Practical Ethical Hacking and Defensive Security Training
Build practical cybersecurity skills through 30 tutor-led sessions in DigiUK’s controlled Manchester laboratory. Every session is 90 minutes, giving you 45 hours of guided training in ethical hacking, vulnerability assessment, traffic analysis, web security, incident response and professional reporting.
This course starts at cybersecurity practice. It does not include the separate Network+ syllabus or the separate Kali Linux administration course. Learners should already understand networking and basic Linux, or complete those DigiUK foundation courses first.
Your Cyber Security Induction Is Free
Free Induction and Laboratory Tour
This free induction takes place before Session 1 and is separate from the 30 paid course sessions. Meet the tutor, see the isolated lab and experience the teaching method before making a financial commitment.
- Discuss your current networking and Linux knowledge
- See how practical exercises are controlled and recorded
- Review the 30-session syllabus and learning order
- Confirm that this is the correct starting course for you
- Ask about the current timetable
Flexible Course Payments
£30 per 90-minute session
- Four-session block: £120
- No long contract: Continue while the course remains right for you
- Small classes: Maximum of five learners
- Practical focus: More than 80% guided laboratory activity
Why Choose DigiUK Cyber Security Training?
Security skills grow through careful practice, not by memorising tool names. The tutor explains the purpose, demonstrates the method, supervises the lab and then helps each learner interpret the evidence and improve the result.
- More than 80% guided practical work
- Maximum five learners for individual support
- Exact tool syntax and argument explanations
- Realistic output and evidence interpretation
- Offensive techniques connected to defensive controls
- Authorisation, scope and stop conditions in every active lab
- Troubleshooting and safe recovery steps
- Professional findings, remediation and retesting
Experienced Instructor
Learn with guidance informed by more than 30 years of IT-industry experience, 21 years of networking and cybersecurity teaching, and a Master’s Degree in Software Engineering.
Practical, Not Exam-Cram Training
The syllabus covers knowledge areas found across respected professional pathways, but lessons focus on understanding, safe technical work and evidence—not memorising answers for one examination.
The Complete 30-Session Cyber Security Curriculum
The syllabus moves from safe assessment foundations to practical testing, defensive analysis and professional reporting. Each session lasts 90 minutes and combines explanation, tutor demonstration, supervised practice, evidence review and questions.
Stage One — Safety, Foundations and Reconnaissance · Sessions 1–5
Session 1 — Orientation, Authorisation and Laboratory Safety
Understand the course structure, approved targets, written permission, scope, rules of engagement, stop conditions, evidence folders, privacy, professional conduct and the legal boundary between authorised testing and unauthorised access.
Session 2 — Cybersecurity Fundamentals, Risk and Controls
Connect assets, data, systems and services to threats, vulnerabilities, likelihood, impact and controls. Apply confidentiality, integrity, availability, authentication, accountability and least privilege to realistic scenarios.
Session 3 — Ethical-Hacking Methodology and Test Planning
Follow a professional lifecycle from pre-engagement and scope through discovery, validation, evidence, risk explanation, reporting, remediation, retesting and closure. Learn why a tool result is not automatically a confirmed finding.
Session 4 — Passive Reconnaissance and OSINT
Collect approved public information without directly probing a target. Evaluate search results, public records, RDAP data, certificate information, metadata and source reliability while respecting privacy and engagement limits.
Session 5 — Active Reconnaissance and DNS Evidence
Move carefully from passive research to authorised interaction. Examine DNS records, name resolution, web responses and service clues, then record exactly what was observed, what it suggests and what remains unproven.
Stage Two — Discovery, Scanning, Enumeration and Vulnerabilities · Sessions 6–10
Session 6 — Host Discovery and Network Baselines
Identify approved live hosts using proportionate discovery methods. Compare ARP, ICMP and TCP-based observations, understand filtering and false negatives, and establish a baseline before deeper testing.
