How can I learn security? Is there a course you'd recommend?

There are plenty of security courses and little guidance on where to start. The most effective path usually combines practice in a safe environment, careful review of what the agent does, and a clear choice of direction.

Much of the learning comes from testing your own applications and reading, step by step, what the agent tried.

When you come across something you don’t understand, stop and investigate: what does this term mean? Why did it try this approach? What would prevent this problem?

Also decide whether you’re interested in offensive security (attacking to find vulnerabilities, with permission) or defensive security (protecting systems), since the courses are different. Be transparent with clients about your experience: not having a certification is fine; pretending to be an expert in everything isn’t.

Start with what you own

Test only applications you built yourself or environments created for practice. Testing someone else’s system without written permission may be a crime, even if you mean well.

There are applications deliberately built with vulnerabilities for study, such as OWASP Juice Shop (from OWASP, an open community dedicated to application security). It’s free and runs on your computer. There are also CTFs (Capture The Flag competitions, where participants look for hidden vulnerabilities to earn points), which are great for practice.

Read what the agent tried

When you ask an AI agent to test your application, the value is in the record of its steps. Read each attempt and ask: what was it trying to find out here? Why this approach? What would prevent this?

Did you stop understanding a term? Pause and look it up right away. This habit turns each test into a lesson tailored to your own system.

Offensive or defensive

Offensive security means attacking to find vulnerabilities, always with permission. It includes a pentest (a commissioned penetration test). Defensive security means protecting systems: configuring, monitoring, and responding to incidents.

The areas of study are different. For those pursuing offensive security in web systems, the PortSwigger Web Security Academy is free. TryHackMe and Hack The Box have free content and paid plans, with learning paths for both sides. The OWASP Top 10 is a good starting reference for both.

Be honest about your experience

Tell clients what you’ve done and what you haven’t. Not having a certification doesn’t stop you from starting with small jobs. Promising what you can’t deliver is what destroys trust.

1. Decide whether to start with offensive or defensive security.
2. Set up your own practice environment, such as OWASP Juice Shop.
3. Ask the agent to test and save the full record of its steps.
4. Look up every term or approach you didn’t understand.
5. Choose a learning platform that fits the direction you picked.
6. Write down what you learned in simple language, as if you were explaining it to a client.

• Practicing on real third-party websites, which may be illegal even if you cause no damage.
• Looking only at the agent’s final result and missing the learning in its steps.
• Buying courses on both sides at once and scattering your focus.

• Test what you own and read through the agent's steps.
• Don't understand something? Look it up right away.
• Offensive or defensive: choose before taking a course.

• CourseProfissional 2030 · Auditor de IAScope and authorization, risk inventory, and reporting (not a pentest).
• Projectprof2030-labA fictional company with 12 planted AI vulnerabilities for you to practice on.
• Projectia-sem-censura-defensivaPractice by testing your own app, with scope rules.

Some of these materials are in Portuguese.