisation’s entire remote workforce. N-able’s N-central, the console MSPs use to manage hundreds of client networks, needed its fourth emergency hotfix in five weeks, one of them a 10.0 pre-auth RCE.

Notice what these targets have in common: they sit at the perimeter, they hold privileged keys by design, and they get a fraction of the monitoring that laptops and identities get. An employee laptop has EDR, MFA and a nervous user. A VPN appliance has a firmware version and an open port. In 2026, the perimeter did not disappear — it concentrated, into a few dozen always-on boxes that attackers notice before you do.

1.3 The economics of “you”

Most attacks on ordinary people are commodity: automated, mass-distributed, and cheap. Breached password corpora feed credential-stuffing bots; phishing kits are rented; residential proxy pools make password spraying look like normal traffic — Datadog researchers tracked low-and-low-slow spraying against AWS root accounts across 150+ organisations, deliberately paced to slip under lockout thresholds. Nobody hand-picked you; a list did.

That is oddly good news. Commodity attacks quit when cost rises: a unique password kills stuffing, phishing-resistant MFA kills most proxy kits, and a two-minute report to your bank or IT team kills the follow-on fraud. Your job in this course is not to become unbeatable — it is to become the expensive target, and to be fast and loud when something slips through.

1.4 Motive: who attacks, and what they want

Defence gets sharper when you name the attacker’s appetite. Financial criminals want speed and volume: mobile-money fraud rings, SIM-swap syndicates, ransomware operators who treat your outage as their invoice. Spies want patience and position: the Fire Ant router tunnels were quiet by design because stolen tomorrow beats noise today. Hacktivists and insiders want messages or revenge, and accept clumsier methods. Most individuals and small businesses face the first group almost exclusively — commodity crime, automated and indifferent.

That indifference is your leverage. A financial attacker optimises for the cheapest viable victim; every control in this course raises your price tag. Motive also tells you what to protect first: if the appetite is money, guard the payment paths and recovery channels; if it is position, guard the edge devices and admin paths. When you know what they want, you finally know what you should defend — and what you can stop losing sleep over.

2.1 CIA, with receipts

Confidentiality is about secrets staying secret: when Dropbox disclosed that ~5,000 accounts were accessed through a Lenovo ID single-sign-on verification weakness, attackers read and downloaded users’ files — a confidentiality failure. Integrity is about things being what they claim to be: the JFrog Artifactory auth-bypass (CVE-2026-82329) mattered because an attacker with admin tokens could replace trusted packages with backdoored ones — poisoning what every downstream build trusts. Vercel’s CEO called it an “RCE bomb” for exactly this reason.

Availability is about things working when needed: the Cisco Nexus 9000 flaw (CVE-2026-20212) could crash the switch’s S1HAL process and reload the device — a data-centre outage from a single crafted packet — and ransomware’s whole business model is availability held hostage. Most real incidents hit two or three pillars at once; your job is to name the primary loss, because that tells you which control would have mattered most.

2.2 Asset → threat → vulnerability → risk

Security speaks one grammar: an asset (something you value), a threat (something that can harm it), a vulnerability (a weakness the threat can use), and risk (how likely × how bad). A control reduces likelihood, impact, or both. Make it local: your asset is your mobile-money line; the threat is SIM-swap fraud; the vulnerability is weak identity proofing at the telco plus SMS-based codes; the risk is drained savings in an hour; controls are a porting PIN/line lock, moving MFA off SMS, and balance alerts.

This grammar also exposes lazy thinking. “We need AI security” is not a risk statement. “Our finance team’s approval workflow (asset) can be spoofed by WhatsApp impersonation (threat) because vendor bank-detail changes are never verified out-of-band (vulnerability), risking six-figure misdirected payments (impact)” — that is a risk statement, and it already contains its own control.

2.3 Defence in depth, and assuming the breach

Layers fail individually; that is why there are several. The StyleSmuggler Magento zero-day is a perfect autopsy: the patching layer could not work (no patch existed; the first victim was fully patched), yet on one compromised store the implant was found within an hour — because a merchant forwarded a weird “payment transaction failed” email to their host. A human reporting layer caught what no dashboard could.

