CcX Cyber Academy

Cybersecurity training that runs like the actual job

Six weeks. Live online. You train inside a working enterprise network, clear a real ticket queue, and get graded by a senior security leader on work that looks like the work.

A subscription gives you content. This gives you a job simulation, a cohort, and a senior analyst grading your work.

Join the waitlist

Who this is for

You want your first job in cybersecurity, most likely as a SOC analyst or junior security analyst, and you are ready to train the way the job actually works.

You may be changing careers from IT support, from another trade, from the military, or from something with no technology in it at all.
You do not need an IT job on your resume, and you do not need an IT background at all. Foundations Week 0 is included in your tuition and opens the day you enroll: a self paced pre course in computing, Windows, Linux, networking and how the internet and email actually work, built to get students who start from zero to the week one start line. It closes with a readiness check and a live orientation on Saturday, November 7. Students who already work in IT take the same readiness check and test out.
You can commit to two evenings a week, a Saturday lab block, and one graded assignment every week.
You want feedback on your work from a person, not a score from a quiz engine.

Who this is not for

If you want videos you can half watch at double speed, buy a subscription instead. Everything here is live and everything here is graded.
If you want a guaranteed job at the end, this is not that, and anyone who promises you one is selling you something. Read the completion commitment in the price section. That is the honest version.
If you already work in a SOC, this programme will move too slowly for you. It is built for people breaking in.
If you cannot show up live, do not enroll. The cohort is the product.

What makes it different: you work for a company from day one

The whole programme runs inside one fictional company, Harlowe and Finch LLP, a law firm with offices in Houston and Chicago. Client data is sensitive, email is the lifeline of the business, and you are its security team.

From the first session you work like a Tier 1 analyst:

A real ticket queue. Your exercises arrive as tickets in the firm ticketing system, with priorities, deadlines and impatient users attached. You claim them, work them, document them and close them.
Workplace standards, enforced. Acknowledge a ticket within 15 minutes during a shift. Update priority work at least every 30 minutes. Put evidence in the ticket, not opinions. Escalate with a proper handoff note that says what happened, what you found, what you tried and what you need.
A real network behind it. An Active Directory domain, Windows workstations and servers, Linux systems, a firewall, a mail server and a SOC console. You reach all of it through your browser.
Identity run the way companies run it. The firm runs on Microsoft 365, so you sign in through Microsoft Entra ID with multi factor authentication on your own account, the way staff sign in at the many companies built on Microsoft. Identity is also where you will work. When a password spray hits the firm, or a member of staff gets buried in sign in prompts until they tap approve just to make them stop, you investigate it in the Entra sign in logs, correlated with the SOC console, the same evidence an identity admin would hand you.
Real mail with real headers. The firm mail system is a working mail server, so when a phishing email lands you analyse the actual message, the actual Received chain and the actual SPF, DKIM and DMARC results. Not a screenshot.
Noise, on purpose. The firm generates alerts all day and most of them are benign. Users lock themselves out, partners work at midnight, marketing sends mail that trips the phishing rules. You will be graded on closing false positives with confidence and clear reasoning, not only on catching attackers.
Your own evidence. Phishing lures and investigation material are generated per student. No two students investigate the same email, so there is no answer key to copy and no shortcut around doing the work.

The working stack

The main SOC console is Elastic. You will also run searches in Splunk, because job postings keep asking for it, and you will see how the same incident looks in both. During the cohort you also work inside Microsoft Sentinel, the console at the centre of the Microsoft security stack, while its trial window runs. The search dialect you are graded on is SPL in Splunk, the one job postings name most, and in week four you build your first automation playbook in Splunk SOAR. Zeek records every connection and DNS lookup on the firm network, for the weeks when packets alone are too much data. The firm AWS accounts report into GuardDuty and Security Hub, and their findings arrive in your queue as tickets like everything else.

Elastic
Splunk
Microsoft Sentinel
Microsoft Entra ID
Microsoft Defender
Microsoft Purview
AWS GuardDuty
Zeek
BloodHound
Velociraptor
TheHive
MISP
Splunk SOAR
Tines
ServiceNow

How the six weeks run

Live sessions run Tuesday and Thursday evenings, 6:30 to 8:30 PM Central, with a Saturday lab block from 10:00 AM to 1:00 PM Central. That is 35 hours live with your instructor, plus graded assignment work each week.

