The whole field on one page, for someone who can program but has never worked in security. It starts with the building blocks the industry assumes you already know, then walks through how attacks unfold, where they happen, what defends against them, who does the work, and who the adversaries are.
This is the map; the codex is the territory. Words with a dotted underline show a short definition when you hover, focus or tap them.
This page — zoom out
The general picture: how the field is organized, what every tool category does, who the players are. Read it once end to end, then come back to it as a reference.
The codex — zoom in
Thirty real intrusions from 2014 to 2025, each a self-contained short course: concepts first, then the attack step by step with the attacker's reasoning, then the defense with the defender's reasoning.
01
Foundations — the twelve building blocks
Security conversations assume a mental model of computers, networks, and identity that most application developers never needed. These twelve cards supply it. Each ends with a for a programmer analogy and the terms you will hear.
02
Anatomy of a breach — the attack lifecycle
Almost every intrusion follows the same arc, whether it takes an hour or a year. Here it is first as a plain story, then as the fifteen named stages (tactics) used by MITRE ATT&CK, the field’s shared public catalog of attacker behavior. The tactic names are the spine every card, rule, and report in this library hangs on.
The story, in plain language
A typical human-operated intrusion of a company, told once. Most codex cards are a variation on this; a few (a request flood, a deepfake call, an insider) never need the middle steps.
Before
The attacker picks a target and learns about it from the outside: employee names on LinkedIn, the VPN product on the login page, leaked passwords from old breaches. They rent servers and register look-alike domains to work from.
Getting in
They find one door: a phishing email that steals a password, a password reused from a leak, a bug in an internet-facing app, or a vendor whose software everyone installs. They only need one; the defender must guard them all. In the 2026 Verizon breach report the exploited bug overtook the stolen password as the most common door (see Numbers below).
Settling in
Once code runs on one machine, they make sure they can come back after a reboot, and open a quiet channel home so they can control the machine remotely. This channel is called command and control (C2). The malware that phones home is a "beacon" or "implant".
Looking around
They map the inside: which machines exist, who the admins are, where the data is, what the security tools are. Mostly using the operating system's own built-in commands, so nothing looks foreign. This is called "living off the land".
Climbing
They steal more credentials (from memory, from files, from the directory that holds every account) and use them to become an administrator, then to hop from machine to machine. In most companies the goal is "domain admin": control of the central directory, which means control of everything.
Cashing out
They gather the data that matters, copy it out, and then either sell it, extort with it, encrypt everything for ransom, or, for spies, just keep quietly reading. Ransomware crews now steal first and encrypt second, so a backup alone no longer ends the leverage.
Meanwhile
Almost every one of those steps leaves traces: a login event, a new process, a DNS lookup, a file written, a cloud API call. The defender's whole job is to collect those traces (telemetry), notice the abnormal ones (detection), understand what happened (investigation), and stop it (response). The rest of this page is about that job.
The fifteen tactics, and what each looks like in the logs
A tactic is the attacker's goal at a stage (the "why"). A technique is a specific method for achieving it (the "how"), numbered Txxxx. ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a free public catalog, built from published incident reports and maintained by the US non-profit MITRE, of a few hundred techniques organized under these fifteen tactics (ATT&CK v19, 2026). Tactic IDs look like TA0001; a technique can have sub-techniques, written T1558.003. You do not need to memorize techniques; you do need to be able to place any story on this spine.
03
Attack surfaces — where attacks happen
An attack surface is everything an attacker can touch. The industry carves it into these areas, and most products, teams, and job titles are organized around one of them. Each card names the typical way in, who defends it, and which codex cases show it in action.
The pattern across surfaces
Notice the same three root causes recur everywhere: a credential that should not have worked (no MFA, reused, leaked, over-privileged), a bug in something exposed to the internet (unpatched or zero-day), and trust extended too far (a vendor, a help desk, an insider, a build pipeline). Most of the defensive stack exists to shrink one of those three. Their ranking shifts from year to year: in the 2026 Verizon breach report (see Numbers) the exploited bug, at about 31% of breaches, overtook the stolen credential, at about 13%, as the most common way in, although credentials still appear somewhere in about 39% of breaches.
