Certified - CompTIA CYSA+ Audio Course

Welcome to Domain 3 of the CySA+ PrepCast, where we move from prevention and vulnerability management into response and containment. In this episode, we provide an overview of what incident response means in modern organizations and how it’s structured in the CySA+ exam. You’ll learn how incident response differs from general troubleshooting, and why having a clear plan, chain of command, and comm...

Before moving forward, it’s time to reflect. In this comprehensive recap, we walk through the critical knowledge areas covered in Domain 2: Vulnerability Management. From scanning types and validation workflows to secure coding, asset prioritization, compensating controls, and risk decisions—you’ll get a structured review that reinforces everything you’ve learned so far. We’ll also offer tips for...

What if you could anticipate the attacker’s plan before they even launch it? In this episode, we introduce threat modeling as a method for identifying and prioritizing potential threats based on how applications and systems are designed. You’ll learn how threat modeling is performed using techniques like STRIDE, kill chain analysis, and data flow diagrams—and how it’s used to predict, prevent, and...

Security that begins in production is already behind schedule. In this episode, we take a holistic view of the Secure Software Development Lifecycle (SDLC), explaining how security is integrated into every phase of software creation—from planning and design to development, testing, deployment, and maintenance. You'll learn how threat modeling, secure coding standards, automated testing, and static...

You don’t need to be a developer to influence secure code—but you do need to understand what secure coding looks like. In this episode, we break down the most important secure development practices that analysts should know when evaluating application risk or reviewing vulnerability reports. Topics include input validation, output encoding, secure session management, proper authentication handling...

You can't protect what you can't see. In this episode, we explore the evolving discipline of attack surface management (ASM)—a proactive process that helps security teams identify, map, and reduce the ways in which an attacker could compromise an organization. You'll learn how ASM incorporates both internal and external assets, including shadow IT, exposed APIs, forgotten subdomains, and misconfig...

In a world where thousands of vulnerabilities exist, how do you decide which to address first? In this episode, we break down the art and science of vulnerability prioritization—how analysts combine CVSS scores, asset value, exploitability, and business context to triage effectively. You’ll learn how to identify which issues must be escalated to leadership or incident response teams, and which can...

Cybersecurity doesn’t happen in a vacuum—it happens under governance. In this episode, we explain how policies, governance structures, and service-level objectives (SLOs) shape the work of the security analyst. You’ll learn how vulnerability management policies define scan frequency, remediation timelines, and exception criteria—and how governance teams enforce consistency across business units an...

Effective vulnerability management is built on sound risk management principles. In this episode, we explore the four classic risk response strategies—accept, avoid, transfer, and mitigate—and how they apply to real-world cybersecurity scenarios. You'll learn how security analysts recommend and evaluate responses based on the nature of the vulnerability, the criticality of the asset, the threat la...

Sometimes a vulnerability can’t be fixed—at least, not right away. In this episode, we explain how analysts and risk managers document and process exceptions: formal records of accepted risk where vulnerabilities are not remediated within standard timelines. You’ll learn when exceptions are appropriate, what approvals are required, and how expiration dates, revalidation, and compensating controls...

Security teams can’t just apply patches whenever they want—especially in enterprise environments where uptime and availability are critical. In this episode, we explore how maintenance windows are scheduled, documented, and coordinated to apply updates without disrupting core business operations. You’ll learn how organizations balance risk reduction with service availability, and how scheduling de...

Vulnerabilities don’t just exist—they persist, especially when patch and configuration management processes are weak. In this episode, we walk through the full lifecycle of patching and secure configuration: from initial discovery and testing, to staged deployment, validation, and rollback planning. You'll learn how patch management tools integrate with vulnerability scanning platforms and how cha...

Not all security controls serve the same function. In this episode, we explain the various types of controls used across cybersecurity programs and why it’s important to understand their classification. You’ll learn the difference between managerial, operational, and technical controls—and how each can be preventative, detective, responsive, or corrective in nature. We’ll walk through real example...

