The methodology
From first login
to verified credential.
Every student on a ThinkCyber deployment follows the same four-step structure — Choose, Learn, Prove, Certify. The path is identical whether the deployment is a beginner academy, an enterprise SOC track, or a national CERT program. What changes is the program selected and the depth of the destination.
The four steps
One structured path.
Every student. Every program.
A single methodology takes every student from program selection through internationally recognized certification.
1
Choose
Pick a program matched to role and level — a full catalogue of programs across seven domains.
2
Learn
Video lessons, reference books, and hands-on labs on real systems. AI assistant on call.
3
Prove
Lab tests, real-attack scenarios, and project work. Timed, scored, evidence-backed.
4
Certify
Proctored scenario exam and a City & Guilds Assured credential, priced separately.
Step by step
What actually happens
at each stage.
A closer look at the four steps — what students do, what trainers see, and what the platform delivers.
1
Choose
A program for every role, every level.
Students enter the catalog matched to their starting point and target role. The progression is structured: introductory IT and Linux foundations at the entry levels, then forking into defensive, offensive, or forensics specializations as students advance.
a full catalogue of programs across defense operations, offensive security, forensics, network security, Python automation, and ICS/SCADA.
Seven levels — from absolute beginner with no IT background through advanced specialist.
Guided pathways — defender, hunter, IR, red team, forensics tracks with prerequisite gating.
Trainer assignment — academies can pre-enroll cohorts into specific programs or let students self-select within a curriculum.
2
Learn
Material designed to be reinforced by doing.
Each program mixes learning modes: hands-on labs, and books and video lessons for most modules. Theory and practice alternate in short cycles. An AI assistant is available throughout for questions the trainer is not in the room to answer.
Video lessons — concise instruction sequenced with lab work, not multi-hour lecture marathons.
Reference books — structured written material per module, searchable from inside the platform.
Hands-on labs — browser terminals connected to real Linux and Windows servers with real tools.
Cy, the AI assistant — help for stuck moments, any time, day or night, scoped to the current program.
3
Prove
Demonstrate skill against real incidents.
In the Prove stage, students show what they can do. Students execute lab tests, work through scenarios drawn from real-world incidents, and complete project work — all scored on what they actually did at the command line.
Lab tests — standalone challenges per module, used for module gating and self-paced practice.
Real-attack scenarios — real-incident reproductions, including scenarios built from break-ins our decoy servers caught.
Projects — end-of-program assignments combining skills from the full curriculum.
Real-world validation — AI assessment reads commands, files, and indicators.
4
Certify
Credentials employers and accreditors recognize.
Students who complete a program can sit a separate, proctored scenario exam. Passing earns a City & Guilds Assured credential — backed by 140+ years of international assessment expertise . Every certificate carries its own ID. The exam is priced per student, separately from the programme.
Proctored exam — a separate scenario exam, not a multiple-choice quiz. Same hands-on standard as the program.
City & Guilds Assured — awarded jointly by ThinkCyber and City & Guilds. The exam is priced separately.
Its own ID — every certificate carries its own ID and names the academy that taught it.
MITRE ATT&CK labels — each investigation names the techniques it trains.
Program progression
From entry-level to
advanced specialist.
Programs are organized into seven progression levels. Students follow guided pathways from foundational IT skills through advanced role specialization. Trainers can configure which paths are open to which cohorts.
L1
Cyber Foundations
L2
IT & Linux Core
L3
Network Fundamentals
L4
Defense & SOC
L5
Forensics & Hunting
L6
Offensive & Pen Test
L7
Advanced Specialist
Next step
Browse the program catalog.
a full catalogue of programs across seven levels — choose by audience, role, or specialization to see exactly what a student covers.