← Back to catalogue

Level 2 · M.Sc

MSc Advanced Whitehat Defensive Security

Security · Live · v0

Doctoral defensive security — detection science, large-scale telemetry, and original blue-team research.

Path type

Security

Requirements

MSc Whitehat Defensive Security

Enrollment

€39.90

Deadline

Next cohort starts 2027-09-06 (AY 2027/28)

Length

~1 year · 42 phases

Language

English · Español

Content freshness

Curriculum updated 2026-08-23 · content rev d7bd4b17

Cortex Credits (CC)

126 CC · 421 CC across all tiers of this programme
What are Cortex Credits?

Syllabus

View the phase syllabus

0. From admin to defensive-systems researcher
1. The defender's threat model, applied
2. Measurement discipline for defense
3. Linux kernel architecture for defenders
4. eBPF foundations for security observability
5. Reading & reproducing defensive research
6. The privilege-ring model for defenders
7. CPU security flags as hardening primitives
8. MSRs, model-specific registers & microcode trust
9. Machine-code & opcode-level tamper detection
10. ELF at defensive depth
11. Ring-0 kernel rootkit detection
12. Ring −1 / ring −2 stealth & detection
13. Low-level defense capstone
14. Process memory & the /proc forensic surface at depth
15. Acquisition & analysis (DFIR toolchain)
16. Live-response methodology
17. Runtime tampering detection
18. Persistence hunting at depth
19. Anti-forensics & counter-anti-forensics
20. Forensics capstone
21. Log architecture & the SIEM (CLI side)
22. Host telemetry at depth
23. Network detection at research depth
24. eBPF runtime detection & HIDS
25. Detection-engineering methodology
26. Threat-detection content, honestly
27. Detection-engineering capstone
28. SELinux internals & policy engineering at depth
29. The LSM framework & comparative MAC
30. seccomp-bpf & syscall filtering
31. Namespaces, cgroups v2 & container internals at depth
32. Sandboxing technologies compared
33. Compiler & binary hardening
34. Isolation capstone
35. Firewall engines at research depth
36. OpenBSD as a security research platform
37. Network intrusion detection at depth: encrypted traffic and flow features
38. The hardened edge: relayd, TLS termination & WAF
39. DNS, PKI & trust-infrastructure defense
40. Segmentation & zero-trust for the Bastion
41. Traffic capture & analysis at depth

Syllabus →

Enrolment prerequisites

• A verified account and admissions-committee approval.
• Recommended path: MSc Whitehat Defensive Security (advisory, not blocking).