“Assume breach” is the attitude that makes layers honest: you design as if compromise will happen, so you pre-agree what detection, containment and reporting look like. It is not pessimism; it is the difference between a fire drill and a fire panic.

2.4 Risk treatment: the four honest choices

Once risk is named, you have exactly four moves: mitigate (add controls — MFA, backups, patching), transfer (insurance, or contractually shifting liability to a vendor), avoid (stop holding the data or running the service at all), and accept (decide, consciously and in writing, that the risk is cheaper than the fix). Every organisation does all four; mature ones know which is which. Immature ones believe a fifth option exists: “ignore, and hope nobody notices.”

What remains after treatment is residual risk — the honest baseline you live with. Vendors who promise to “eliminate risk” are selling the fifth option in a nicer font. Personal translation: you mitigate your email (manager + MFA), transfer your laptop’s loss (insurance or accepting replacement cost), avoid storing client IDs in WhatsApp chats, and accept that your public posts can be screenshotted. Naming the choice is what makes it a decision instead of an accident.

3.1 Credentials are the new perimeter

Every breach corpus ever leaked is still for sale, and bots never sleep: credential stuffing fires your old email+password pairs at hundreds of services until something opens. Strength is irrelevant here — uniqueness is the defence. One password reused across five services means one breached forum from 2019 owns your 2026.

The practical floor in 2026: a password manager, and inside it a unique passphrase per service (four or more random words beat eight clever characters, and they’re typeable). The manager also kills the visual tell of phishing: it simply will not autofill on paypa1.com.

3.2 MFA that can be phished — and MFA that can’t

SMS codes die to SIM swaps and to real-time phishing relays that proxy your login while you type. TOTP apps beat SMS but still type into a fake site happily. Passkeys (FIDO2) are cryptographic and origin-bound: the key refuses to sign for a lookalike domain, which is why they are called phishing-resistant. Choose downward only when you must: passkey → TOTP → SMS → nothing is the wrong order.

And know MFA’s two bypasses so you respect its limits. First, session theft: after a successful login, your browser holds a session cookie — steal that (infostealer malware, or a compromised machine) and the attacker is logged in; no password, no MFA prompt. In 2026 researchers tracked info-stealers specifically harvesting authenticated AI-assistant session cookies to read corporate chat histories. Second, MFA itself can be backdoored: CISA’s Gunra ransomware advisory describes attackers editing a victim’s VDI portal so one attacker-chosen OTP always succeeded.

3.3 Your credential stack, in order

Build it like a building: manager (the floor), unique passphrases everywhere (the walls), passkeys where offered (the doors), TOTP as fallback (the spare keys), and session hygiene (the locks): sign out of shared devices, treat “stay logged in” on public machines as a donation, and when an account behaves strangely, rotate the password and revoke active sessions — rotating without revoking leaves the stolen session alive.

3.4 When the account is already gone: the recovery play

Sometimes you are not preventing takeover, you are evicting someone. Act in this order: recover access through the provider’s official flow from a clean device; then immediately inspect what attackers change first — recovery email, recovery phone, added MFA devices, active sessions, forwarding rules, connected apps. Remove their footholds before celebrating; a password reset with an attacker-owned recovery address is a revolving door.

Then contain the blast: warn contacts (hijacked accounts scam your friends next), check payment methods and addresses for additions, and where money or identity is involved, file the report while timestamps are fresh. Finally, learn the structural lesson: your recovery path is part of your credential stack. An outdated backup email is a back door with your name on it — audit recovery settings with the same seriousness as passwords.

4.1 Anatomy of a lure

Every social-engineering message, in any channel, pulls some combination of four levers: urgency (“within 24 hours”), authority (“CEO”, “bank fraud desk”, “Geek Squad refunds”), fear or greed (“failed transfer”, “you won”), and effort-minimisation (“just click to confirm”, “just run Quick Assist so I can fix it”). The 2026 twist is channel diversity: email for the office, SMS and WhatsApp for the wallet, voice calls for the anxious — and remote-support tools as the payload, as Huntress documented with rogue ScreenConnect installs seeded by Quick Assist tech-support scams and fake refund lures.

