Free Cybersecurity & AI Security Course with Certificate
Free cybersecurity course for beginners covering threats, phishing, passwords and identity, network and web security basics, secure development, AI security, prompt injection, data privacy, incident response and risk management. Flash cards, checkpoint quizzes and a verifiable certificate.
Security work protects confidentiality (only authorised people can see data), integrity (data is not altered improperly) and availability (systems work when needed). Every control trades against usability and cost, so decisions are about acceptable risk, not perfection. Naming which of the three is at stake clarifies most arguments about a control. Ransomware, for example, attacks availability and often confidentiality at once.
Name whether confidentiality, integrity or availability is at risk before choosing a control.
Take three systems you use and write which part of the triad matters most for each.
Every expert you admire learned it exactly this way — one scene at a time.
What you will be able to do
- Explain confidentiality, integrity and availability and apply them to real decisions
- Recognise phishing, social engineering and modern AI-assisted scams
- Set up strong authentication, password managers and phishing-resistant MFA
- Understand networks, firewalls, VPNs and encryption in plain language
- Identify common web application risks and how they are prevented
- Apply secure development and dependency hygiene
- Defend AI systems against prompt injection and data leakage
- Handle personal data lawfully and minimise exposure
- Run a basic incident response process without panic
- Assess risk and plan a cybersecurity career path
Course structure
Foundation — Threats, identity and everyday defence
What security protects, who attacks and why, and the personal controls that stop the majority of real-world incidents.
Advanced — Networks, web security and secure development
How systems are actually attacked and defended: network fundamentals, encryption, web application risks, secure coding practice and logging.
Mastery — AI security, privacy, incident response and careers
The frontier and the discipline: securing AI systems, prompt injection defence, privacy law, incident response, risk frameworks and getting hired.
Full syllabus — every topic covered
30 topic cards across three levels. Each card teaches one idea, ends with a takeaway, and is followed by a checkpoint quiz every five cards.
Level 1: Foundation — Threats, identity and everyday defence
What security protects, who attacks and why, and the personal controls that stop the majority of real-world incidents.
- 1. The CIA triad: what security actually protects — Name whether confidentiality, integrity or availability is at risk before choosing a control.
- 2. Threat actors and their motives — Defend against the likely attacker, not the most dramatic one.
- 3. Attack surface and the principle of least privilege — Fewer accounts, fewer permissions, smaller blast radius.
- 4. Phishing: how to recognise it — Verify unusual requests out-of-band; judge the request, not the writing quality.
- 5. Passwords, password managers and reuse — Unique long passwords in a manager; rotate on compromise, not on schedule.
- 6. Multi-factor authentication and which factors resist phishing — Prefer passkeys or hardware keys; never approve an MFA prompt you did not start.
- 7. Malware, ransomware and how infections start — Infections usually start with a click; tested backups decide the outcome.
- 8. Updates, patching and dependency risk — Patch promptly — known and unpatched is the most common way in.
- 9. Backups and the 3-2-1 rule — 3-2-1, with one copy offline, and test the restore.
- 10. Device and physical security — Encrypt, lock and be able to wipe every device you carry.
Level 2: Advanced — Networks, web security and secure development
How systems are actually attacked and defended: network fundamentals, encryption, web application risks, secure coding practice and logging.
- 1. Network fundamentals for defenders — Segment networks and default-deny inbound; know your normal traffic.
- 2. Encryption in transit and at rest — TLS in transit, encryption at rest, and guard the keys above all.
- 3. Identity: SSO, sessions and tokens — Tokens are credentials — expire, revoke and review them like passwords.
- 4. Web application risks and how they are prevented — Never trust client input; enforce authorisation on every server request.
- 5. Secure development habits — Threat model early, keep secrets out of code, scan dependencies continuously.
- 6. Supply chain and third-party risk — Inventory dependencies and vendors; least privilege applies to them too.
- 7. Logging, monitoring and detection — Log the security-relevant events, protect the logs, alert sparingly.
- 8. Social engineering beyond email — Use process, not judgement under pressure: verify by call-back and dual approval.
- 9. Cloud and configuration security — Cloud incidents come from your configuration, not the provider's hardware.
- 10. Vulnerability management as a routine — Prioritise by exposure and exploitability, then verify the fix.
Level 3: Mastery — AI security, privacy, incident response and careers
The frontier and the discipline: securing AI systems, prompt injection defence, privacy law, incident response, risk frameworks and getting hired.
- 1. What changes when you add AI to a product — Treat model output as untrusted input to everything downstream.
- 2. Prompt injection explained defensively — Prompt injection is an architecture problem, not a wording problem.
- 3. Designing safe AI tool access — Allow-list actions, confirm irreversible ones, never execute raw model output.
- 4. Data leakage through AI systems — Apply user permissions before retrieval, and control what data leaves the organisation.
- 5. AI-assisted social engineering and deepfakes — Authenticate the request through process, never by how convincing it sounds.
- 6. Privacy, data protection and lawful handling — Collect less, document why, and know your breach-notification clock.
- 7. Incident response: the six phases — Prepare in advance, contain early, review without blame.
- 8. Risk management and security frameworks — Mitigate, transfer, accept or avoid — and write down which you chose and why.
- 9. Security culture and awareness that works — Make the secure path the easy path and reward reporting.
- 10. Cybersecurity careers and how to start — Fundamentals plus legal hands-on practice plus clear writing gets the first role.
Frequently asked questions
- Is this cybersecurity course suitable for complete beginners?
- Yes. Foundation starts with what security actually protects and builds up in plain language. No prior IT, networking or coding experience is required.
- Does it teach hacking?
- No. The course is strictly defensive and educational. It explains how attacks work conceptually so you can recognise and prevent them, and it does not provide instructions or tooling for attacking systems.
- What is AI security and why is it here?
- AI systems introduce new failure modes — prompt injection, training and context data leakage, insecure plugin and tool access, and model-assisted social engineering. Anyone deploying AI features needs these defences alongside classic security.
- Will this prepare me for certifications?
- It covers much of the vocabulary and concept base tested in entry-level certifications and interviews. Use it as a structured foundation before formal exam preparation.
- How long does it take?
- About 9 hours across three levels — Foundation, Advanced and Mastery — at your own pace.
- What does the certificate include?
- Your name, the course, total duration, score, issue date, a unique verification ID and a QR code linking to a public verification page — shareable to LinkedIn in one click.