Session 7 — TCP and UDP Port Scanning with Nmap
Use Nmap safely inside the lab. Understand target expressions, port selection, scan types, timing choices and output formats, together with the meaning and limitations of open, closed, filtered and open|filtered results.
Session 8 — Service, Version and Operating-System Clues
Collect service banners, protocol responses, version information and operating-system indicators. Separate direct evidence from inference and verify important observations through more than one safe method.
Session 9 — Service Enumeration
Investigate approved SMB, DNS, SNMP, HTTP and other exposed services. Identify shares, names, capabilities and configuration clues without confusing accessible information with exploitable access.
Session 10 — Vulnerability Assessment and Manual Validation
Follow the vulnerability lifecycle from discovery to treatment. Understand CVE, CWE, CVSS and EPSS, scanner credentials, signatures, false positives, prioritisation, manual confirmation, remediation advice and retesting.
Stage Three — System, Password and Malware Security · Sessions 11–15
Session 11 — Password, Hash and Authentication Security
Understand online and offline password risks, hashing, salting, password policy, lockouts, multifactor authentication and credential storage. Use controlled lab examples to explain Hydra, John the Ripper and Hashcat without attacking public accounts.
Session 12 — Controlled System Validation with Metasploit
Understand modules, options, payload concepts, sessions and evidence. Validate only approved lab weaknesses, select the least disruptive method, capture proof carefully and stop when the agreed objective is reached.
Session 13 — Privilege Boundaries and Post-Access Evidence
Study users, groups, tokens, permissions, services and common privilege boundaries in Windows and Linux. Collect the minimum evidence needed to show impact without unnecessary changes or data access.
Session 14 — Persistence Concepts, Detection and Cleanup
Recognise common persistence locations and the evidence they leave. Focus on detection, containment, authorised validation, removal, restoration and proof that the laboratory system has returned to its expected state.
Session 15 — Malware and Virus Triage
Compare viruses, worms, trojans, ransomware and other malware. Examine hashes, strings, file metadata, behaviour clues, indicators of compromise and YARA concepts while following safe-analysis, isolation and recovery rules.
Stage Four — Network Defence, Human Risk and Sessions · Sessions 16–20
Session 16 — Packet Capture and Traffic Analysis
Use Wireshark, TShark and Tcpdump to capture approved traffic, apply capture and display filters, follow TCP streams, identify cleartext exposure, recognise retransmissions and preserve packet evidence with correct context.
Session 17 — Social Engineering and Phishing Defence
Study phishing, business-email compromise, impersonation, pretexting, deepfakes and human influence. Examine email headers and authentication controls, reporting routes, verification processes and ethical simulation limits.
Session 18 — Denial of Service and Resilience
Understand resource exhaustion, availability loss, distributed attacks, traffic baselines, rate controls, upstream protection, communication and recovery. No uncontrolled flooding is conducted during the course.
Session 19 — Session, Cookie and Token Security
Study session identifiers, cookies, fixation, replay, logout, timeout, CSRF and JWT risks. Connect technical weaknesses to secure attributes, rotation, expiry, invalidation, monitoring and incident evidence.
Session 20 — Firewalls, IDS/IPS and Honeypots
Understand stateful rules, segmentation, signatures, behaviour-based detection, Suricata, Zeek, alert validation, false positives, honeypots, change control and how defensive evidence supports an investigation.
Stage Five — Web, Application and Database Security · Sessions 21–25
Session 21 — Web Server and TLS Security
Inspect HTTP methods, response codes, headers, TLS, certificates, virtual hosts, default content, directory exposure, authentication, access logs and error logs across common Apache, Nginx and IIS scenarios.
Session 22 — Web Application Mapping and Proxy Workflows
Map pages, parameters, forms, APIs and trust boundaries. Use Burp Suite and OWASP ZAP to intercept authorised traffic, and use tools such as Gobuster and Nikto with controlled scope and appropriate request rates.
