Ryan G. Cox

The reason people spend thousands of hours playing video games isn't because they love playing the tutorial over and over - it's because the gameplay loop and progression system makes playing feel rewarding. I think learning cybersecurity should be no different. But most education platforms focus on mindless content, videos, courses, and certifications. That's exactly what I'm trying to change with DefendTheOrg. XP. Levels. Badges. Leaderboards. And soon, story-driven campaigns that combine multiple skills into realistic scenarios. But not at the cost of quality cybersecurity labs, educational content, and structure to learning hands-on skills. Because if you're going to spend hundreds of hours developing cybersecurity skills, it might as well be fun.

But I thought cybersecurity is dead 🤔

Checks out

Your EDR detects a suspicious PowerShell command on an employee workstation. The command downloads a script from an external domain and executes it. The endpoint is still online, and the user is actively working. You check your SIEM and find that the same domain was contacted by three other endpoints in the last hour. What should you do NEXT? A. Isolate all four endpoints immediately and begin rebuilding them from known-good images. B. Investigate the PowerShell execution chain and correlate activity across the four endpoints to determine scope, while assessing whether containment is needed. C. Block the external domain at the firewall and close the incident if no further connections occur. D. Search for the script’s hash across the environment and isolate only endpoints where the exact same file is found.

If you could redo the start of your cybersecurity career, what advice would you give others starting out? Here are the four things I'd do differently. 1. Talk to more people. Early on I barely networked, and that was the biggest mistake. It's a dense field, and it can be difficult to know your path. Meet people that can help you figure out where to go next. 2. Spend less time collecting certs and more time on focused learning. Certs help when you have absolutely zero experience and need something on your resume. But even then, they aren't the whole game. Learn through hands-on methods instead of just checking a box. 3. Build things. Building teaches you fastest because you break stuff along the way. And those projects carry over to the job more than any certification ever could. 4. Be patient for more than a year. Give it two to three. Cybersecurity is dense. It takes time to learn, time to feel comfortable, and time to see the full scope, because you're touching nearly the whole stack. If you're early in this, save this for the week where things might not be going your way.

This man is still insane

Cybersecurity hiring is going to go bonkers in 2027

I'm building new labs on @defendtheorg and getting blocked by Cybersecurity checks on Opus 😢

Calm before the storm that is Incident Response on-call...

You say you want to be a SOC Analyst. But how bad do you want it? Go give Sidecar a go now!

Cybersecurity can't buy everything, but it sure can buy a LOT of things...

IAM is HUGE right now. Here’s an easy way to learn the basics in under 2 hours.

One of the biggest challenges when breaking into cybersecurity is knowing what to learn, in what order, and why. There's no shortage of courses, certifications, and tools. But without a clear direction, it's easy to spend months learning things without knowing whether they're moving you closer to your goal. That's why I built Paths on DefendTheOrg - to turn a massive library of cybersecurity content into a structured roadmap toward a specific career. You shouldn't have to rely on luck to figure out your career. You should have a path to follow.

Should we do a giveaway?

Code review used to be one of the biggest jobs in engineering - but it looks different now. AI writes and reviews most code. But manual review still has a place in the process. Here are 5 things you need to know about Code Review ⬇️ - 1️⃣ Review is about what gets missed At its core, it's edge-case hunting. You check for what the author didn't think about: - Inputs that break assumptions - Formats that don't match - States never handled - Permissions touched by accident 2️⃣ Know where manual review fits You can't hand-review every line anymore. You shouldn't. Manual review earns its cost on critical changes: - Production databases - Access to sensitive data - Permissions opening up When a change widens who can reach what, a human confirms it's intended. 3️⃣ AI now does the first pass It's good at the tireless work: - Scanning every diff - Flagging patterns across the change - Catching obvious stuff fast - Never bored on line 400 It clears noise so humans focus on judgment. 4️⃣ But AI will always find something Run it again, it finds another. A lot is noise: - Edge cases that can't be hit - Paths that don't exist - Bugs behind impossible conditions The skill is triage. Is this reachable? What's the real impact? 5️⃣ Separate valid from valuable Ask: - What could this break that the author missed? - Does it change who can access what? - Is the finding reachable in our system? - What's the blast radius? Good review isn't finding the most issues. It's finding the ones that matter.

Your career is not going to progress just because you're good at your job. I wish someone told me this earlier. Being technically competent is one piece of the puzzle. It's the price of admission, not the thing that gets you promoted. The people who move up aren't always the best engineers in the room. They're the ones who can communicate their work. Who make their impact visible. Who take ownership when something breaks and build real relationships across the team. And they advocate for themselves. That last one is the one most of us get wrong. We assume good work speaks for itself and that someone is keeping score. Nobody is keeping score for you. Promotions are intentional. You have to understand the business, know what the organization actually values, and then show how your work ties back to it. So if you've been heads down, grinding, doing great work and wondering why nothing is changing, this is why. The work gets you in the room. Everything else gets you the seat.

As a detection engineer, I get pumped when I schedule a detection eng weekly challenge Go give this weeks challenge a shot!

Nobody gets promoted for work the decision-makers never saw. Technical skill gets you in the room. It does not move you up. The people who grow fastest in tech learn to communicate their impact, take ownership, understand the business, and advocate for themselves. Promotions are intentional. Start treating them that way.

What skills would you want to see added to @defendtheorg ? Currently we have: - Code Review - Detection Engineering - Incident Response - MITRE ATT&CK - Security operations - Scripting - System Design - Threat Hunting - Threat Modeling Are there any blue-team specific skills you'd want to see labs for? Some ideas I've been floating around: - IAM - Cloud Security - Threat Intel - (Insert Your Skill Here...)