Ryan G. Cox

The reason people spend thousands of hours playing video games isn't because they love playing the tutorial over and over - it's because the gameplay loop and progression system makes playing feel rewarding. I think learning cybersecurity should be no different. But most education platforms focus on mindless content, videos, courses, and certifications. That's exactly what I'm trying to change with DefendTheOrg. XP. Levels. Badges. Leaderboards. And soon, story-driven campaigns that combine multiple skills into realistic scenarios. But not at the cost of quality cybersecurity labs, educational content, and structure to learning hands-on skills. Because if you're going to spend hundreds of hours developing cybersecurity skills, it might as well be fun.

If you could redo the start of your cybersecurity career, what advice would you give others starting out? Here are the four things I'd do differently. 1. Talk to more people. Early on I barely networked, and that was the biggest mistake. It's a dense field, and it can be difficult to know your path. Meet people that can help you figure out where to go next. 2. Spend less time collecting certs and more time on focused learning. Certs help when you have absolutely zero experience and need something on your resume. But even then, they aren't the whole game. Learn through hands-on methods instead of just checking a box. 3. Build things. Building teaches you fastest because you break stuff along the way. And those projects carry over to the job more than any certification ever could. 4. Be patient for more than a year. Give it two to three. Cybersecurity is dense. It takes time to learn, time to feel comfortable, and time to see the full scope, because you're touching nearly the whole stack. If you're early in this, save this for the week where things might not be going your way.

This man is still insane

Cybersecurity hiring is going to go bonkers in 2027

I'm building new labs on @defendtheorg and getting blocked by Cybersecurity checks on Opus 😢

Calm before the storm that is Incident Response on-call...

You say you want to be a SOC Analyst. But how bad do you want it? Go give Sidecar a go now!

Cybersecurity can't buy everything, but it sure can buy a LOT of things...

IAM is HUGE right now. Here’s an easy way to learn the basics in under 2 hours.

One of the biggest challenges when breaking into cybersecurity is knowing what to learn, in what order, and why. There's no shortage of courses, certifications, and tools. But without a clear direction, it's easy to spend months learning things without knowing whether they're moving you closer to your goal. That's why I built Paths on DefendTheOrg - to turn a massive library of cybersecurity content into a structured roadmap toward a specific career. You shouldn't have to rely on luck to figure out your career. You should have a path to follow.

Should we do a giveaway?

Code review used to be one of the biggest jobs in engineering - but it looks different now. AI writes and reviews most code. But manual review still has a place in the process. Here are 5 things you need to know about Code Review ⬇️ - 1️⃣ Review is about what gets missed At its core, it's edge-case hunting. You check for what the author didn't think about: - Inputs that break assumptions - Formats that don't match - States never handled - Permissions touched by accident 2️⃣ Know where manual review fits You can't hand-review every line anymore. You shouldn't. Manual review earns its cost on critical changes: - Production databases - Access to sensitive data - Permissions opening up When a change widens who can reach what, a human confirms it's intended. 3️⃣ AI now does the first pass It's good at the tireless work: - Scanning every diff - Flagging patterns across the change - Catching obvious stuff fast - Never bored on line 400 It clears noise so humans focus on judgment. 4️⃣ But AI will always find something Run it again, it finds another. A lot is noise: - Edge cases that can't be hit - Paths that don't exist - Bugs behind impossible conditions The skill is triage. Is this reachable? What's the real impact? 5️⃣ Separate valid from valuable Ask: - What could this break that the author missed? - Does it change who can access what? - Is the finding reachable in our system? - What's the blast radius? Good review isn't finding the most issues. It's finding the ones that matter.

Your career is not going to progress just because you're good at your job. I wish someone told me this earlier. Being technically competent is one piece of the puzzle. It's the price of admission, not the thing that gets you promoted. The people who move up aren't always the best engineers in the room. They're the ones who can communicate their work. Who make their impact visible. Who take ownership when something breaks and build real relationships across the team. And they advocate for themselves. That last one is the one most of us get wrong. We assume good work speaks for itself and that someone is keeping score. Nobody is keeping score for you. Promotions are intentional. You have to understand the business, know what the organization actually values, and then show how your work ties back to it. So if you've been heads down, grinding, doing great work and wondering why nothing is changing, this is why. The work gets you in the room. Everything else gets you the seat.

As a detection engineer, I get pumped when I schedule a detection eng weekly challenge Go give this weeks challenge a shot!

Nobody gets promoted for work the decision-makers never saw. Technical skill gets you in the room. It does not move you up. The people who grow fastest in tech learn to communicate their impact, take ownership, understand the business, and advocate for themselves. Promotions are intentional. Start treating them that way.

What skills would you want to see added to @defendtheorg ? Currently we have: - Code Review - Detection Engineering - Incident Response - MITRE ATT&CK - Security operations - Scripting - System Design - Threat Hunting - Threat Modeling Are there any blue-team specific skills you'd want to see labs for? Some ideas I've been floating around: - IAM - Cloud Security - Threat Intel - (Insert Your Skill Here...)

You’re building a detection for credential dumping on Windows endpoints. Your first version alerts whenever `procdump.exe` accesses the LSASS process. During testing, you discover that an attacker can perform similar activity using a different tool. What is the BEST way to improve the detection? A. Add hashes for known credential-dumping tools to the detection so more variants are covered. B. Alert on every process that accesses LSASS, regardless of context, to avoid missing an attack. C. Identify the behavioral signals associated with suspicious LSASS access and correlate them with process context and other relevant activity. D. Increase the detection’s severity so analysts investigate every LSASS access alert immediately.

Stop trying to learn all of cybersecurity. Do this instead. ⬇️ One of the biggest mistakes people make when learning cybersecurity is trying to learn EVERYTHING. Networking, cloud, AppSec, IAM, detection engineering, threat intel, incident response… You can spend years jumping between topics and still feel like you don't know enough. The problem? You're trying to learn everything at once. Here's how I'd approach learning at different stages of your career: 1. Just starting out? Build the foundation. Focus on cybersecurity fundamentals, networking, understanding how systems work, and developing a security mindset. You don't need to master every domain. You need a foundation to build on. 2. Already working in cybersecurity? Go deep. Pick a domain that interests you or aligns with your career goals. Cloud Security, Detection & Response, AppSec, IAM, Threat Hunting… Choose a direction. Build things. Solve real problems. Develop expertise. Don't jump between unrelated topics just because you feel like you *should* know them. 3. Trying to get promoted? Focus on impact. Knowing more isn't enough. You need to solve complex problems, work across teams, and make progress when there's no obvious answer. Learn to take ownership and drive problems toward resolution. Broader knowledge will come through experience, collaboration, and exposure to other parts of the business. The takeaway? Build your foundation. Pick a direction. Go deep. You don't need to know everything in cybersecurity. You need to get really good at the things that matter for where you're going. Save this for your learning journey.

A morning run never hurt nobody 🏃