Week 0, from the day you enroll: Foundations

Included in your tuition and open the moment you enroll. Short lessons, each one followed by a small hands on task in a sandbox corner of the range: how computers work, Windows and Linux basics, what an IP address and DNS and a port actually are, how the internet and email flow, the security words the field uses, and what a ticket is. You finish with a readiness check you certify yourself and a live orientation on Saturday, November 7 that doubles as your range tech check. If you already work in IT, you take the readiness check and test out. Nobody starts week one lost.

Week 1, November 10 to 14: Start the job

What a SOC actually does all day. Networking that matters for investigations: addresses, subnets, ports, DNS, the TCP handshake. Command line work on Windows and Linux. Your first shift in the range, working a queue of noisy, mostly benign tickets to the documentation standard. Graded assignment: networking questions answered as ticket work, using evidence you pulled from the range yourself.

Week 2, November 17 to 21: Endpoints, Linux, logs and the SIEM

Finding authentication evidence in Linux logs. Windows event logs and endpoint telemetry. Searching the SIEM to answer a specific question and building a timeline from raw events. Identity joins the evidence this week: the firm signs in through Microsoft Entra ID, you enrol in multi factor authentication, and you work two identity investigations as tickets, a password spray and an MFA fatigue attack, from the Entra sign in logs correlated with the SIEM. You rerun the core of one investigation in Splunk, writing real SPL, and that work is graded, because SPL is the dialect employers name most. You also meet Microsoft Sentinel, the Microsoft stack console, while its trial window runs, and the firm AWS findings from GuardDuty and Security Hub land in your queue as tickets, because that is the job now. The AI assistant switches on this week, under the verification discipline described below. Graded assignment: a full SIEM investigation write up, including a note on what the AI got wrong.

Thanksgiving week, November 23 to 28: Self paced lab week

No live sessions. A lighter week that still behaves like a real job, because the queue does not stop for holidays. You harden a Windows and a Linux machine against CIS Benchmark settings and prove it with before and after evidence, clear a backlog of low priority tickets, and get an early look at packet analysis. Your instructor also demonstrates PingCastle against the firm domain before and after the hardening, the same posture report real firms hand to auditors, and you take your first BloodHound look at how an attacker could move through the domain. Graded assignment: a CIS hardening report.

Week 3, December 1 to 5: Seeing attacks, packets and phishing

Wireshark in depth: following conversations, spotting scans, beaconing and data leaving the network, with Zeek connection and DNS records beside the captures so you learn when metadata answers the question and when only the packets will. Then phishing: how attacks on a law firm actually look, and full header analysis on real messages from the firm mailbox. The week ends with the simulated SOC shift on Saturday, December 5: three hours working a live queue while real incidents develop in the network, a user reports a suspicious email mid shift, and you finish by writing the handover note the next shift will rely on. Confirmed incidents from the shift are opened as cases in TheHive, the case layer that sits above the ticket queue in a real SOC, and every indicator you check goes against the firm MISP instance. Graded assignment: a complete phishing investigation, including the scope check and the reply to the user who reported it.

Week 4, December 8 to 12: Exposure and detection engineering

Vulnerability scanning with Nessus, and how to prioritise by real risk instead of raw scores. Firewall rules and logs. IDS and IPS alerts. Investigating an endpoint alert in Microsoft Defender for Endpoint and isolating a host. Mapping the firm domain with BloodHound so you can see the attack path your detection rule has to defend. MITRE ATT&CK as the shared language of the SOC. You also build your first security automation: a phishing triage playbook in Splunk SOAR that enriches indicators, opens the case and drafts the ticket for analyst approval. On the evening of Wednesday, December 9, you get paged: an on call escalation drill where you respond inside a set window and hand off to standard. Graded assignment: a Sigma style detection rule you wrote from a real event, mapped to ATT&CK, with test evidence showing it fires on attack data and behaves on benign data. Your BloodHound path map goes in with it, with the step your rule defends marked.