Notice what the levers attack: not your intelligence, your context. You are tired, mid-task, polite, or scared of looking silly. That is why the defence is procedural, not personal: a habit that runs even when you are tired.

4.2 The verification habit that ends most fraud

One habit beats a thousand warnings: verify out-of-band. Any request to change payment details, reset credentials, or grant remote access gets confirmed through a channel the message did not provide — the number on your card, the contact in your contract, walking over to the desk. Business-email-compensation fraud collapses against it; so does the “new WhatsApp number” CEO scam. Second habit: channel-hopping is a red flag. “Email me on WhatsApp” / “call this number” exists to escape the channel your organisation monitors.

Third: treat unexpected remote-access requests as hostile by default. Nobody legitimate needs you to run Quick Assist or install a remote client to “fix” a refund. In the ScreenConnect worm incidents, the initial accesses were exactly this: a support scam, a phishing MSI, a fake Geek Squad refund form.

4.3 The first five minutes after a click

Order matters more than speed: stop (do not type anything more), disconnect the trust, not the evidence — on a credential phish, change the password from a different device and revoke active sessions; on a file/executable, isolate the machine from the network but keep it powered on for forensics; report to bank/IT/telecom with screenshots; warn your contacts if identity or email is involved so the follow-on scam fails. Then breathe: reporting fast is a win, and organisations that punish reporters train their staff to hide breaches instead.

Remember the StyleSmuggler merchant: the fastest detection in that incident was a forwarded “weird email.” Your report is not an admission — it is a sensor.

4.4 The AI era of lures: when your eyes can’t verify

2026 social engineering stopped asking you to spot bad grammar. Voice-cloned “family emergency” calls, deepfake video of executives approving payments, and phishing emails written fluently by language models have moved verification out of the realm of perception: you cannot out-see or out-hear these lures, and trying to is a trap. Police agencies across several continents have warned about clone-voice calls pressing for instant money — the constant tells are urgency, secrecy (“don’t tell anyone”), and resistance to a call-back.

So the defence becomes purely procedural, which is good news: procedures don’t care how realistic the lie is. Pre-agreed code words for family and finance; mandatory out-of-band call-backs for any payment or credential change; a standing rule that urgency plus secrecy equals verification, every time, no exceptions for rank or emotion. The lie gets better; the procedure doesn’t need to.

5.1 Updates are a security feature, not a nuisance

Every patch is a public confession of a flaw — and attackers read confessions faster than defenders deploy them. The September 2026 Exchange story is the archetype: fix shipped 11 August, working exploit code public by 27 August, and Shadowserver still counted 21,899 exposed unpatched servers on 1 September. Patch latency is the exploit window.

Your personal rule should be boring and absolute: OS and browser updates within 72 hours when rated critical (Chrome’s actively-exploited V8 zero-day, CVE-2026-85046, was fixed by an emergency update — the sixth Chrome zero-day of 2026), everything else within two weeks, auto-update on for apps wherever offered. And remember the uncomfortable footnote: sometimes the security product itself is the surface — Microsoft spent September racing to patch “ShieldBreak”, a privilege-escalation flaw in Defender’s own malware engine with a public PoC since August.

5.2 AV, EDR, MDM — the alphabet, decoded

Antivirus matches known bad files. EDR (endpoint detection & response) watches behaviour — process trees, odd PowerShell, credential access — and lets a SOC respond. MDM (mobile device management) is the enrolment layer: enforced encryption, patch policy, remote wipe for company data. When an employer asks to enrol your personal phone, the honest question is what can they see and what can they wipe — usually work-profile data, not your photos, but ask in writing.

And know how endpoints actually fall in 2026: not by exotic malware, but by trust misplacement. Kaspersky tracked “Silver Fox” distributing the ValleyRAT backdoor inside a genuinely signed Chinese wallpaper app — signed, because signatures prove provenance, not intent — and running it under trusted processes while victims were socially engineered into adding it to their antivirus exclusions. An exclusion is a hole you dug yourself.

