Know how attackers work.
Be ready first.

Curriculum

Twelve tracks take learners from white belt to black belt, including an AI chapter open to everyone (free) and a professional AI deep dive on human factors, failure modes, bias and noise.

1. 01

   Cyber security foundations

   The basics everyone needs first: what security protects, how it came to exist, why it is everyone's job, and how the pieces fit together — illustrated with real breaches.

   For: Everyone, including executives and non-technical staff

   AvailableIncluded in the free plan
2. 02

   The human element

   You are the weakest link — and the strongest control. Real social engineering, from Kevin Mitnick to today, and the everyday habits that put you in charge.

   For: Everyone, including executives and non-technical staff

   AvailableIncluded in the free plan
3. 03

   Threat landscape for Japan

   Who targets Japan, what they want, and what it looks like when it lands — espionage at the network edge, ransomware, and the fraud that reaches everyone — told through real Japanese cases, with the habits that stop them.

   For: Everyone, including executives and non-technical staff

   AvailableIncluded in the free plan
4. 04

   AI-powered attacks and agent-based hacking

   How AI is changing every stage of an attack: machine-written lures and deepfakes, autonomous AI agents that run intrusions end to end, AI that finds and exploits vulnerabilities in hours, malware that asks an AI for its next move, and attacks on the AI systems you deploy. Told through real 2024–2026 cases, with the defenses that still work at machine speed.

   For: Everyone: available on the free plan in a plain-language family edition, and in full technical depth on professional plans

   AvailableIncluded in the free plan
5. 05

   AI deep dive: the human mind, failure modes, bias and noise

   For security, risk and IT professionals who deploy or depend on AI. How models really work and where errors enter; how AI exploits human psychology and breeds dependence; why hallucinations happen and how to validate output; how bias is learned, amplified and normalized; how randomness, adversarial noise and poisoned data produce unexpected outcomes. Ends with a lab auditing an AI triage analyst.

   For: Security, risk, IT and data professionals; managers who approve AI use

   Available
6. 06

   Initial access defense

   Close the doors attackers use first: targeted email lures, mail spoofing, internet-facing VPNs and gateways, valid accounts on remote services, and the help desk — with the controls and detections that stop them.

   For: IT and security staff

   Available
7. 07

   Detection engineering

   Turn prevention's failures into alerts: the telemetry to collect, behaviour-based rules written as code in Sigma, and detections for VS Code tunnels, Windows Sandbox abuse, PowerShell and AI-agent activity.

   For: SOC analysts, detection engineers and IT security staff

   Available
8. 08

   Cloud defense: AWS, Azure and Google Cloud

   Defend the three major clouds where attacks actually happen, identity and configuration, and learn where AWS, Microsoft Azure and Google Cloud differ: privilege escalation, audit-log tampering, posture management, leaked-key response, Entra ID, Google Cloud service accounts and secure defaults, and cloud AI agents.

   For: Cloud, platform and security teams running AWS, Azure or Google Cloud

   Available
9. 09

   Social engineering and insider-style access

   Defend against attacks that abuse trust: fake recruiters and coding-test malware, stolen sessions that bypass MFA, tampered approvals through suppliers and signing interfaces, and fake employees built with stolen identities and AI.

   For: Security, IT, HR, finance and engineering leads

   Available
10. 10

    Software supply chain

    SBOMs, Sigstore signing and OpenSSF Scorecard in practice, plus the AI supply chain: models, skills, MCP servers and poisoned data.

    For: Developers, DevOps and platform teams, and the security staff who review their dependencies

    Available
11. 11

    Incident response and reporting

    Run an incident end to end in a Japanese context: triage and contain in the first 24 hours, preserve evidence, meet reporting duties to the PPC, police, NCO, regulators and customers, rehearse a supplier-borne intrusion, and respond at machine speed with guarded automation.

    For: Security leads, IT managers, legal, communications and executives

    Available
12. 12

    Daily CVE review

    Read the daily brief in five minutes and turn it into patch priorities.

    For: Everyone in IT

    AvailableIncluded in the free plan
13. 13

    Quantum and post-quantum encryption

    What quantum computers will and won't break, why data stolen today matters, the new NIST standards (ML-KEM, ML-DSA, SLH-DSA) and the 2030/2035 deadlines in the US, EU, UK and Japan, how to run a migration from inventory to crypto-agility, and how to tell QKD, hype and quantum scams apart.

    For: Security, IT and product engineers, architects, risk managers and leaders responsible for long-lived data or devices

    AvailableIncluded in the free plan
14. 14

    Everyday scams and manipulation

    Social engineering for profit: dark patterns and pressure selling, the fake-police, SNS investment and romance fraud behind Japan's record 2025 losses, crypto and Web3 scams, and the new phone, ID and platform rules that scammers are already copying. For staff who protect customers, and for businesses checking their own sites and sales scripts.

    For: Customer support, fraud, trust and safety, compliance and marketing staff; managers of consumer-facing businesses

    AvailableIncluded in the free plan
15. 15

    Network security and DDoS defense

    Design and defend networks at home and at work: segmentation and zero trust, secure remote access, DNS and egress control, network detection, and defending against DDoS attacks like those that hit Japanese airlines and banks in 2024–25.

    For: Everyone with a home network; network and IT staff

    Available
16. 16

    API security

    Secure the interfaces your apps, partners and AI agents call: inventory, authentication and object-level authorization, rate limits and abuse controls, gateways and testing, mapped to the OWASP API Security Top 10.

    For: Developers, architects and platform teams

    Available
17. 17

    Cryptography and key management

    Use cryptography correctly and keep keys safe: choosing algorithms, TLS and certificates, KMS and HSMs, secrets management, rotation and revocation, and preparing for post-quantum migration.

    For: Developers, cloud and security engineers

    Coming soon
18. 18

    Defending people, data, infrastructure and IoT

    Practical defence of what matters most: people and identities, data wherever it lives, servers and endpoints, and IoT and operational technology, from home cameras to factory controllers.

    For: Everyone; IT, facilities and OT staff

    Coming soon
19. 19

    Governance and vulnerability management

    Run security as a managed programme: governance frameworks and roles, risk management, the main types of vulnerabilities and how they arise, and a vulnerability-management process that prioritises by exploitation and exposure.

    For: Security managers, risk and compliance, IT leads

    Coming soon
20. 20

    Threat hunting, APT defense and stopping attacks in progress

    Assume you are already breached: hunt for activity that looks harmless, defend against APT tradecraft, use AI to search actively for intrusion rather than waiting for alerts, and contain attacks while they are still in progress.

    For: SOC, threat hunters, incident responders and security architects

    Coming soon
21. 21

    Top 100 threats field guide

    IDCC's own catalogue of the 100 threats most likely to reach Japanese people and organisations, mapped to MITRE ATT&CK, CWE, OWASP and CISA KEV, each with how to recognise it, detect it and stop it.

    For: Everyone; defenders use it as a reference

    Coming soon

IDCC certifications

Credentials that prove practical cybersecurity skills. Exam vouchers are on sale now. We'll contact voucher holders when online proctored exams open.

Annual Professional and Team Professional plans include one exam attempt a year

Pricing

All prices include consumption tax. Pay annually and get 2 months free. Cancel anytime.

Payments are processed securely by Square. Your card details never touch our servers.