Cybersecurity Foundations: The Analyst Path
Signature Course No. 108 — A Signature AI Socratic Coaching Course.
A New Kind of Learning
Socratic coaching, delivered by an agentic AI coach.
Not a course you watch. An AI coach you work with.
The Lighthouse Coach begins by discovering how you think about the subject, teaches what is missing, and gives you realistic practice before asking you to prove that you can use it. You may test out of concepts you already understand, while capstones turn the learning into a practical plan, decision, conversation, or other real-world result.
The curriculum is deliberately authored; the AI delivers it through coaching. It is not an AI randomly generating lessons.
A coach that teaches by asking — not by lecturing
The Lighthouse Coach is an AI Socratic coach built on Cognosco Learning's Cybersecurity Foundations: The Analyst Path course, in the Risk, Safety & Compliance category. It does not play videos at you.
It holds a conversation: it asks you a question, listens to your answer, names the misconception it hears, affirms what you got right, and asks the next question — the way a great coach works in the room. You work realistic security scenarios alongside the Coach throughout: messy alerts, incomplete logs, competing priorities, and people who need an answer before the evidence is complete.
This is the course for aspiring analysts preparing for entry-level security roles, IT staff moving sideways into security, career-changers with everyday IT fluency, junior analysts already in seat who feel the gaps, and the small-organization defender by necessity who is the security function.
It works in the order the job itself runs: first, Module 1 — The Ground and the Adversary: How Attacks Happen and What Stands in Their Way — work through Concepts 1–9, finishing with Reading an Environment You Must Defend; then, Module 2 — The Analyst's Working Day: From Signal to Case Closed — work through Concepts 10–18, finishing with The Case File.
You can type your answers, or talk out loud: the Voice Coach speaks its questions and listens to your spoken replies, hands-free. The course is self-paced and always on — roughly 30 minutes per concept, about 9 hours in full, taken in as many sittings as you like. Learners who already know the material can test out concept by concept.
Nothing in this course teaches attacking systems. This is defensive work only: how defenders think, what defenders watch, how defenders respond. Every scenario in these pages stays inside authorization: systems the fictional defenders are employed and entitled to defend, evidence they are entitled to read, and actions a responsible analyst may take.
This course is vendor-neutral and principle-based, on purpose. It names no product's menus, no console's buttons, and no vendor's procedure.
This course makes no certification-exam promises. It is not an exam-prep product, it is not aligned question-by-question to any vendor's or body's test, and it guarantees no credential, interview, or job.
This course starts where No. 51 stops.
Both capstones produce real artifacts — a complete environment reading with a one-page brief a business owner can decide on, and a complete worked incident case file, plus your own analyst readiness plan — not just ideas about security.
This is the one hundred and eighth course in The Lighthouse Signature Series — the online counterpart to the one-day, in-person learning Cognosco Learning has delivered since 2002.
Course Facts
One full concept, coached end to end — free: verify your email and we’ll send you a link to start.
Already enrolled? Enter the course →
Diagnose → Learn & Practice → Prove → Capstone
Every learner moves through the same discipline a Cognosco instructor would insist on in the room.
Diagnose
The Coach starts where the course starts: with the ground, not the alerts. You cannot defend what you cannot picture — and you cannot spot a stranger in a crowd you have never looked at. Every concept opens with three questions that locate where you actually stand, and your answers shape how deeply the Coach works the concept with you. Everyone begins with Module 1 — no skipping the foundations you only think you have.
Learn & Practice
Work each concept in conversation with the Coach — spoken or written — then practice it against realistic situations until it holds up.
Prove
Every concept ends in proof: answer the check cold and demonstrate the skill. Know it already? Test out and take credit immediately.
Capstone
Finish with two capstones — Reading an Environment You Must Defend for Module 1 and The Case File for Module 2 — that pull the whole course together, and earn the certificate.
What You'll Learn
Every organization now runs on systems it only partly understands, watched by fewer people than the work requires, against opponents who need to succeed only occasionally while the defense must hold every day — and into that gap walks the entry-level security analyst, usually underprepared for what the job actually is.
