Roadmaps Security roadmaps Offensive security and assessment
Assess the identity backbone of enterprises under authorisation: Active Directory and Entra ID weaknesses, Kerberos, attack paths, and the hardening that closes them.
Estimated time: 12–24 months · At about 10 hours a week.
Offensive skills are for authorised testing only: your own lab, a practice platform, or a system whose owner has given you written permission. Testing anything else is a crime in most countries.
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
Domains, forests, trusts, objects, group policy and the role of domain controllers. You must understand AD deeply before you can assess it.
Kerberos and NTLM on-premises, SAML and OIDC in the cloud. Learn how tickets and tokens work, because the attacks abuse their design.
Stand up your own small domain to practise safely and legally. Deliberately vulnerable lab projects make this quick.
Cloud identity, conditional access, and the sync that joins on-premises AD to Entra ID. Hybrid trust is a rich source of attack paths.
Reading users, groups, permissions and trusts is the start of every assessment, and much of it uses normal, authorised queries.
Learn Microsoft's tiered administration and the enterprise access model first, so every weakness you find maps to a known hardening.
Tools such as BloodHound reveal chains from a normal account to high privilege. Learn to read them and, for defenders, to cut them.
Kerberoasting, AS-REP roasting and delegation abuse exploit how Kerberos works. Learn the concept, the detection and the configuration that prevents each.
Cached credentials, service accounts and secrets in scripts give attackers their next hop. Find them and remove them; prefer managed service accounts.
Misconfigured delegation and trusts let privileges cross boundaries. Learn how, and the settings that lock them down.
Excessive rights on objects create quiet paths to domain control. Learn to audit ACLs and apply least privilege.
For every attack, learn the logs and detections that catch it. An assessor who can also tell defenders how to see it is far more valuable.
The sync between on-premises AD and Entra ID, and federation, create paths in both directions. Learn them and the settings that contain them.
Conditional access gaps, consent abuse, over-privileged applications and risky roles. Assess the cloud directory and tighten it.
Understand how attackers try to keep access in a directory so you can detect and remove it. Study this firmly from the defender's side.
Tiering, privileged access workstations, LAPS, protected users, and reducing attack paths to near zero. This is the point of the whole roadmap.
Deliver an identity assessment that ranks attack paths by impact and gives a realistic hardening roadmap. Impact and fixes, not a list of tricks.
Work with defenders to simulate identity attacks safely and verify detections. This is the most constructive use of these skills.
Drive tiering, privileged access management and identity threat detection across a large estate. Identity is now the core of defence.
ITDR watches identity systems for attacks in progress. Design the detections and the response for your directory.
Identity research moves fast. Follow it, test findings in your lab, and disclose responsibly through proper channels.
Almost every corporate network runs on Active Directory or Entra ID, and almost every serious intrusion runs through it. Identity assessment finds the misconfigurations and weak trust relationships that let an attacker move from one account to domain-wide control, so defenders can close them.
This roadmap is a learning path for authorised assessment and, above all, for defence. It pairs every attack concept with its hardening, uses purpose-built lab environments, and expects you to test only directories you own or are explicitly engaged to assess. The goal is a more defensible identity layer.
Identity is the number one battleground in enterprise security. Assessors who can map attack paths and, crucially, explain how to harden them are essential to both red and blue teams and to every incident responder.
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
A common progression. Titles vary between companies.
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact