Ryan G. Cox

The reason people spend thousands of hours playing video games isn't because they love playing the tutorial over and over - it's because the gameplay loop and progression system makes playing feel rewarding. I think learning cybersecurity should be no different. But most education platforms focus on mindless content, videos, courses, and certifications. That's exactly what I'm trying to change with DefendTheOrg. XP. Levels. Badges. Leaderboards. And soon, story-driven campaigns that combine multiple skills into realistic scenarios. But not at the cost of quality cybersecurity labs, educational content, and structure to learning hands-on skills. Because if you're going to spend hundreds of hours developing cybersecurity skills, it might as well be fun.

I love creating content because I enjoy hearing the impact it has on other people in their careers and lives. But I absolutely hate the administrative parts of it: - Editing Videos - Reformating into different creatives - Figuring out whats performing well - Analyzing why content is working - Staying up with the popular trends - Posting to all platforms So I've actually been working on a framework that's been saving me practically all of that time. I speak my ideas and my system cranks out the content. It's been amazing so far and made me love content creation even more. I think I'm going to productize this framework since it's saving me about 5 hours a week at the moment. Anyone else interested in a social media system that goes beyond just scheduling and turns your ideas into a fine oiled machine?

This exercise on @defendtheorg is a great one to try as a beginner 👏

No new lab this Thursday…… 🥲 But only because we dropped 6 yesterday in the new Purple Team skill.

I started in Cybersecurity 7 Years ago on a whim with zero experience. Here I am 7 years later sharing my experiences, knowledge, and life as I continue to build a life of my own. If I can do it, you can do it too. Follow along for my journey through cybersecurity and building my own products. Feel free to ask any questions along the way :)

ITS HERE. TIME TO GO 🟪🟪🟪

What does purple teaming actually look like when you move beyond the theory? That's exactly what I wanted to bring to DefendTheOrg. The new Purple Teaming experience puts you in the middle of an attack simulation where you have to analyze telemetry, identify detection gaps, engineer improvements, map coverage to MITRE ATT&CK, and validate your work by rerunning the attack. Because the goal isn't just to write more detections. It's to understand where your defenses fall short and systematically make them better. Purple Teaming is live on DefendTheOrg. Go put your skills to the test.

Coffee + The Gauntlet have become my Tuesday morning routine ☕️

Dear Aspiring Security Engineer, Detection & Response (DART) is one of the most hands-on areas of security you can work in. Here are 5 things you need to know about it. ⬇️ - 1️⃣ Detection engineering builds the signals This is the build side. You write detections, tune out noise, make sure the right data exists, and build the platform the detections run on. Data → Detection Logic → Alert → Response A detection is only as good as the response it enables. 2️⃣ Incident response acts on the signals An alert fires. Now you have to figure out what actually happened. Is it real or a false positive? What's the scope? Which systems and identities are involved? How do you contain it? What needs fixing so it doesn't happen again? This is where your detections get tested. 3️⃣ You are your own customer DART is a hybrid role. You build the tooling, then you use that same tooling when you respond. Alert missing context? You feel it. Slow query mid-investigation? You feel it. Noisy detection? You feel it. That feedback loop makes the work better over time. 4️⃣ On-call is part of the job A lot of teams run a rotation. Every month or so you take a shift. On-call, your job is strictly operational. You triage and respond. Engineering work waits. The rest of the time you build detections, improve tooling, and fix what on-call taught you. On-call shows you what to build next. 5️⃣ Hunting and intel feed the loop They aren't in the name, but they support everything DART does. Intel tells you what attackers are doing. Hunting tells you if they're already in your environment. Both turn into new detections. Ask yourself: What would this attack look like in our data? Would we detect it today? Could we respond quickly? What did the last incident teach us? Detect, respond, learn, build. Then do it again.

Definitely hitting this one this week 😤

The OG Tweet: nitter.gq/RyanGCox_/status/21163…

But I thought cybersecurity is dead 🤔

Checks out

Your EDR detects a suspicious PowerShell command on an employee workstation. The command downloads a script from an external domain and executes it. The endpoint is still online, and the user is actively working. You check your SIEM and find that the same domain was contacted by three other endpoints in the last hour. What should you do NEXT? A. Isolate all four endpoints immediately and begin rebuilding them from known-good images. B. Investigate the PowerShell execution chain and correlate activity across the four endpoints to determine scope, while assessing whether containment is needed. C. Block the external domain at the firewall and close the incident if no further connections occur. D. Search for the script’s hash across the environment and isolate only endpoints where the exact same file is found.