What happens when you can’t fix a vulnerability directly? In this episode, we introduce the concept of compensating controls—alternative safeguards put in place to reduce risk when a vulnerability cannot be immediately remediated. You’ll learn how network segmentation, monitoring, air gapping, and tightly scoped access policies are used to minimize exposure and limit an attacker’s options. We also...

Sometimes attackers don’t need to upload malicious files—they just need to include them. In this episode, we explore Local File Inclusion (LFI) and Remote File Inclusion (RFI) vulnerabilities, which allow attackers to manipulate file paths in application inputs and force systems to load unintended or external code. You’ll learn how LFI can be used to read sensitive server-side files, and how RFI o...

Attackers often start with limited access—but they rarely stay there. In this episode, we break down privilege escalation vulnerabilities, which allow attackers to move from low-level accounts to administrative or root-level control. You’ll learn the difference between vertical and horizontal escalation, how flaws in permissions, service configurations, or kernel-level bugs create these pathways,...

Few vulnerabilities are as critical—or as devastating—as remote code execution. In this episode, we explore how RCE vulnerabilities allow attackers to run arbitrary code on target systems, often with high privileges and zero user interaction. You’ll learn how RCE flaws emerge from input validation failures, memory corruption bugs, insecure deserialization, and unsafe system calls. We discuss how R...

Some of the most dangerous requests come from inside the house. In this episode, we unpack Server-Side Request Forgery (SSRF), a vulnerability that allows attackers to trick a server into sending requests to internal services, external endpoints, or cloud metadata APIs. You’ll learn how attackers abuse server-side functionality to pivot into otherwise inaccessible environments, bypass firewalls, o...

If attackers can bypass your login system, the rest of your defenses may not matter. In this episode, we explore identification and authentication failures such as broken login flows, weak password policies, exposed session tokens, and improper use of multifactor authentication (MFA). These flaws make it easy for attackers to impersonate users or hijack their sessions—and they continue to top OWAS...

Running outdated software isn't just inconvenient—it’s dangerous. In this episode, we explore the risks posed by end-of-life (EOL) systems and unsupported components, which often lack vendor patches, security updates, or compatibility with modern security tools. You'll learn how attackers specifically target legacy platforms due to known vulnerabilities and weak default settings. We also examine h...

Even the strongest tools can be rendered useless by poor configuration. In this episode, we explore how security misconfigurations—ranging from default credentials and exposed directories to verbose error messages and unrestricted administrative interfaces—create pathways for attackers. These issues often appear in cloud platforms, web servers, mobile apps, and third-party services. You’ll learn h...

Not all vulnerabilities are bugs—some are architectural. In this episode, we explore the concept of insecure design, a growing concern recognized in recent OWASP rankings. You’ll learn how poor design choices—such as excessive trust in client input, lack of threat modeling, or missing authorization layers—can create exploitable conditions even when code functions as intended. We discuss how analys...

When input isn’t properly restricted, users can end up accessing far more than intended. In this episode, we break down directory traversal vulnerabilities—flaws that allow attackers to manipulate file paths and access sensitive files or directories outside of the intended web root. You’ll learn how inputs like ../ or encoded path characters can lead to file exposure, configuration leaks, and cred...

In this episode, we examine Cross-Site Request Forgery, or CSRF—a vulnerability that tricks authenticated users into executing unwanted actions on a web application. You’ll learn how attackers exploit user sessions by embedding malicious links or scripts in third-party sites, emails, or ads, effectively hijacking user privileges to perform unauthorized actions. We explore real-world CSRF use cases...

Injection vulnerabilities have been on the OWASP Top Ten for years—and for good reason. In this episode, we explain how SQL, command-line, and LDAP injection flaws allow attackers to manipulate input to execute unintended commands or access unauthorized data. You’ll learn the anatomy of a basic injection attack, how user input is weaponized, and what kinds of systems are most susceptible. We’ll co...