This course is about what the job actually is. You will learn the ground analysts defend — how computers, services, networks, and identities fit together well enough that an attack has a shape you can see; how attackers actually work, stage by stage, motive to impact, studied strictly in order to defeat them; and what stands in their way and why — layers of controls, each chosen for a reason and each assumed to be fallible.
Then you will learn the working day itself: how logs testify and how to read them without inventing what they do not say, how detection turns a flood of events into a short list worth a human's attention, how triage decides what matters first when everything arrives at once, how an investigation builds a timeline out of fragments until the story is solid enough to act on, and how incident response moves — contain, eradicate, recover, learn — without panic and without theater.
Finally, you will learn the half of the job nobody puts in the job posting: deciding what to patch first when you cannot patch everything, stating risk in business language a decision-maker can weigh, documenting work so clearly that a stranger could continue it at 3 a.m., and communicating under pressure in a way that earns the trust this profession runs on. Nothing here is product procedure and nothing here is attack craft. It is the thinking, taught plainly and practiced on realistic cases, until the thinking becomes habit.
What you will learn
- See the ground you defend — systems, networks, and identity — and how an attacker moves across it
- Read the evidence: logs, alerts, and baselines — and tell signal from noise without guessing
- Work an incident end to end: triage, investigate, contain, recover, and learn
- Think in risk and speak in business language: choose controls, set priorities, and document work others can trust
Everything in the course
- All 18 concepts of Cybersecurity Foundations: The Analyst Path, in 2 modules
- A starting-point check first — the Coach finds where you actually stand before teaching
- Learn, Practice, Prove for every concept — no passive video watching
- A test-out on every concept: prove you know it and move on
- The Voice Coach: talk with the Coach out loud — it speaks, listens, and replies
- A personal Learner Record of your work across the course
- Two capstone exercises: Reading an Environment You Must Defend and The Case File
- A printable session summary whenever you pause
- The Lighthouse Coach completion certificate (Signature Series)
- Your progress is saved as you go — stop anytime, resume where you left off
Built for the person standing on the defending side of the desk
Cybersecurity Foundations: The Analyst Path is for aspiring analysts preparing for entry-level security roles — who want to arrive able to reason about real work, not merely able to define vocabulary words, IT staff moving sideways into security, whose fluency with the ground is real but whose security judgment has never been deliberately built, career-changers with everyday IT fluency who want a principled route into defensive work, junior analysts already in seat who feel the gaps — alerts they judge by gut, write-ups they know are thin,
incidents they survived rather than worked — and the small-organization defender by necessity: the person in a small company or school or clinic who is the security function, and who needs sound priorities more than enterprise scale.
Nothing in this course teaches attacking systems. This is defensive work only: how defenders think, what defenders watch, how defenders respond.
This course is vendor-neutral and principle-based, on purpose. It names no product's menus, no console's buttons, and no vendor's procedure. This is a Risk, Safety & Compliance course.
It assumes everyday IT fluency — you use accounts, networks, and cloud services comfortably, you know what an administrator can do that a standard user cannot, you have seen settings, updates, and sharing permissions — and it assumes No. 51-style security awareness as the floor: you can already recognize phishing, protect your own accounts, and work safely as an employee. It assumes no prior security role, no particular product, and no mathematics beyond plain reasoning about likelihood and impact.
Prefer to learn live and in person? The same material anchors Cognosco's one-day programs — browse the in-person catalog.
Start with Reading an Environment You Must Defend
$195 — introductory price. One payment. No subscription, no password to manage.
Here is exactly what happens when you enroll:
- Pay securely with Stripe — you are taken straight into the course
- Create your learner profile and begin the Module 1 starting-point check
- Save the access key you are given — it restores your enrollment on any device
- Learn at your pace; your progress is stored in your browser on your device
For the full voice experience, use Chrome and allow the microphone when asked. Typing your answers works everywhere, all the time. Questions before you enroll? Email hello@cognoscolearning.com.
More Signature Courses are coming
Cybersecurity Foundations: The Analyst Path is Signature Course No. 108. Leave your email and we'll send you news of future Signature Courses and Lighthouse updates as they are announced — nothing else.