Session 23 — Access Control, Authentication and MFA
Assess identity flows, account recovery, authorisation checks, vertical and horizontal access control, MFA, passkeys, federation, lockout behaviour and useful authentication telemetry.
Session 24 — Common Web and API Vulnerabilities
Understand cross-site scripting, CSRF, path traversal, unsafe file upload, SSRF, insecure design, API risks and business-logic weaknesses. Connect each issue to validation, defensive coding, logging and retesting.
Session 25 — SQL Injection and Database Protection
Study error-based, union-based, boolean-based and time-based SQL injection concepts. Use controlled manual checks and SQLMap only in the lab, then apply parameterised queries, least privilege, safe error handling and monitoring.
Stage Six — Wireless, Cryptography, Modern Systems and Capstone · Sessions 26–30
Session 26 — Wireless Security
Understand 802.11 operation, WPA2, WPA3, protected management frames, enterprise authentication, WPS risks, guest isolation, rogue access points and defensive analysis using approved or supplied captures.
Session 27 — Cryptography, PKI and TLS
Compare encryption, hashing, MACs and digital signatures. Understand certificates, trust chains, key storage, password hashing, TLS negotiation, common implementation failures and the need for post-quantum planning.
Session 28 — Cloud, Mobile, IoT, OT and AI Security
Apply shared responsibility, identity, secrets, logging and configuration principles to cloud platforms; permissions and APIs to mobile systems; firmware and protocols to IoT; safety-first thinking to OT; and human verification to AI-assisted security work.
Session 29 — Incident Response, Evidence and Professional Reporting
Build a timeline, preserve source and time context, separate fact from conclusion, assess impact, recommend practical controls and write clear findings. Use structured preparation, detection, response and recovery principles.
Session 30 — Integrated Practical Capstone and Retest
Complete an authorised assessment from scope through discovery, validation and reporting. Present the evidence, explain limitations, recommend remediation, retest the agreed changes, clean the lab and complete a professional handover.
Cyber Security Laboratory and Tools
Active exercises take place only inside DigiUK’s isolated training environment or another system covered by clear written authorisation. The Kali workstation is used to run security tools; the separate Kali course teaches how to administer the operating system itself.
Authorised security-testing and analysis workstation
View the security tools and command-teaching method
| Learning purpose | Example tools | How they are taught |
|---|---|---|
| Reconnaissance and discovery | dig, host, curl, Nmap and approved OSINT sources | Purpose, scope, exact options, output fields, limitations and evidence. |
| Traffic analysis | Wireshark, TShark and Tcpdump | Capture location, filters, streams, timestamps, protocol fields and safe storage. |
| Vulnerability assessment | Approved scanners, CVE/CWE/CVSS/EPSS sources and manual checks | Scanner setup, false positives, validation, priority, remediation and retest. |
| System validation | Metasploit Framework and native Windows/Linux evidence | Module purpose, required options, least-disruptive validation and cleanup. |
| Web and API security | Burp Suite, OWASP ZAP, Gobuster, Nikto and SQLMap | Proxy workflow, request meaning, rate control, validation and defensive correction. |
| Password security | Hydra, John the Ripper and Hashcat in controlled exercises | Online/offline distinction, formats, limits, policy, MFA and secure storage. |
| Detection and evidence | Suricata, Zeek, logs, packet evidence and checksums | Alert context, false positives, timelines, integrity and defensible conclusions. |
| Teaching element | Explanation | Learner evidence |
|---|---|---|
| Purpose | What the command or tool does and why it fits the approved task. | Objective, target and scope. |
| Exact syntax | The complete example and the meaning of every option and argument used. | The command exactly as performed. |
| Expected result | Important output fields, normal variations and common errors. | Relevant output or screenshot. |
| Interpretation | What the result proves, what it may suggest and what it cannot prove. | A short evidence-based conclusion. |
| Troubleshooting | Permissions, connectivity, syntax, target state and safe correction steps. | Error, diagnosis and verified correction. |
| Closure | Stop tools, save evidence, restore changes and confirm the final lab state. | Evidence index and cleanup record. |
The Practical Method Used Throughout the Course
Professional Knowledge and Framework Coverage
The course has been independently compared with selected learning areas from recognised certifications and security guidance. This helps learners connect practical work to wider professional language; it does not create accreditation, endorsement or certification equivalence.
