Learn Security - Without Chasing a Certification¶
Plain-English security for people who want to understand how systems get attacked and defended, not just pass an exam.
Built and maintained by Patrick Wiloak - Ex-AWS Solutions Architect, 10 years in tech. If certs aren't your goal, start here.
🎥 @patrickwiloak | 💼 LinkedIn
Who this is for¶
You want to understand security, but:
- You're not preparing for an exam (or not yet)
- You want context and intuition, not 200-question fact dumps
- You'd rather learn why a control exists before memorising vendor settings
- You're a developer, IT or ops engineer, founder, PM, or someone moving into security
If you do want certifications, head to the Study Hub, where every security certification on this site is indexed.
What's in this hub¶
The path¶
- Security from Scratch - seven phases from zero to security engineer: foundations, how attacks work, identity, protecting data, cloud security, detection and response, compliance, then picking a lane. Start here.
Bite-size concept pages¶
- Concepts - 4 topic pages, 5-10 min each: IAM, TLS and HTTPS, secrets management, and the shared responsibility model. The index also points to the cloud, data and AI concepts on the sibling sites.
Reference¶
- Glossary - security, identity, cloud and networking terms in plain English
- YouTube curation - filtered videos worth your time
Brand new to all of this?¶
- Day One on Cloud Zero to Hero - terminal, git, HTTP, servers. Security builds on these, so start there if they are unfamiliar.
How to use this¶
There's no single right order. Pick what fits:
| If you want to... | Start here |
|---|---|
| Learn security end to end | Security from Scratch |
| Look up a term you keep seeing | Glossary |
| Understand one idea (IAM, TLS, secrets) | Concepts |
| See a real security architecture | Zero trust architecture |
| Try a hands-on build | Implement zero trust |
| Understand a compliance framework | Compliance guides |
| Learn how AI apps get attacked | AI security on AI Zero to Hero |
Why this exists¶
Most security content is either:
- Cert-shaped - exam objectives, fact sheets, practice questions (great if you have an exam date, useless if you just want to understand)
- Vendor marketing - "stop every threat with our platform!" (no actual technical content)
- Deeply specialised - exploit write-ups and research papers that skip the fundamentals you'd need to follow them
This hub is the missing middle: technical, accurate, plain English, no exam scaffolding.
Companion resources¶
- Study Hub - if you decide to certify
- Security Engineer roadmap - the certification order for the career
- Service comparisons - security tools and identity services across AWS, Azure and GCP
- Topic indexes - security and identity, across all four pillars
Contributing¶
Spot something wrong, unclear, or missing? See CONTRIBUTING.md. Plain-English contributions especially welcome - if you can explain something better than I did, please do.