04
The defensive stack — what every product category actually does
These acronyms are most of what makes a room of security people sound like another language. For each: what it is, the problem it solves, the data it looks at, what an alert from it looks like, where it fails, and a vendor or two so the names ring a bell. Vendors are illustrative, not endorsements, and categories blur as products expand.
See it move · the stack as one machine
Prevent, sense, decide, act
Telemetry never stops flowing into the SIEM. One attack gets past the preventive controls and is followed all the way to containment.
The steady stream is the point: detection works on the flow of ordinary events, and the attack is one event in it. On a phone this figure scrolls sideways.
How to think about the stack
Sensors (EDR, NDR, cloud audit logs, identity logs, WAF) produce telemetry. The SIEM collects it and runs detection rules. SOAR automates what happens when a rule fires. Most of the rest is either a preventive control that stops a class of attack outright (MFA, patching, allowlisting, IMDSv2, and segmentation: splitting the network so that a compromised machine can reach only the few systems it needs) or a posture tool that helps you find the weak spots (unpatched software, unsafe settings, forgotten hosts) before an attacker does (CSPM, SSPM, vulnerability scanning, attack-surface management). The remainder either feeds the sensors and the SIEM (threat intel, deception) or tests the whole stack on purpose (BAS, adversary emulation).
No product covers the whole lifecycle. Defense in depth means an attacker who slips past one layer still has to get past the next, and each layer they touch is another chance to notice them.
05
The disciplines and the people
Tools do not defend anything; people using them do. "Security researcher" is really a dozen distinct crafts. Blue defends, red attacks with permission, purple is the two working together. Each card includes what a typical day looks like, so you can picture the job rather than the title.
How the teams are organized
A large company runs a Security Operations Center (SOC): a 24/7 team watching the alert queue. Tier 1 analysts triage (is this real?), Tier 2 investigate (what happened?), Tier 3 hunt and handle incidents. Many companies outsource this to an MSSP (managed security service provider) or buy MDR (managed detection and response) from an EDR vendor or a specialist provider, who watches their endpoints for them. Above the SOC sit detection engineering, threat intelligence, incident response, and, at the top, the CISO (chief information security officer), who owns risk and briefs the board.
Where a developer fits: application security (reviewing and hardening code, running the scanners in CI), detection engineering (detections are code, with tests and version control), security engineering (building the pipelines, the tooling, the platform the SOC works in), and product security at vendors (building the EDR, the SIEM, the scanner itself). All four are places where writing software is the core skill and security is the domain.
06
The adversaries
Who is on the other side, what they want, how capable they are, and how the industry tracks them. Knowing the actor shapes the defense: you emulate the threat you actually face, and you prioritize the techniques that actor really uses.
The cybercrime economy — why it is an industry, not a hobby
Financially motivated crime is specialized and layered, like any market. Initial access brokers (IABs) break into companies and sell the foothold (a working VPN login, a web shell) on criminal forums, typically for a few hundred to a few thousand dollars. Infostealer operators infect consumer machines, harvest everything the browser has saved (passwords, session cookies, autofill data), and sell the results by the thousand, one "log" per infected machine. An employee’s or contractor’s personal PC is how corporate credentials end up in those logs (Snowflake #14). Ransomware-as-a-service (RaaS) crews (ALPHV, LockBit, Cl0p, and successors) build the ransomware, run the negotiation portal and the "leak site" where stolen data is published, and rent all of it to affiliates: independent criminals who do the intrusions and split the ransom, typically 70–80% to the affiliate. It is a franchise model, which is why taking down a brand rarely stops the people doing the intrusions; they move to the next brand. Money mules (people who receive and forward stolen funds through their own bank accounts) and crypto mixers (services that pool and shuffle cryptocurrency to break the trail) launder the proceeds. Bulletproof hosters rent servers that ignore abuse complaints.
This is why "who did it" is often several groups: an infostealer infected a contractor, a broker sold the credential, an affiliate used it, and a RaaS brand's name ended up on the ransom note. It is also why the defenses that hurt the economy (MFA everywhere, which devalues stolen passwords; revoking sessions, which kills stolen cookies; immutable backups, which cannot be altered or deleted even by an administrator and so remove the need for a decryption key; refusing to pay) matter more than blocking any single group.
How actors are named and tracked
Every vendor names groups differently, because each one sees only its own slice of the evidence (its own customers, its own sensors) and cannot be sure its cluster of activity is the same as a competitor’s. So one crew has many names. The group run by Russia’s SVR foreign-intelligence service is APT29 (Mandiant), Midnight Blizzard (Microsoft; weather themes in which the family name gives the origin: "Blizzard" = Russia, "Typhoon" = China, "Sandstorm" = Iran, "Sleet" = North Korea, "Tempest" = financially motivated crime), Cozy Bear (CrowdStrike; animals, "Bear" = Russia, "Panda" = China, "Kitten" = Iran, "Chollima" = North Korea, "Spider" = criminal), Nobelium (Microsoft's older name) and G0016 (MITRE ATT&CK’s group ID). Mandiant, now part of Google, numbered its groups: APT plus a number for state-backed espionage groups, FIN plus a number for financially motivated ones, and UNC ("uncategorized") plus a number (UNC5221, UNC5537) for a cluster of activity not yet tied to a known group. In July 2026 Google Threat Intelligence Group replaced the APT and FIN numbers with two-word names whose second word gives the category ("Relic" = Russia, "Castle" = China, "Ion" = Iran, "Neptune" = North Korea, "Comet" = cybercrime), so APT29 is now also ICE RELIC. UNC numbers remain for clusters still under investigation, and the old names stay searchable, so you will keep meeting APT29 in older reports and throughout this library. Vendors publish cross-reference tables; Microsoft and CrowdStrike began a joint mapping in 2025.
Attribution (working out who is behind an intrusion) clusters on TTPs (tactics, techniques, procedures: the actor's habits) more than on IOCs (indicators of compromise: specific hashes, IPs, domains), because habits are expensive to change. David Bianco's Pyramid of Pain makes this explicit: hash values are trivial for an attacker to change, IPs easy, domains simple, network and host artifacts (the traces a tool leaves by default, such as the named pipes it creates) annoying, tools challenging, and TTPs at the top are tough. That is the whole argument for behavior-based detection over indicator matching, and the reason the detection rules in the codex cards are written the way they are.
See it move · the Pyramid of Pain
An attacker changes one indicator at each level
The longer the change takes, the more it costs them, and only a rule on the behavior itself survives all of them.
David Bianco’s Pyramid of Pain, with one example from the codex at each level. A behavior rule can still be starved by pacing; that is what tuning and the decoy account in card 10 are for. The replacement values are invented, and the IP addresses are from ranges reserved for documentation. The bars rank the attacker’s time; they are not to scale.
07
The shared language — frameworks and standards
The reference systems everyone cites. Fluency in these is most of what lets you follow any security conversation or read any report. Each card says what it is for and when you will meet it.
08
Numbers that frame the field
A few figures from the industry's most-cited annual reports, to calibrate intuition. They shift each year; the sources are linked so you can refresh them. How to read them: the DBIR is Verizon’s annual Data Breach Investigations Report. Its 2026 edition analyzes more than 31,000 security incidents, of which over 22,000 were confirmed breaches (data actually disclosed to someone unauthorized), contributed by incident-response firms, insurers, and law-enforcement agencies; its percentages are shares of those breaches, and "began with" means the initial-access vector, the first way in. IBM’s figure comes from a yearly study of several hundred breached organizations and adds up detection, response, notification, and lost business. IC3 is the FBI’s Internet Crime Complaint Center; its totals are only what victims reported to it, so they are a floor, not an estimate.
How it all connects — the loop
None of these layers stands alone. They form one continuous cycle, and every part of this library covers a different stretch of it:
An attacker moves through the lifecycle across a surface; the defensive stack emits telemetry; a SOC or detection engineer turns telemetry into an alert, investigates, and responds; a red or purple team emulates the attack to find what was missed; the gap becomes the next detection. Round and round.
Where the rest of the library sits: this field map stands alone as the board. Everything else lives inside the codex’s thirty cases: each card is Attack and Respond from both chairs, and carries its own Detection rules. Two cards hold a full worked method: case 10 builds one detection end to end (stage 8, New detection, the blue loop: from a hypothesis and a telemetry check, through emulation, to a tuned, measured, documented rule), and case 12 runs Emulate → Find the gap (stages 6–7, the red loop).
Suggested reading tracks through the codex
Thirty cards is a lot to read in order. These tracks group them by the lesson they share, so you can follow one thread at a time. Cases appear in more than one track where they teach more than one thing.