5.3 The ten-minute phone hardening pass

In order of payoff: lock + encryption (biometric + strong PIN; modern phones encrypt by default — verify); SIM PIN plus a telco porting/line lock (Module 3’s SIM-swap control); app sources — store-only installs, no sideloaded APKs chasing “premium free”; messaging 2FA (WhatsApp/Telegram two-step PIN); auto-update on for OS, browser, banking apps; Find My Device on; and a permissions sweep — does the torch app really need contacts? Charge-only on strange USB ports is paranoia-lite: the realistic risk is low, the habit is free.

5.5 Loss, theft and the second-hand market

Devices also die socially: they get lost on matatus, stolen off tables, or sold onward. Pre-commit the sequence so panic doesn’t choose for you: remote lock first (Find My Device / Find My), then change the crown-jewel passwords from another device and revoke sessions, then telco SIM lock, then bank-app logout where offered, then remote wipe only after you’ve preserved what investigations or insurance need. Wiping is irreversible; sequence matters.

The market runs both ways. Buying used: insist on a clean factory reset in front of you, no activation locks (FRP/iCloud), and update immediately — second-hand phones often ship with ancient, exploitable builds. Selling or disposing: sign out of everything, remove SIM and SD, encrypt-then-factory-reset, and keep the receipt trail. A wiped phone with your account still signed in is not wiped; it is a donation.

6.1 Your router is an edge device (act like it)

Everything in Module 1 about “the edge” applies to the box under your TV: always on, privileged, unwatched. September 2026 reporting on MikroTik RouterOS flaws described exactly the downstream abuse: unpatched perimeter appliances used for unauthorised config changes, packet interception, command proxies and DDoS botnets. Separately, the “Fire Ant” espionage campaign planted covert GRE tunnels inside Cisco IOS XR routers to siphon live traffic — routers as spy hardware.

The home checklist is short and unglamorous: change the factory admin password (still the #1 router failure); update firmware and enable auto-update if present; WPA2-AES or WPA3, never WEP/open; disable WPS; put IoT gadgets and guests on a guest network so a compromised bulb can’t reach your laptop; and disable remote admin from the internet unless you can explain why you need it.

6.2 Public Wi-Fi: the real risk model

HTTPS encrypts your traffic’s contents end-to-end, so the old “everyone reads your passwords at the café” story is mostly dead. The living risks are: rogue/evil-twin access points with convincing names; attacks on the unencrypted leftovers (captive portals, legacy protocols, local file sharing, printer discovery); and simple local proximity — same network means your device can be scanned and probed directly. Rules: forget networks after use, disable auto-join, keep the device firewall on, and for anything sensitive on untrusted Wi-Fi use your phone’s hotspot or a VPN.

6.3 What a VPN does — and the marketing lie

A VPN encrypts the hop between you and the VPN server and masks your traffic from the local network — genuinely valuable on hotel and café Wi-Fi, and for routing around censorship or hostile networks. It does not make you anonymous to the sites you log into (they still see your account), it does not block malware or phishing, and it does not replace device security — you are simply extending trust to the VPN provider. Choose providers like you choose banks; free VPNs are usually the product.

6.5 Segmenting a home network without enterprise gear

You don’t need VLANs to get most of the benefit: your router’s guest network is a segmentation tool wearing a hospitality costume. Put every IoT device — bulbs, cameras, smart plugs, the TV that argues with updates — on guest Wi-Fi with client isolation on, and keep phones and laptops on the main network. A compromised camera now sees nothing but other compromised cameras.

Three more cheap wins: turn UPnP off (it lets devices punch holes in your firewall autonomously, and malware loves it); replace remote-access port forwarding with a VPN or vendor cloud relay; and consider a filtering resolver such as Quad9 (9.9.9.9) at router level, which blocks known-malicious domains for every device at once — including the ones too old to protect themselves. Fifteen minutes of router configuration, years of quiet.

7.1 The map that already exists

Assume four copies of “you” are circulating: breach corpora (old leaks, forever for sale — check your email on a breach-lookup service today), data brokers and ad ecosystems (inferred profiles, location histories), app telemetry (contacts, photos metadata, usage), and you (posts, tags, check-ins, the school name in your bio). Scammers compose these copies: your pet’s name in a 2019 post is a password-reset answer in 2026.

