Web Application Security Training Path
Building real defensive skills takes time and proper structure. Our program walks you through three progressive phases—starting with fundamentals and moving into practical defense techniques that matter in 2025.
Classes begin September 2025. Applications open in May.
How the Program Actually Works
We break it down into three phases over nine months. Each builds on what came before—no shortcuts, just steady progress.
Foundation Phase
Months 1-3 | 12 weeks
- HTTP protocol mechanics and session management
- Authentication patterns and common weaknesses
- Input validation and data flow tracking
- Browser security model fundamentals
- Basic threat modeling concepts
Application Phase
Months 4-6 | 12 weeks
- SQL injection prevention techniques
- XSS defense and content security policies
- CSRF protection implementation
- API security and authorization controls
- Secure session handling practices
Integration Phase
Months 7-9 | 12 weeks
- Security testing in development workflows
- Code review for vulnerability patterns
- Incident response procedures
- Security tooling and automation
- Real-world case studies and scenarios
Learn Through Doing
Every module includes hands-on labs where you'll work with actual vulnerable applications. You'll break things, fix them, and understand why certain approaches fail.
By month six, most students can identify and patch common vulnerabilities without needing reference materials. The pattern recognition comes from repetition, not memorization.
Final projects involve securing a complete application from scratch—applying everything learned across all three phases.
What Students Accomplish
These numbers come from our 2024 cohort. Results vary based on prior experience and time commitment, but these represent typical outcomes.
Hands-on practice time across all three phases
Covered through exercises and case studies
With consistent 12-15 hour weekly commitment
Students who finish all three phases
I came in knowing basic programming but nothing about security. The phase structure made sense—each month built on the last without overwhelming me. By month seven, I was catching bugs in my own projects before they became issues.
The labs were tough but practical. Every exercise tied back to real vulnerabilities I'd seen in production code. Three months after finishing, I implemented CSRF protection across our entire platform—something I couldn't have done before this program.
Common Questions We Address
Most students hit similar roadblocks. Here's how we work through them during the program.
Time Management Struggles
Nine months is a significant commitment. Most students balance this with full-time work.
Our approach: Modules are self-paced within each phase. Weekly check-ins help you stay on track without rigid deadlines.Feeling Overwhelmed Early
Security has a steep learning curve. Month one can feel like drinking from a firehose.
Our approach: Foundation phase moves slowly on purpose. Concepts repeat across multiple exercises until they stick.Applying Theory to Practice
Understanding vulnerabilities conceptually doesn't mean you can spot them in real code.
Our approach: Every concept includes three types of exercises—recognition, exploitation, and remediation.
Colette Moss
Lead Security Instructor
Spent eight years doing penetration testing before moving into education. Teaches phases two and three.