A programme design course on threat hunting as a proactive, hypothesis driven discipline: searching for evidence of a compromise that existing automated detection has not already flagged. Distinct from the reactive, alert driven work covered conceptually in secops-siem and from the adversarial simulation covered in purple-teaming-in-practice and red-team-adversary-emulation, hunting assumes a real, unknown compromise may already be present. You will learn the hypothesis driven hunting method, how threat intelligence informs a hunting hypothesis, the data visibility and retention requirements a hunt depends on, how to document a hunt's findings whether or not it finds anything, how to convert a confirmed discovery into standing automated detection, the staffing and skill investment a hunting capability actually requires, and how to measure a hunting programme's value by coverage gained rather than by raw hunt count.
Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.
None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.
You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.
The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.
