Learn the essential concepts, then build a connected enterprise-style environment and use it. Configure the network. Create the domain. Provision identities. Collect the logs. Test the controls. Investigate what happened.
Cyber security theory matters. The problem begins when a course treats theory as the destination and leaves learners to bridge the operational gap alone.
Learners can repeat terminology but may still hesitate when asked to configure a control, trace an event or explain why one system depends on another.
Important theory is taught first, then tested through configuration, troubleshooting, attack simulation, monitoring, investigation and reporting.
A real environment teaches relationships that an isolated exercise cannot.
The paths are organised around responsibilities found across cyber security teams. Learners can build a focused route or combine paths to understand how attack, defence, governance and leadership affect one another.
Collect real telemetry, investigate suspicious activity and move from an alert to a documented response inside the lab you helped build.
Learn how attackers discover and move through systems, then convert each technique into evidence that defenders can detect and address.
Turn technical evidence into priorities, decisions, operational plans and clear communication for teams and stakeholders.
Connect policies and controls to the systems, identities, logs and review evidence that show whether a requirement is working.
The lab connects network segmentation, Windows and Linux systems, identity, business applications, security tooling and controlled attack activity. Learners see where evidence originates and how it moves.
Prepare compatible hardware, install VMware ESXi and configure pfSense or OPNsense, VLANs, routing, DNS and DHCP.
Build Active Directory Domain Services, create DNS and Group Policy, join endpoints and manage the environment as a connected estate.
Connect an HR data source to identity provisioning, role-based access, SSO, MFA and access review workflows.
Add realistic services such as file sharing, team chat, DevOps tooling and managed Windows or Linux workloads.
Collect Windows events, Defender activity, firewall records, Linux audit data and application logs into Splunk, Wazuh or Security Onion.
Run controlled tests, investigate the resulting evidence, contain the scenario and document the improvements that follow.
One-to-one and small group sessions let the instructor observe how a learner approaches a problem, not only whether the final answer is correct. Misconfigurations become teaching material. Investigation notes receive feedback. Decisions must be explained.
Read how Hacktivity1 teachesWe will start with what you want to be able to do, assess the practical gap and discuss a training path that makes sense.