Metadata deserves special suspicion: a “harmless” photo can carry GPS coordinates, device model and timestamp. Strip or disable location tagging for public posts, and remember that the audience of a “friends-only” post includes every friend’s compromised account.

7.2 Kenya’s DPA 2019, in human sentences

The Act says, in effect: your personal data may only be collected with a lawful basis (usually your informed consent), only for a stated purpose, only as much as is necessary; you may ask what is held about you, correct it, and in many cases demand deletion; and when it is breached, the holder must notify the regulator — and where the harm is real, you — without undue delay. The Office of the Data Protection Commissioner (ODPC) is your escalation route when a company stonewalls you.

Use it practically: when an app demands contacts “or you can’t continue,” that is a purpose-limitation conversation; when a company you left still emails you, that is an erasure request; when your bank breaches, notification is not a favour — it is the law.

7.3 The afternoon cleanup

Four passes, in order: breach pass (lookup your email; rotate everything listed); permissions pass (revoke contacts/location/mic from apps that don’t earn them); backup pass (enable end-to-end-encrypted cloud backups for WhatsApp and device, or accept that your “private” chats sit in someone’s cloud in plaintext); visibility pass (social: hide birthday year, old posts audit, stranger-followers prune). None of this makes you invisible; all of it makes you expensive.

7.4 Asking for your data: subject-access requests that work

Kenya’s Data Protection Act gives you leverage most people never use: the right to ask any organisation holding your personal data what they hold, why, and where it came from — and to request correction or erasure. A subject-access request needs no lawyer: a short email naming yourself, your identifiers (account number, phone), the request (“a copy of my personal data processed, its purposes and recipients”), and a deadline reference (“within the period prescribed by the Data Protection Act, 2019”) is legally sufficient.

Keep expectations adult: some replies are slow or evasive; that is when you escalate to the ODPC with your paper trail attached. Even never sending a request, knowing the mechanism changes how you read every “we value your privacy” banner — you now know it is a legal duty with a regulator behind it, not a favour. Privacy stops being vibes the day you write your first request.

8.1 Shared responsibility, without the slide deck

The provider secures the cloud: physical datacentres, hypervisors, the fabric. You secure in the cloud: your accounts, your configurations, your data, your sharing links. Nearly every “cloud breach” headline is a your-side failure: an over-broad sharing link, a storage bucket left public, an unrevoked ex-employee grant. Default-deny is the posture: private by default, shared deliberately, reviewed quarterly.

8.2 Grants, integrations and the shadow perimeter

Every “Sign in with X” and every connected app is a standing permission: read my mail, post as me, see my files. Attackers love OAuth abuse because it needs no password — the token is the key. Twice a year, open your Google/Microsoft/account “third-party access” page and revoke ruthlessly; anything you don’t recognise gets evicted, not investigated. The Dropbox incident adds the federation clause: integrations can also inherit a partner’s verification weaknesses, so the inventory includes SSO links, not just apps.

8.3 Backups that survive ransomware, and exits that survive vendors

3-2-1: three copies, two media, one offsite — and in 2026, one immutable or offline, because ransomware now deletes reachable backups first. Test a restore quarterly; an untested backup is a rumour. Then the vendor exit question: if this SaaS vanished tonight, what would you get back, in what format, how fast? “Your data is yours” should be a download button, not a slogan.

And when a vendor is breached, respond like JetBrains’ customers were told to: rotate what you entrusted. JetBrains disclosed that attackers entered through its own unpatched TeamCity server (CVE-2026-63077), took a 2024 backup of its Cadence service and touched AWS credentials — users were told to revoke/rotate everything used in Cadence executions and treat those outputs as untrusted. Your vendor’s patch hygiene is your risk; the four questions: how do you patch, how fast? what do you hold about us? how would you notify us, and within how long? can we export and leave?

8.4 SaaS sprawl: the accounts you forgot are still holding you

Every trial signup, quiz site and dead startup that ever took your email is a standing copy of some version of you — password hashes from 2014, phone numbers from 2018, ID scans from that one KYC form. Breach after breach is simply these forgotten warehouses leaking on schedule. Your password manager’s full account list is therefore not a convenience feature; it is your personal asset register, and the dormant entries are your unmapped attack surface.

