Blue Team programmes

The first 26 classes are the same, deliberately – both teach you to operate the security stack and work a live alert queue. Specialist then adds four classes Analyst does not have: Security Investigations, an Advanced Threat Hunting Workshop, Breach Analysis, and Root Cause Analysis & Reporting. Those four are the difference between working the queue and owning the investigation – between a Tier 1 or 2 analyst and the Tier 3 specialist the hard cases are escalated to.

Yes, and plenty of people do. You pay only for the four specialist classes, at the Specialist rate – £180. The 26 shared classes are never charged twice. Tell us when you are ready and we schedule the four with the next group running them.

Match it to the job you want next. A first SOC role: Analyst is enough. Tier 3 and investigation work, or you already work a queue: Specialist. You build or run infrastructure and want to design security rather than operate it: Engineer. If you are unsure, book a fit call and we will tell you honestly – including if the answer is “not yet”.

For Analyst, no. It is the entry point and it is built for people with none – students, graduates and career changers from outside IT. You need comfort using a computer, a willingness to learn and about 20 hours a week; networking and cloud basics are taught in the first two classes. Specialist starts from the same beginning but works at depth and expects you to keep pace. Engineer assumes existing technical competence from class one.

Attend at least 80% of the classes, and pass every assignment your tutor sets, each handed in by the final class. The Specialist badge also needs both master assignments. The Engineer badge also needs the configuration pack from all three practice sessions and the build walkthrough. Everyone who completes the classes also receives a certificate of course completion, badge or not.

Yes. Analyst upgrades to Specialist by adding the four specialist classes, and you pay only for those. Engineer is a separate programme: it assumes technical competence rather than prior MyCyberWay study, and nothing in it repeats the other two.

Two to three classes a week, two hours each, scheduled around your job. Budget around 20 hours a week in total, including lab work and assignments. The programmes are built for people in full-time work, but they are not passive.

No, and be cautious of anyone who does. What is included is a rewritten CV, an optimised LinkedIn profile, mock interviews against real role specifications, Premium Jobs from joining your batch until three months after your final class, and a private job group. Outcomes depend on your effort, your background and the market – and we will be straight with you about all three.

A Microsoft Azure subscription and a Defender trial tenant – the free tiers are enough for the course – and a machine that comfortably runs a browser. We send setup guidance before the modules that need them. Your lab stays open for six months after the programme ends, so you can keep practising while you job hunt.

Give us a week’s notice before your next scheduled class and we pause the programme. You are charged for the classes delivered, pro rata at the per-class rate, and you can withdraw at any time. The full terms are in the course handout, which you receive before paying anything.

Your MyCyberWay account is created when you check out, and it is also your sign-in to the learning portal. Once we have agreed your start date and schedule and placed you in your batch, your classes and their Join on Teams links, recordings, labs, quizzes and calendar are all there.

Yes. If you are buying for a business, tell us and we will invoice your organisation. Business customers buy on our business terms (section 15 of our Terms and Conditions).