- CEH
- Security+
- ISC2 CC
- CySA+
- CISSP
- CISM
- CISA
- PEN-200 / OSCP+
- OWASP
- MITRE ATT&CK
- NIST
- UK NCSC
View the complete independent coverage matrix
| Reference | Relevant course coverage | Meaning of the comparison |
|---|---|---|
| CEH | Methodology, reconnaissance, scanning, enumeration, vulnerabilities, system security, malware, social engineering, web and wireless security. | Broad related subject coverage; this is not official EC-Council training or a CEH examination. |
| CompTIA Security+ | Threats, vulnerabilities, architecture, identity, network protection, security operations, incident response, governance and risk. | Relevant knowledge areas support wider development without replacing official CompTIA materials. |
| ISC2 Certified in Cybersecurity (CC) | Security principles, access control, network security, operations, incident response and continuity awareness. | Foundation concepts are connected to practical exercises; no ISC2 award is issued. |
| CompTIA CySA+ | Vulnerability management, evidence analysis, monitoring, detection, investigation and response. | Selected analyst activities appear within the wider ethical-hacking course. |
| ISC2 CISSP | Risk, assets, architecture, network security, identity, assessment, operations and software-security principles. | Professional context is introduced; CISSP experience requirements and official preparation are not replaced. |
| ISACA CISM | Governance, risk, security-programme and incident-management awareness. | Management context helps learners explain why a technical control matters to an organisation. |
| ISACA CISA | Audit evidence, control evaluation, operational resilience and information-asset protection. | Audit thinking strengthens traceability and reporting; this is not official CISA training. |
| OffSec PEN-200 / OSCP+ | Practical enumeration, evidence-led validation, privilege-boundary analysis, troubleshooting and reporting habits. | Related working practices are developed in DigiUK’s lab; it is not an OffSec course or OSCP examination lab. |
| OWASP | OWASP Top 10:2025, web testing, API security, authentication, sessions, access control, injection and generative-AI application risks. | Current OWASP awareness and testing guidance supports repeatable application-security work. |
| MITRE ATT&CK | Enterprise, Mobile and ICS behaviour mapping, evidence sources, detection opportunities and defensive controls. | ATT&CK provides a shared language for connecting observed behaviour to defensive action. |
| NIST | Cybersecurity Framework 2.0, SP 800-61 Rev. 3 incident-response principles, technical testing and AI risk management. | NIST guidance supports structured governance, testing, response and recovery decisions. |
| UK NCSC | Authorised testing, commissioning, scope, safe delivery, limitations, communication and reporting. | UK guidance supports responsible professional practice and recognises that testing is one part of wider assurance. |
Cyber Security Course Learning Outcomes
Develop practical skills in authorised assessment, ethical hacking, defensive analysis, evidence, remediation, incident response and professional reporting.
View all 15 practical learning outcomes
- Define authorisation, scope, rules of engagement and stop conditions
- Plan a proportionate security assessment
- Conduct controlled reconnaissance and service enumeration
- Use Nmap results without overstating what they prove
- Assess vulnerability information and validate important findings
- Use relevant security tools from a Kali workstation
- Analyse packet captures, logs, alerts and system evidence
- Assess common Windows, Linux and network security controls
- Test web and API security safely inside the approved lab
- Recognise malware, phishing and session-security indicators
- Explain wireless, cryptographic and identity-security controls
- Apply incident-response and evidence-handling principles
- Relate observations to OWASP, MITRE ATT&CK, NIST and NCSC guidance
- Write clear findings with risk, evidence and practical remediation
- Retest agreed corrections and complete a professional handover
Who Is This Course For?