Run the sprawl purge twice a year: for each dormant account, decide delete or defend — delete with the provider’s closure flow (or erasure request when they stall), or defend with a unique password and MFA if it still earns its place. For new signups, consider purpose aliases: a dedicated email for financial life, one for shopping, one for experiments. Sprawl is how one 2019 forum breach becomes a 2026 takeover; registries are how it doesn’t.

9.1 Reading an advisory like an analyst

Every advisory answers five questions: what (CVE id + weakness class), how bad (CVSS — note the vector: network? complexity? privileges? user interaction?), who is affected (exact versions/PIDs), is it exploited (KEV listing, vendor PSIRT language), and what now (fixed release vs workaround). Cisco’s September advisory is a clean specimen: CVE-2026-20212, CVSS 9.8, vector AV:N/AC:L/PR:N/UI:N — reachable over the network, easy, no credentials, no click — because TCP ports 43210/43211 sat open in the default VRF; fix = upgraded NX-OS; workaround = iACLs blocking those ports.

Two reading habits separate pros from panic: CVSS is severity, not risk — a 9.8 buried in a sealed management VLAN loses to a 7.5 facing the internet with no auth; and “workaround” is not “fix” — it is a bridge you pay tolls on until the real release lands.

9.2 The exposure economy

Disclosure starts a race both sides can see. Shadowserver’s internet-wide scans flagged 21,899 Exchange servers still unpatched against CVE-2026-62911 three weeks after the fix — the same count attackers use as a shopping list. End-of-support makes it structural: Exchange 2016/2019 fixes ride on paid Extended Security Updates that end 31 October 2026, after which “unpatched” becomes permanent. And “it’s internal only” is a topology hope, not a control: Cisco’s own advisory notes a switch needn’t face the internet if a compromised segment can reach it.

Prioritisation, then, is exposure math: KEV-listed or actively exploited → now; internet-reachable unauthenticated RCE → this week; everything else on SLA. KEV (CISA’s Known Exploited Vulnerabilities catalogue) is the profession’s agreement to stop debating scores once real exploitation exists — SonicWall’s chained SMA1000 flaws landed there within days of disclosure.

9.3 Chains, and the patched-but-compromised paradox

Attackers compose flaws the way chefs compose flavours: SonicWall’s 10.0 pre-auth SSRF bought privileged reach; the 7.8 command injection cashed it in — individually “just” two CVEs, together an unauthenticated takeover. Which brings us to the paradox every practitioner must internalise: patch status does not equal safety. StyleSmuggler’s first victim ran the highest patch level available with a clean patch report — and was compromised by a flaw no vendor had described yet. Vulnerability management is therefore three jobs, not one: inventory (you cannot patch what you forgot), exposure reduction (disable GraphQL, block ports, segment), and detection (for the flaw with no CVE yet).

9.4 A personal vulnerability-management loop

Organisations run vulnerability management as a discipline; you can run a credible solo version in twenty monthly minutes. Keep a tiny register — a notes-app table: asset / version / update channel / last checked — covering phone, laptop, router, TV/IoT oddities, and your five crown-jewel services. Each month walk it: OS and browser updates applied? router firmware current? any service shouting about a breach? Any “critical” headline touching your assets gets the 72-hour rule from Module 9’s SLAs.

The register’s real power is memory: “last checked” columns turn guilt into schedule, and the asset list kills the classic personal-security failure — forgetting the device in the drawer that still receives your OTPs. Pair the loop with the quarterly rituals from Module 12 and you have, in miniature, exactly what auditors look for in organisations: inventory, cadence, evidence.

10.1 Detect without destroying

Detection signals are usually mundane: a bank SMS you didn’t trigger, a “password changed” mail you didn’t request, a device that’s hot and slow at 3am, colleagues receiving strange messages “from you,” a supplier invoice with new bank details. The first discipline: stop feeding the incident — no more typing, no more clicking — and the second: don’t destroy evidence. Reformatting the laptop feels like cleanup and is, forensically, arson. Screenshots, timestamps, message headers and the powered-on machine are your case file.

