Program at a Glance

The class is 180 minutes: roughly two hours of lecture in three blocks, two short breaks, and a ~50-minute hands-on workshop. Times are targets, not handcuffs.

Run sheet

Time	Segment
0:00‑0:10	Framing — why this matters, the mental model, the roadmap
0:10‑0:50	Block 1 · Foundations — CIA triad, crypto, identity, networks, defense-in-depth
0:50‑1:00	☕ Break
1:00‑1:35	Block 2 · Threat Landscape — attack lifecycle, attack classes, 2026 frontier threats
1:35‑1:50	The Mythos Moment — when the attacker becomes an AI
1:50‑2:00	☕ Break
2:00‑2:20	Block 3 · The Autonomous SOC — defending at machine speed, Zero Trust, the new analyst role
2:20‑2:30	The Post-Mythos World — the new baseline + 5 things to remember
2:30‑3:00	Workshop · Trinetra — analyze a repo, triage findings, open a PR with fixes

Learning outcomes

By the end, a participant can:

1. Use core security vocabulary correctly (threat vs. vulnerability vs. risk; the CIA triad).
2. Explain how a modern intrusion unfolds using a kill-chain / ATT&CK lens.
3. Describe the Mythos development and articulate both the alarm and the credible “this was already happening” counter-narrative.
4. Explain what an Autonomous SOC is, why machine-speed attacks force it, and how the human role shifts to supervision.
5. Run an AI code-security analysis with Trinetra and open a defensible pull request with fixes.

What you need

• A laptop with a modern browser.
• A GitHub (or compatible) account and a sample repository you can open PRs against. A deliberately vulnerable demo repo works best — see the lab.
• A Trinetra account / access for the hands-on portion.

How the material is organized

• Lecture pages mirror the deck, with speaker-ready talking points.
• The deck itself runs in-browser from Run the Deck.
• The workshop pages are the participant-facing lab.
• Reference holds the glossary and every source cited in the talk.