68 skills. Learn the ones that open the most doors first.

Automating test cases and calling model APIs is daily work.

Most corporate networks are Windows domains.

Multi-step work needs clear control flow and stopping conditions.

Organisations now need policies for how AI is used and tested.

Picking the right model for the task controls cost and latency.

Automated checks turn source changes into controlled releases.

Managers and customers act on your summary, not your screenshots.

You cannot investigate what was never logged.

Senior roles are judged on design decisions, not tickets closed.

Phishing, malware and credential abuse make up most of an analyst's queue.

Real applications need data persistence and service-to-service communication.

Reproducible, non-root, scanned images reduce supply-chain and runtime risk.

Acting in the right order preserves evidence and stops spread.

Long tasks fail when context is managed badly.

Leaked context is often the finding with the biggest business impact.

Turning attacker behaviour into alerts is a core deliverable.

The most common and most damaging LLM vulnerability class.

Images are the deployable unit used by modern delivery platforms.

Checking model output is the skill that separates production use from demos.

A fix without a test comes back in the next release.

Audits pass or fail on evidence.

Infrastructure and delivery changes need reviewable history.

Every LLM feature is reached through an API; most real breaches start with auth mistakes.

Consequential actions need approval gates that attackers cannot talk their way past.

Identity is the primary cloud perimeter; most incidents involve over-broad access.

The first hour of a credential leak decides the damage.

Catching a misconfiguration in review is far cheaper than in production.

The frameworks customers ask about most.

Probes, resources, RBAC and network policy keep failures contained.

Deployments and Services are the daily primitives of container platforms.

Limiting what a tool can do caps the damage of any injection that succeeds.

Most cloud compute is Linux; investigation happens at the shell.

Most tooling and targets are Linux.

Cloud servers, containers and CI runners all depend on Linux.

Evidence lives in authentication, endpoint and network logs.

Well-designed tools make agents both more capable and safer.

Every integration starts here.

Enumeration is reading what a network exposes.

Every alert is about a host, a user or a connection.

Preventive controls stop mistakes no individual review would catch.

The reference list clients and auditors ask you to test against.

The shared vocabulary for application risk that security reviews are written in.

Policies are the organisation's rules, and you draft them.

Initial access rarely matters without escalation.

Production budgets depend on it.

Clear instructions, context and examples drive most quality gains.

Injection is an attack on instructions; you need to know how instructions are layered.

Security at cloud scale is automated or it does not happen.

Most successful tests are won in enumeration.

The report is the product the client pays for.

Boards fund what they understand.

Retrieved documents are an indirect injection path most teams overlook.

Everything in GRC starts from likelihood and impact.

Staying in scope is a legal requirement, not a courtesy.

You map controls to risks and prove they work.

Confidentiality, integrity and availability frame how you judge severity.

Senior roles own the roadmap, not just the checklist.

Small, safe scripts remove repeated manual work.

Searching logs quickly is the analyst's core tool.

Public buckets and unencrypted data remain common breach causes.

Network controls and most detections are reasoned about at this layer.

Vendors are a leading source of breaches.

Knowing attacker techniques shortens investigations.

Tools connect the model to your systems and data.

Tools turn a text bug into a real action like sending email or reading files.

Correct prioritisation is what a SOC is measured on.

Segmentation limits how far an attacker moves.

Web apps are the most common test scope.