10.2 Containment orders, by scenario

Credential phish: change the password from a different, clean device, then revoke active sessions and tokens — rotating without revoking leaves the attacker’s session sipping coffee in your account. Device malware/ransomware: disconnect network (Wi-Fi off, cable out) but keep power on; do not wipe; hand to IT/forensics. Bank or mobile-money fraud: call the fraud line from a known number, request hold/reversal windows, change credentials from clean device, then written report. SIM-swap signs (signal dead + reset SMS elsewhere): telco line lock immediately, then every SMS-dependent MFA moves to app/passkey.

At work, the same shapes scale: isolate, preserve, escalate with a timeline attached. Speed beats completeness in the first report; completeness beats poetry in the second.

10.3 Report routes, and the resets people forget

Personal incidents in Kenya have real doors: your bank’s fraud desk and the payments-reversal process, telco fraud lines, the DCI Cybercrime Unit for criminal matters, the ODPC when your personal data is breached by an organisation, and CERT.ke / CAK context for service-level incidents. Organisational incidents follow your IR procedure (Module 11) and statutory clocks — GDPR’s 72 hours, Kenya DPA’s notification duty.

Post-incident, reset what the attacker touched, not just what they typed: passwords, active sessions, OAuth grants, API keys — and MFA enrolments. CISA’s Gunra ransomware advisory describes attackers editing a victim’s VDI portal so an attacker-chosen OTP always succeeded: if MFA itself was tampered with, “we changed the password” is a lullaby. Re-enrol MFA from scratch, and review MFA method downgrade history where logs allow.

10.4 Helping someone else through their incident

Sooner or later the phone rings: a parent scammed, a colleague phished, a friend locked out of mobile money. Your job is co-regulation before containment — panic contagion causes the worst decisions (paying immediately, wiping evidence, shouting at the victim). Script your first minute: “You did the right thing telling me. We’ll handle it step by step. Don’t touch anything yet.” Then run their containment with them, out loud: clean device for rotations, session revocation, bank and telco calls, screenshots before anything is deleted.

Guard the language: “how did you fall for that?” is not analysis, it is training them to hide the next incident — the exact culture failure organisations pay millions to undo. Debrief later, kindly, as a procedure gap (“we need a code word”) rather than a character flaw (“you’re careless”). Communities that respond well to the first victim create the reporting culture that saves the second.

11.1 The governance pyramid, decoded

Policies are the broad statements of intent — “client data is handled as if it were our own crown jewels.” Standards are specific mandatory requirements for an area or technology — “MFA must be enforced on all administrative access”; guidelines are the recommended cousins (“you should prefer phishing-resistant methods”). Procedures are the step-by-step executions — the eight-move vulnerability remediation workflow, the joiners-movers-leavers checklist with its 24-hour revocation clock. Policies say why; standards say what, exactly; procedures say how, in order, by whom.

Why care if you’re not “management”? Because every audit, client questionnaire and incident post-mortem runs on this pyramid — and because the fastest way to look senior in a security conversation is to ask which layer a decision belongs to. “That’s a policy question” and “that needs a procedure” are complete, professional sentences.

11.2 Where you live in the pyramid

Your daily obligations are procedures wearing casual clothes: lock screens and clean desks (confidentiality), no shared accounts (accountability — a shared login is a shared identity, and “who did it?” becomes unanswerable), asset returns on exit, visitor escorting, and acceptable-use boundaries (company systems for company work, personal data off company devices and vice versa). Remote work extends the corporate edge into Module 6 territory: your home router is now infrastructure your employer’s data transits — which is why sane remote-work standards mandate updates, disk encryption and private networks for sensitive calls.

And the cultural clause, which no tool can replace: reporting speed is a control. The StyleSmuggler implant found within an hour was found because a merchant forwarded a weird email without feeling silly. Organisations that punish reporters train staff to hide breaches; organisations that thank them install a human sensor network for free.

