This is the full curriculum for the HackRange Mentorship. Each week has written lessons, a video recap, hands on lab work, and a quiz. Several weeks add a challenge, which is a longer exercise where you are given a goal and left to work out the path yourself.
The order matters. Nothing later in the program assumes knowledge you were not given earlier, and most of the later weeks reuse the lab you built in the earlier ones.
Week 1: Orientation and Networking Foundations
The week opens with the lab rules and the rules of engagement, because everything after this point involves tools that are illegal to point at the wrong target.
Then the networking core: how IP addresses work, subnetting explained in a way that actually sticks, and IPv6, which most people avoid until it breaks something. The week closes with reading a machine like a professional, which is the habit of walking up to an unfamiliar host and systematically working out what it is and what it does.
Week 2: DNS, Routing, and the Linux Firewall
DNS gets a full week's attention because so many attacks and so many outages run through it. You cover how a name becomes an address, the full zoo of record types, zone files, and running your own DNS server. Then you look at what goes wrong: cache poisoning, hijacking, tunneling, and the defenses for each.
The second half is Linux routing and the Linux firewall, covering both iptables and nftables. This is the foundation for every later conversation about firewalls and policy enforcement.
Week 3: Infrastructure Weaknesses and Identity
You point the question at a single machine: what is this thing exposing, and why. NFS gets picked apart as an example of a file share protocol that trusts far too much. SSH gets hardened properly.
Then identity, authorization, and least privilege, followed by the messy reality of sudo, service accounts, and permissions that outlived the person who needed them. The week ends with a challenge: audit a server you inherited, with no documentation and no one to ask.
Week 4: The CIS Critical Security Controls
The first framework week. You start with why frameworks exist at all, then work through the CIS Controls in three groups: Controls 1 through 6 for knowing what you have, 7 through 12 for keeping it healthy, and 13 through 18 for watching, training, and testing.
The challenge asks you to take the findings from your Week 3 server audit and map them to specific controls. That mapping is exactly what a real security team does to turn a pile of problems into a funded plan.
Week 5: GRC, Frameworks, and Audit Evidence
What governance, risk, and compliance actually is, the framework landscape including CMMC, and risk registers with numbers that are honest rather than convenient.
Then the part nobody teaches: audit evidence. You are handed messy data and asked to make it answer a specific question. There is a challenge quiz built around an auditor's report, plus supplemental videos showing how to do the same job in Excel and in Bash, so you can see both the office way and the shell way.
Week 6: Third Party Risk, Vulnerabilities, and Assets
Why your vendors are your problem, how to actually run a third party risk program, and a walk through the tooling landscape with a real assessment.
Then vulnerability management from scan to fixed, and asset management, which is the unglamorous foundation everything else sits on. You cannot patch, monitor, or protect a thing you do not know you own.
Week 7: Shadow SaaS and Shadow AI
Shadow IT is the set of systems nobody told you about. You learn to find shadow SaaS in your own logs, which is a genuinely satisfying exercise the first time a subscription nobody approved falls out of a DNS query log.
Then shadow AI, which is the same problem with sharper edges, and how to govern AI use without banning it and pushing it further underground. The challenge is a shadow IT hunt.
Week 8: The Blue Team and Getting Into Splunk
The blue team, detection and response, and how a SOC is actually staffed. Then the SIEM and the log sources that feed it, followed by your first real searches in Splunk.
The week closes with reading an intrusion: the specific traces attackers leave behind, and where to look for them.
Week 9: The Investigation, Operation Quiet Vendor
This is the week students remember. You are given a briefing and exactly one thread to pull. From there you work the pivots yourself, learn the rhythm of an investigation, and reconstruct the whole intrusion out of log data.
The debrief lays out the full kill chain so you can see what you found and what you walked past. Then you write the incident report, because an investigation nobody can read is an investigation that did not happen. That skill is covered in more depth in our incident response guide.
Week 10: Purple Team and Attack Simulation
Red and blue working together. You cover detection engineering, which is the discipline of turning what you learned in Week 9 into an alert that fires next time, then breach and attack simulation and autonomous pentesting.
The challenge is the honest version of this work: build your detections, then run the attack against them and find out whether they actually fired.
Week 11: GenAI to Operationalize Security
How AI is rewriting the rules, using it in the SOC for triage, summarizing, and response, and a source driven web application review done with AI assistance.
Then the part that matters most: trust but verify. Where these tools get it wrong, how confidently they get it wrong, and what checking their work looks like. See AI in the SOC for the full treatment.
Week 12: Cloud Security
Shared responsibility and the new attack surface, then cloud IAM, which is the real perimeter in a cloud account. Where data leaks: storage, secrets, and the instance metadata service.
Then seeing in the cloud, meaning logging, detection, and posture management, followed by containers and Kubernetes. The challenge is a full audit of a cloud account.
Week 13: Capstone and Your Career
The capstone is a tabletop exercise where you run an incident as a group. No terminal, no tools, just decisions under pressure with incomplete information, which is what the job actually feels like on a bad day.
Then the career material: certifications as a map rather than a destination, proof of work through a home lab and portfolio, and getting hired, including what the first 90 days really look like.
Learn This at HackRange
Every week has a lab and a quiz, and the whole thing is graded. You can see your progress, your score, and where you sit against your pod in the learning management system.