- College and university students
- IT support and helpdesk professionals
- Network engineers moving into security
- Technical career changers with the required foundations
- Aspiring SOC and cybersecurity analysts
- Aspiring vulnerability-assessment technicians
- Aspiring junior penetration testers
- Professionals who need practical security awareness
Entry Knowledge
Learners should already have a useful understanding of networking and basic Linux operation.
- IP addressing, ports, protocols and core network services
- Basic routing, switching and troubleshooting concepts
- Kali/Linux terminal navigation and command structure
- Files, permissions, packages, services and networking commands
If these areas are new, begin with DigiUK’s dedicated Network+ course and Kali Linux course. The free induction can also be used to confirm your starting level.
Course Information
30 tutor-led sessions, 90 minutes each, 45 guided hours, maximum five learners and more than 80% practical laboratory activity in Stretford, Manchester.
View prices, prerequisites, delivery and assessment details
| Course | Cyber Security Course Manchester — Practical Security Training |
|---|---|
| Total sessions | 30 structured tutor-led sessions |
| Session length | 90 minutes |
| Guided learning | 45 hours |
| Practical proportion | More than 80% guided laboratory activity, supported by essential theory |
| Class size | Maximum of five learners |
| Price | £30 per session |
| Payment block | Four sessions for £120 |
| Free induction | A separate induction before Session 1 is free, subject to arrangement and availability |
| Delivery | Practical instructor-led classroom and laboratory training |
| Location | DigiUK Academy, Stretford, Manchester |
| Prerequisites | Good networking knowledge and basic Linux/Kali operation, or completion of the separate DigiUK foundation courses |
| Network+ included? | No. The complete Network+ syllabus is a separate course. |
| Kali Linux course included? | No. Kali is used as a security workstation; Linux administration is taught separately. |
| Assessment | Guided practical work, evidence, questions, tutor feedback, reporting and an integrated capstone |
| Award | DigiUK Academy Certificate of Completion |
| Current timetable | Provided when arranging the free induction |
| Official exams | Not included unless expressly stated in writing |
Frequently Asked Questions
Does this course include the Network+ course?
No. Networking knowledge is used throughout the labs, but the full Network+ syllabus is a separate foundation course and is not repeated during these 30 cybersecurity sessions.
Does this course include the Kali Linux course?
No. Kali Linux is used as the authorised security-testing workstation, but terminal fundamentals, file management, permissions, packages, services, logs and Bash administration belong to DigiUK’s separate Kali Linux course.
Can a complete IT beginner join directly?
A complete beginner should normally develop networking and basic Kali/Linux skills first. During the free induction, the tutor can confirm whether you are ready or recommend the correct foundation stage.
Is this an official CEH, CompTIA, ISC2, ISACA or OffSec course?
No. This is an independently created DigiUK Academy programme. It covers related knowledge and practical skills but is not official vendor training, an external certification or an examination.
Is the training practical?
Yes. More than 80% of the programme is based on guided practical activity, supported by the theory required to understand the method, interpret the evidence and work safely.
Can learners test public websites or networks?
No. Active exercises are limited to DigiUK’s isolated laboratory or another target covered by clear written authorisation and an agreed scope.
Does the fee include an external certification examination?
No external examination, voucher, membership or subscription is included unless this is expressly confirmed in writing.
What certificate is awarded?
Learners who meet the course-completion requirements receive a DigiUK Academy Certificate of Completion. It is not a vendor-issued or regulated professional certification.
Book Your Free Cyber Security Induction
Visit DigiUK Academy, meet the tutor, see the controlled laboratory and discuss your current networking, Linux and cybersecurity knowledge. We will explain the 30-session course, practical method, current timetable and payment arrangement.
Each class is limited to a maximum of five learners.