11.3 When procedures meet worms

The ScreenConnect worm is a procedures autopsy: initial accesses were social (Quick Assist scam, phishing MSI, fake refund lure), but the propagation exploited a missing verification step — technicians connecting to infected hosts with no “confirm origin” gate, and file transfer left enabled. ConnectWise’s interim advice (disable file transfer until patched) is exactly what a procedure is: a written brake applied at organisational speed. Your takeaway: any tool that can move files or control screens needs a written “verify before you connect” rule — and the discipline to follow it at 4:55pm on a Friday.

11.4 Reading a policy like an auditor (a 15-minute career skill)

Open any security policy and ask five questions: who owns it (a role, not a department mascot)? when was it reviewed (a date older than two years is decoration)? what’s in scope (people, systems, third parties — or vague “all staff” hand-waving)? how are exceptions handled (written, time-bound, approved — or silent)? and does every “must” point at a procedure that explains how? Policies failing these tests are wallpaper; policies passing them are operating systems.

This skill compounds: it is exactly what client questionnaires, ISO-style audits and interview panels probe, and it flips your relationship with rules from obedience to judgement. Practise cheaply on public documents — banks’ privacy notices, SaaS security pages — noting what’s missing. Within a month you’ll spot an unowned, unreviewed, exception-free policy in ninety seconds, and say the sentence that gets attention in any room: “which layer of the pyramid does this decision belong to?”

12.1 The twelve-point audit

Score each item Yes/No; every No is a scheduled task, not a shame: 1 Unique passphrases via manager on email, money, work, cloud. 2 Phishing-resistant or app MFA on those four (no SMS on money). 3 SIM PIN + telco line lock. 4 Devices encrypted, locked <2 min, Find-My on. 5 OS/browser auto-update on; critical patches <72h habit. 6 Router: admin password changed, firmware current, WPA2/3, guest net for IoT. 7 Backups 3-2-1 with one immutable/offline copy, restore tested this quarter. 8 Cloud grants purged in last 6 months; sharing links default-private. 9 Breach-lookup run; exposed passwords rotated. 10 App permissions swept; encrypted chat backups on. 11 IR card written; family code-word agreed. 12 Verification rule (Module 11) practised with at least one other human.

12.2 Rituals that keep it true

Security decays silently: grants accumulate, firmware ages, backups rot. Four quarterly rituals arrest the decay — grant purge (third-party access pages), restore test (one real file, end to end), patch & firmware day (router, IoT, neglected laptops), and access & session review (active sessions, old devices, ex-accounts). Diarise them like tax dates. Re-run the twelve-point audit twice a year; track your score as a number, because numbers move behaviour that intentions cannot.

12.3 Where you go from here

If this course landed, the profession has doors at every level: Cisco Networking Academy / Skills for All for structured, lab-heavy fundamentals and the CCST track; IBM’s Cybersecurity Analyst certificate path for a broad analyst stack with a breach-case capstone; CompTIA Security+ as the classic first credential; and when you’re ready for practitioner depth, SANS courses with GIAC certifications (SEC275/GFACT is the friendly on-ramp). Pair any of them with hands-on repetition — labs, CTFs, home-lab builds — because every one of these bodies certifies skill, and skill is a contact sport. VunVault’s own labs and this Academy’s future modules sit in the same tradition: learn by doing, then prove it under exam conditions.

Whatever you choose, keep the two sentences this course was built on: make yourself the expensive target, and be fast and loud when something slips through. Everything else is syllabus.

12.4 Staying sharp: labs, communities and the weekly hour

Knowledge decays; skill persists — but only if rehearsed. Build the cheapest lab that works: one old laptop or a free VM slot, a deliberately vulnerable practice image, and a sandboxed browser for opening suspicious things on purpose. Add one CTF or lab platform account and commit to a weekly hour: sixty minutes of hands-on repetition beats a yearly binge, because security is pattern memory and pattern memory needs spacing.

Then add people: a local community (Nairobi’s security meetups and BSides-style conferences are real and welcoming), one online forum or Discord where practitioners post write-ups, and a habit of reading one incident report a week — like the case files in this course — and summarising it in three lines of your own. Certificates open doors; the weekly hour and the write-up habit are what make you worth hiring behind the door. VunVault’s labs and future Academy modules are built to slot into exactly this rhythm.