Vibe Engines is free, interactive AI engineering & system design — runs in your browser. Pick a learning path →
18 stations. 3 tracks. From the security mindset and cryptography to threat modeling, cloud and detection, then DevSecOps, zero trust and securing AI — become the engineer who breaks and defends systems.
18 stations on 3 ladders, in order — each rung is written assuming the one above it. Mark them off as you go; your progress is saved in this browser.
6 rungs · ~6h · ends at Secure Coding.
F1 · Beginner · 40 min
Security is a way of thinking before it is a toolset: assume breach, distrust input, and ask "how would I abuse this?" of everything. Learn the CIA triad (confidentiality, integrity, availability), the principle of least privilege, defense in depth, and why the attacker only has to be right once while you have to be right always.
Build itTake a login form and list ten ways to abuse it. Which are your problem to defend, and which belong to the platform?
✓ CheckpointTake a feature you built and answer “how would I abuse this?” — if nothing comes to mind, you have not looked at it as an attacker yet.
F2 · Beginner · 55 min
You cannot secure what you do not understand. Learn how packets, TCP/IP, DNS and TLS actually move data, what a request really contains, and where trust boundaries sit — because most attacks live at the seams between systems that each assumed the other was safe.
Build itTrace an HTTPS request end to end: DNS, handshake, headers, response. Where could a man-in-the-middle sit, and what stops them?
✓ CheckpointExplain what TLS actually proves about the other end, and what it does not prove about the content.
F3 · Intermediate · 60 min
Crypto is the load-bearing wall of security, and misusing it is worse than skipping it. Learn symmetric vs asymmetric encryption, hashing vs encryption vs encoding, digital signatures, and the golden rule that saves careers: never roll your own crypto — use vetted libraries correctly.
Build itA junior stores passwords with SHA-256. Explain why that is still wrong, and what salted, slow hashing (bcrypt/argon2) fixes.
✓ CheckpointState the difference between hashing, encryption and encoding, and name which one base64 is — the answer trips people up in interviews for a reason.
F4 · Intermediate · 55 min
Most breaches are authentication and authorization failures, not exotic exploits. Learn the difference (authn = who you are, authz = what you may do), how sessions and tokens work, OAuth2 and OIDC flows, MFA, and why "confused deputy" bugs let one component act with another’s power.
Build itDesign the permission check for an API where users may read any profile but edit only their own. Where do most teams get this wrong?
✓ CheckpointExplain why a JWT in localStorage and a session cookie fail differently under XSS.
F5 · Intermediate · 65 min
The OWASP Top 10 is where security engineering meets the keyboard. Learn injection (SQL, command), cross-site scripting, CSRF, SSRF and insecure deserialization — how each works, how to find it, and the input-validation and output-encoding disciplines that shut whole classes of bug.
Build itA search box builds SQL by string concatenation. Show the injection, then the parameterized-query fix — and why validation alone is not enough.
✓ CheckpointExplain why escaping output stops XSS while validating input alone does not.
F6 · Intermediate · 55 min
Security is a property you build in, not bolt on. Learn to handle secrets (never in code or logs), manage dependencies and their vulnerabilities, fail closed, and read code adversarially — the everyday habits that keep vulnerabilities out of the codebase in the first place.
Build itReview a snippet that logs a full request for debugging. What sensitive data just leaked into your log pipeline forever?
✓ CheckpointExplain why a secret in an environment variable is better than one in the image and still not good enough.
6 rungs · ~6h · ends at Incident Response.
T1 · Intermediate · 60 min
Before you defend, decide what you are defending against. Learn structured threat modeling (STRIDE, attack trees, data-flow diagrams): enumerate assets, entry points and adversaries, then prioritize by likelihood × impact so effort lands where the real risk is, not where the fear is.
Build itThreat-model a file-upload feature. List the threats by STRIDE category and pick the two you would fix first, with reasons.
✓ CheckpointRun STRIDE over one data flow you own and name the entry point you had not previously thought of as one.
T2 · Advanced · 65 min
You defend better once you have attacked. Learn the penetration-testing workflow — recon, scanning, exploitation, privilege escalation, reporting — the core tooling, and the discipline that separates a professional from a criminal: scope, authorization, and a written rules-of-engagement.
Build itYou are asked to "test our staging site". Write the three questions that must be answered before you touch a single request.
✓ CheckpointExplain why a scan result is not a finding until you have shown impact.
T3 · Advanced · 65 min
The perimeter dissolved into the cloud, and misconfiguration is now the #1 breach cause. Learn the shared-responsibility model, IAM done right (roles over keys), network controls (VPCs, security groups), secrets and KMS, and why one public S3 bucket has ended more companies than any zero-day.
Build itAn engineer makes a bucket public "just to test". Walk the blast radius, then design the guardrail that makes it impossible by policy.
✓ CheckpointDraw the shared responsibility line for a managed service you use, and name what you wrongly assumed the provider handles.
T4 · Advanced · 60 min
Containers and orchestration added power and a new attack surface. Learn image scanning and minimal bases, the difference between a container boundary and a VM boundary, Kubernetes RBAC and pod security, and how a compromised container tries — and should fail — to escape to the host.
