Start with the Academy and the Security+ track, taught through the Purple Team Mentality in cohort-based training. Scan any code below to go straight there.

Every entry is a live link — click to jump straight to that section.

The disciplines are grouped into four teams. Each team is organized by its own natural shape, so the same field reads differently depending on where you stand. Every discipline gets its own page — mental model, frameworks, method, references, certifications, and the roles that do the work.

BlackHack trains Ethical Hackers. The line between a security professional and a criminal is one thing: authorization. This map teaches offensive and defensive tradecraft so you can protect people - never to harm them.

Red is the offensive discipline: understanding and exercising how systems, people, and processes are attacked. Its native geometry is TERRAIN — a landscape of attackable things, from the upstream forge where capability is built, across the attack terrains, to the downstream criminal economy where access becomes money. The reveal of the whole atlas lives here: MITRE ATT&CK, which the industry treats as the map of offense, describes only ONE of these terrains (enterprise intrusion). Six red zones have had to build their own ATT&CK-equivalent matrix because the field's standard map doesn't reach them.

The forge.

The classic network intrusion — land, look around, move, escalate, persist.

Attack the code and the services it exposes.

Attack the person, not the machine.

Fabricate reality at scale — deepfake voice/video, synthetic identity.

Cross the physical boundary to reach the digital one.

Attack the airwaves — wifi, Bluetooth, cellular, GNSS, sub-GHz.

Attack where bits move atoms — industrial control, vehicles, drones, silicon, satellites.

Attack value encoded as code — smart contracts, DeFi, bridges.

The cash-out — what happens AFTER impact.

Blue is the defensive operating discipline: detecting, investigating, responding, and governing. Its native geometry is a CYCLE — the NIST CSF function loop (Govern → Identify → Protect → Detect → Respond → Recover) that runs continuously. Blue OPERATES the tools (green builds them). The whole blue side runs on one shared framework fabric — ATT&CK, the Kill Chain, the Diamond Model, the Pyramid of Pain, STIX/TAXII — several of them the SAME frameworks red uses, which is exactly where purple lives. GRC sits at the top altitude of this cycle, not off in its own corner.

Run security as a program, not a pile of tools.

Know what's exposed and fix what matters first.

Turn knowledge of adversaries into decisions.

The operational hub — eyes on glass, alert to action.

Build the detections, don't just buy them.

Assume breach and go looking.

When it's real, work the fire methodically.

Plan to survive and recover, not just to prevent.

Take the adversary's tool apart to defend against it.

Green is the engineering build-and-operate discipline: the platforms, pipelines, infrastructure, and code that red attacks and blue operates. Its native geometry is a STACK — abstraction layers from the foundational code and OS, up through infrastructure, pipeline, platform, to the application. Green's structural signature is SECURITY-AS-CODE: controls shifted left into versioned, automated gates (IaC scanning, policy-as-code, signing). Green is foundational precisely because it's the platform layer underneath both red and blue — and AI engineering is one domain within it, not its center.

The foundational craft under everything green.

Build and operate the operating system so it resists attack by default.

Define infrastructure and its guardrails as versioned code.

Build and run the network so communication is secure by design.

Build and secure what runs in the cloud.

Secure the container from image to runtime.

Build security INTO the pipeline, not onto the product.

Trust what you build FROM, not just what you build.

Build the paved road everyone else drives on.

Design and verify software to resist the attacks red will try.

Build AI systems and the guardrails that keep them safe.

Design the whole system to be secure before it's built.

Purple is the integrating discipline — and BlackHack's crown jewel. Its native geometry is a FIELD WITH A VECTOR: a connective WEAVE binding red, blue, and green (it lives in the seams — the ATT&CK Navigator overlay, the YARA keystone, the shared framework fabric), PLUS one bright BRIDGE that crosses to the human. The public field's purple discipline is real but stops at detection coverage — adversary emulation, validation, threat-informed defense, deception. BlackHack's purple extends past that ceiling through the stakeholder/victim perspective and the cross-lane human translation that no public framework models. That extension is the signature.

Act like a specific, real adversary — on purpose, with intel behind it.

Prove the detection actually fires — continuously.

Prioritize defense against what adversaries actually do.

Turn the defender's environment into a trap and a sensor.

THE SIGNATURE.

The far end of the bridge, and the point of all of it.

The established frameworks and standards this map is built on. Tools change; these endure — the reason the map stays evergreen.

All 37 disciplines alphabetically. The colour marks the team; every entry links to its page.

Home for Ethical Hackers. We raise a new generation of Ethical Hackers from diverse backgrounds — bringing new talent into the profession and teaching a hybrid Offensive / Defensive discipline: the Purple Team Mentality.

Nobody hands you trust - or a career. You build it, one proof of work at a time. Pick a path, start the climb, and do the reps where it is free and safe to fail.