Week 5, December 15 to 19: AI in the modern SOC, careers and the capstone

A full session on AI in security operations, described in the next section. Then careers: your resume built line by line from your own graded work, your portfolio put in order, and a mock technical interview run the way a hiring manager runs one, with scored feedback. You also claim your own free ServiceNow developer instance and rebuild one of your security tickets there as an enterprise incident, so the ITSM system most large employers run is not new to you on day one. You build one automation story in your own free Tines account, and inside the Microsoft tenant you set a Microsoft Purview data loss prevention policy for client matter data and triage the alert when the data exposure incident from the AI session trips it. The programme closes on Saturday, December 19 with the capstone and graduation.

The capstone, Saturday, December 19

A targeted phishing email lands at the firm and a user opens it. The endpoint is compromised. The attacker moves through the Active Directory domain toward the servers that hold client files. Your team works the alert queue live, finds the real incident inside the noise, scopes it, contains it and escalates it properly. Endpoint evidence is collected with Velociraptor before anything is wiped, and the incident runs as a case in TheHive while the tickets keep flowing underneath it. Then each student writes the professional incident report on their own. That report is graded against a published rubric, and it is the centrepiece of your portfolio.

AI is part of this job now. Learn to use it without being fooled by it.

AI is built into this programme two ways: you are taught it, and you use it.

You use it as a tool. From week two, an AI assistant sits inside the range with you. Use it to summarise logs, explain an alert in plain language and draft your ticket updates. Every student works under one rule, and it is graded: AI drafts, evidence decides. Anything the AI writes that goes into your ticket carries a short note saying what you verified it against, event by event. Unchecked AI text earns no marks.

You are taught where it breaks. At least one lab in this programme is built so the AI gives you a confident, fluent, wrong answer. It will cite its sources and sound completely sure. Catching it earns marks. Pasting it into your ticket fails that part of the assignment. That lesson, learned here, is worth money in a real SOC.

You learn to defend it. In week five you study how modern SOCs use AI for triage and investigation, and where the human analyst stays accountable. You also work the other side: an employee pastes client material into a public chatbot and you handle it as the data exposure incident it is, and you learn why AI tools must never be trusted to follow instructions hidden inside the data they are reading.

What you walk away with

A graded capstone incident report: an end to end investigation written to a professional standard. This is the document you show employers.
A detection rule you designed, mapped to MITRE ATT&CK and tested against real data from your own range work.
Six graded assignments of realistic analyst work product, each one reviewed by your instructor.
A working stack you can name with a straight face: Elastic and Splunk searching with SPL, Microsoft Sentinel, Microsoft Entra ID, Microsoft Defender and Microsoft Purview, AWS GuardDuty, Zeek, BloodHound, Velociraptor, TheHive, MISP, Splunk SOAR, Tines and ServiceNow, every one of them used on live work in the range rather than watched in a tutorial.
Experience that interviews well: a ticket queue, a live SOC shift, an on call escalation, shift handovers and a phishing caseload, all inside one enterprise you learned the way you would learn an employer.
A resume built from your own graded evidence, with real tools and real numbers and nothing invented.
A mock technical interview with scored feedback, so your first real one is not your first one.
A certificate of completion, issued when your capstone report passes grading.
Grounding that aligns to CompTIA Security+ and to practical SOC certifications including PSAA and BTL1, so the work here counts toward the certifications employers ask about.

Your instructor

This programme is taught and graded live by one person, and he does this work for a living.

He is a senior security leader with more than a decade in security operations, covering detection, incident response, cloud security and running SOC work. His credentials include GCIH, GCFE, AWS Certified Security Specialty, CompTIA Security+ and CySA+, CEH, the Microsoft Security Operations Analyst Associate certification and a Splunk certification.

He ran the first version of this training in 2021 under CcX Ideas. This programme is that training rebuilt for 2026: a private enterprise range instead of installs on your own machine, a graded assignment every single week, and AI treated as part of the job.

The cohort is capped at twelve because he reads and grades your work himself. When you escalate a ticket in the range, the person answering is the person who will grade your capstone.