Build itA pod runs as root with the Docker socket mounted. Explain the escape path to the node, then the three fixes that close it.
✓ CheckpointExplain why a container is not a security boundary in the way a VM is, and what that means for untrusted workloads.
T5 · Advanced · 60 min
Prevention fails; detection is how you find out before the headline does. Learn logging that means something, SIEM and detection rules, the signal-vs-noise problem, and detection engineering: writing and tuning the alerts that catch real attacks without burying the team in false positives.
Build itWrite the detection logic for "credential stuffing" against a login endpoint. What is the true signal, and how do you avoid paging on a Monday-morning login spike?
✓ CheckpointExplain the cost of tuning a detection for recall over precision, and who absorbs it.
T6 · Advanced · 55 min
When — not if — something gets through, calm process beats panic. Learn the IR lifecycle (prepare, detect, contain, eradicate, recover, learn), evidence handling and forensics basics, and the blameless post-mortem that turns a bad day into a stronger system instead of a fired scapegoat.
Build itA server is confirmed compromised at 2am. List your first five actions in order — and justify why "pull it off the network" comes before "wipe it".
✓ CheckpointExplain why containment can tip off an attacker, and how that changes what you do first.
6 rungs · ~6h · ends at The Security Career.
P1 · Advanced · 55 min
Security that lives outside the pipeline gets skipped. Learn to shift security left: SAST/DAST and dependency scanning in CI, security as a merge gate, infrastructure-as-code scanning, and the cultural shift from "the team that says no" to the team that makes the secure path the easy path.
Build itDesign the CI gate that blocks a merge introducing a critical CVE — without grinding every build to a halt on low-severity noise.
✓ CheckpointExplain why a security gate that blocks every build gets switched off, and what a paved road offers instead.
P2 · Advanced · 55 min
The castle-and-moat model died; nothing inside the network is trusted anymore. Learn zero-trust architecture (verify every request, per-identity), micro-segmentation, mTLS between services, and why "on the corporate network" stopped being a meaningful security statement.
Build itRedesign access to an internal admin tool under zero trust. What replaces "it is only reachable on the VPN" as the control?
✓ CheckpointExplain what zero trust removes, and why “inside the network” stops being a permission.
P3 · Advanced · 55 min
One reviewer cannot secure a thousand engineers. Learn to scale AppSec: security champions embedded in teams, paved-road secure defaults and libraries, bug-bounty programs, and measuring security posture so you can show risk going down instead of asserting it.
Build itYour team of three secures 300 engineers. Design the leverage: what do you automate, delegate, and make impossible-by-default?
✓ CheckpointExplain why secure defaults beat security training as a scaling strategy.
P4 · Advanced · 65 min
AI applications broke the old rule that data and instructions are separate. Learn prompt injection (direct and indirect), the lethal trifecta, why filters cannot fully solve it, PII through model pipelines, and the model and MCP supply-chain risks that make securing AI its own discipline.
Build itAn agent reads web pages and can send email. Show the injection attack, then the architectural controls that make a hijack harmless.
✓ CheckpointName the three conditions of the lethal trifecta and say which you can most cheaply remove from a system you run.
P5 · Intermediate · 50 min
Security engineers who speak compliance get budget and buy-in. Learn the frameworks (SOC 2, ISO 27001, GDPR, HIPAA) at working depth, how audits actually work, risk registers, and how to translate a technical vulnerability into the business-risk language executives fund.
Build itTurn "we have no MFA on admin accounts" into a one-paragraph risk statement a CFO will approve budget to fix.
✓ CheckpointExplain the difference between being compliant and being secure, and name something in each that is not in the other.
P6 · Intermediate · 45 min
Security is a field of specializations and a mindset that never stops. Learn the branches (AppSec, cloud, offensive, detection, GRC, AI security), the certifications worth having versus the hype, how to keep current as attacks evolve, and how to grow from doing security to leading it.
Build itMap your next six months: one foundational skill, one offensive skill, one frontier skill — and the lab or CTF that proves each.
✓ CheckpointName which security specialism your last six months resembled, and whether that is the one you want.
The common questions before you start — how long it takes, whether to follow it in order, and how it stays current.
It runs 18 stations across 3 tracks — roughly ~17h of focused learning, plus the time you spend actually building. It is self-paced, so most people work through it over a few weeks, an evening or a single station at a time.
The tracks are ordered so each station builds on the one before, and following them start to finish is the intended path. But every station also stands alone — if you already have the foundations, jump straight to the part you need.
Yes. The whole roadmap, and every handbook, lab, and challenge it links to, is free and open — no sign-up and no paywall.
It teaches the durable fundamentals of the role first, then the tooling and the AI-era shifts on top — so most of it stays relevant as individual tools churn, and it is revised as the role itself changes.
Anyone stepping into or leveling up in the Security Engineer role — whether you are switching in, early-career, or a senior filling gaps. Start where you are; the ladder shows what is left.
See this alongside everything else on the same subject — handbooks, system designs, challenges and tools, in one place.