Course description

Would you like to understand how attackers think, so you can protect the systems you look after? This course is a defensive, plain-English introduction to ethical hacking for beginners. It explains the ideas, the phases of an attack and the defences that stop them, with the law and written permission at the centre of everything.

You start with the Computer Misuse Act 1990, written authorisation and scope, because ethical hacking is only ethical when it's authorised. Then you learn how attacks unfold, build a safe, isolated home lab on a computer you own, and learn the networking basics every defender needs. The middle of the course covers public information, vulnerabilities and patching, web application risks in concept, passwords and MFA, social engineering and phishing, and wireless security. Later sections cover malware, logging and detection, incident response, rating risk and writing findings and reports that lead to real fixes.

There are 10 sections and 50 written lessons. Each lesson has a worked example, common slips, questions people often ask and a short exercise to try, and each section ends with a short quiz. You follow Tiphaine, an IT support technician at a made-up catering supplies wholesaler in Shrewsbury, through an authorised security review of her own workplace, slips included. In the final lessons you write a short security review of a made-up garden centre, with full worked answers. Every section has a practice pack with exercise sheets, answer keys and cheat sheets, plus a glossary, a scope and authorisation template, a lab set-up checklist, a ports and protocols reference sheet, a vulnerability tracking spreadsheet, a phishing spotting worksheet with made-up emails, a report template and more.

What you'll learn

• Ethical hacking and the law: what makes hacking ethical, the Computer Misuse Act 1990 and why written permission matters, the kinds of security assessment, scope and rules of engagement, and thinking like an attacker to protect your systems.
• How attacks unfold: the phases of an attack in outline, reconnaissance and what defenders can see, scanning from the defender's side, how attackers gain and keep access, and why logs matter.
• Building a safe home lab: virtual machines and snapshots, isolated lab networks, a deliberately weak practice machine you build yourself, and lab notes, safety and clearing up.
• Networking basics for security: IP addresses, subnets and private ranges, ports and protocols, DNS, what a port scan reveals on your own lab, and firewalls and checking your own exposure.
• Open-source information and vulnerabilities: what public information reveals, reducing your organisation's footprint, CVE and CVSS in general terms, patching, and keeping a vulnerability tracking sheet.
• Web application risks: how web applications work, the OWASP Top 10 categories in concept, access control, logins and sessions, injection, misconfiguration and the supply chain.
• Passwords, people and wireless: why weak passwords fail, MFA and password managers, social engineering, phishing awareness and UK reporting routes, and wireless security basics.
• Malware, logging and detection: the main kinds of malware in concept, layered defences, what to log and why, spotting the attack phases in your logs, and simple detection habits for small teams.
• Incident response and reporting: incident response basics, containing, recovering and learning, rating risk with likelihood and impact, writing findings that lead to fixes, and the security assessment report.
• Careers and the final project: cyber security roles, learning paths and certifications in general terms, building a portfolio safely, and a final project: a short security review of a made-up garden centre, with worked answers.

Who it's for

Adults who are curious about a career in cyber security, and IT staff who want to understand how attackers think so they can defend their own systems better. No security experience is needed. You'll find it easier if you're comfortable using a computer and installing software. A home lab is optional, and every exercise can be done on paper.

What this course is, and isn't

This is a conceptual introduction for defenders. It contains no attack code, no password cracking and no instructions for attacking any real system. You only ever practise on computers you own, inside your own isolated lab, and you never check anybody else's system without their written permission. The course isn't a certificate course, doesn't award a qualification and isn't linked to any certification body. Official points come from legislation.gov.uk, GOV.UK, the NCSC, OWASP and the official CVSS page, read on 2 November 2026; they can change, so check before you rely on a detail. Tools are described by type, not by brand. Every organisation, person and finding in the examples is made up and labelled.

What will I learn?

• Explain what makes hacking ethical and why the Computer Misuse Act 1990 makes written permission essential
• Agree a scope, rules of engagement and a written authorisation before any security work begins
• Describe the phases of an attack in outline and the signs and defences at each phase
• Build a safe, isolated home lab with virtual machines on a computer you own
• Read IP addresses, ports, protocols and DNS records, and check your own exposure safely
• Review and reduce an organisation's public footprint, and track vulnerabilities from finding to fix
• Explain the OWASP Top 10 categories in concept and ask developers and suppliers good questions
• Strengthen passwords with MFA and password managers, and spot and report phishing and social engineering
• Plan logging, simple detection habits and a basic incident response for a small organisation
• Rate risk with likelihood and impact, write findings that lead to fixes and produce a short security report

Frequently asked questions