Tuition

Early seats for this founding cohort: $3,500

Or 2 payments of $1,750.

Six of the twelve seats are early seats at this price. When they are gone, the standard price applies. The cohort is capped at 12 students in total. The second payment is charged on December 1, 2026.

Enrol with an early seat

Standard seat: $4,000

Or 2 payments of $2,000.

The cohort is capped at 12 students in total. The second payment is charged on December 1, 2026.

Enrol with a standard seat

Tuition covers the Foundations Week 0 pre course, all live instruction, full access to the lab range during the programme, grading and written feedback on every assignment, the simulated SOC shift, the mock technical interview and your certificate of completion.

Refund: Full refund any time before the second live session.

The completion commitment. There is no job guarantee on this page because nobody can honestly offer you one. Here is what is offered instead. Finish everything: every assignment, the capstone and the career programme. If you have done all of that and you are still not interview ready, you repeat the next cohort at no cost until you are.

Questions, answered straight

Do I need IT experience to join?

No. No IT job and no IT background are required, because the programme starts before week one. Foundations Week 0 is included in your tuition and opens the day you enroll. It teaches the fundamentals the rest of the course assumes: how computers and operating systems work, Windows and Linux basics, networking in plain language, and how the internet and email actually flow. Each short lesson comes with a small hands on task, and the pre course ends with a readiness check and a live orientation on Saturday, November 7. If you already have an IT background, you take the readiness check and test out instead. What you do need is basic confidence with a computer: using a browser, joining a video call, finding your way around your own machine. If you have that, Week 0 and week one will carry you the rest of the way.

What do I need at home?

A computer and an internet connection, plus a headset or microphone for live sessions. That is the whole list. There is nothing to install. The entire lab range, the firm network, the mail, the ticketing system and the SOC console run in the academy cloud and open in your browser. The 2021 version of this training made students set up virtual machines on their own laptops before day one, and it caused more problems than everything else in the course combined. It is gone.

Is a job guaranteed?

No. No honest training programme can guarantee you a job, and this one will not pretend to. What you get is the completion commitment above: do all of the work, including the career programme, and if you are not interview ready at the end you repeat the next cohort free. What you also get is proof of work most applicants do not have: a graded incident report, a tested detection rule and shift experience you can talk through in an interview because you actually did it.

How much time does this take each week?

Seven hours live: two evening sessions of two hours and a three hour Saturday lab block. On top of that, plan time for one graded assignment each week. The Thanksgiving week has no live sessions and a lighter self paced workload.

I work during the day. Can I do this?

That is who it is built for. Live sessions are on Tuesday and Thursday evenings and Saturday late morning, Central time. The range work and assignments fit around a working week, but the live sessions are live. If your schedule cannot hold those slots for six weeks, wait for the next cohort.

Does this prepare me for certifications?

The curriculum aligns to CompTIA Security+ and to practical SOC certifications such as PSAA and BTL1. The skills transfer directly: SIEM searching, log analysis, phishing investigation, detection writing. The programme itself is deliberately built around doing the work rather than cramming for a test, because employers hire analysts who can work a queue, and the certification then becomes far easier to earn.

What if I fall behind?

Tell your instructor early, not after it has compounded. The pace is a real pace because the job has one. And the completion commitment stands behind you: a student who finishes everything the programme asks, including the career work, and is still not interview ready repeats the next cohort at no cost.

Why does this cost more than an online subscription?

Because it is a different product. A subscription rents you a library and leaves you alone with it. This is twelve people, a live instructor who grades your work every week, a private enterprise range built for this cohort, a simulated shift, a mock interview and a capstone incident. You are paying for supervision, accountability and proof, not for content.

Enrollment opens the week of October 26, 2026

Cohort 1 of CcX Cyber Academy starts Tuesday, November 10, 2026 and closes with the capstone and graduation on Saturday, December 19, 2026.

Twelve seats. One instructor. You are not buying recordings of a class that already happened, and you are not buying a library of videos. If you want in, get on the waitlist now and the enrollment link reaches you before it goes anywhere public.

Join the waitlist

Questions before you commit: reply to the waitlist confirmation email and a person will answer you.