CompTIA Security+ for Developers is a hands-on course that covers the 5 Security+ domains from a developer's point of view, from cryptography and threat modelling to finding and fixing OWASP vulnerabilities in a simulated lab, IAM, DevSecOps pipelines and incident response. It suits developers, DevOps engineers and tech leads who are responsible for the security of the systems they build.
Many vulnerabilities are created during development: weak input validation, secrets embedded in code, excessive permissions or libraries with known flaws. At the same time, AI-related threats such as prompt injection and data leaking through models now affect the systems developers build directly. Organisations therefore need developers who understand security as a whole, rather than relying only on a security team at the end of the line.
This course uses the 5 CompTIA Security+ domains as its framework, based on the SY0-801 exam objectives, the new version that adds AI-related risks while covering the core of SY0-701. It takes a developer's point of view and puts real-world use ahead of exam cramming. Learners work hands-on with OWASP Juice Shop, ZAP, Nmap, Wireshark, Semgrep, Gitleaks, Trivy and OpenSSL in a simulated environment isolated from real systems, to find, fix and prevent vulnerabilities in a sample system, SecureLoan Portal, and go on to respond to incidents and set a security policy for the team. Learners who want the certification can use it as a foundation and book the exam with CompTIA themselves. (5 days, 6 hours per day, 30 hours in total, Intermediate level.)
What you’ll gain
Understand core security concepts such as the CIA triad, security controls, Zero Trust and cryptography
Recognise threat actors, attack vectors and common application vulnerabilities, including AI-related risks
Find and fix vulnerabilities in your own code following OWASP guidance
Design secure architectures on-premises, in the cloud and in hybrid environments
Manage identities, permissions and secrets correctly
Bring security scanning into development and CI/CD with DevSecOps
Understand monitoring, incident response and basic evidence handling
Understand risk management, governance and legal compliance such as Thailand's PDPA
Who this course is for
Software developers (frontend, backend, full stack and mobile) who want to build secure systems from the start
DevOps engineers who want to bring security into the pipeline
Tech leads and software architects responsible for system security
IT staff who want a structured cybersecurity foundation
Learners who want a foundation before preparing for CompTIA Security+ or another security certification
Prerequisites
Programming in at least one language, with an understanding of web applications and REST APIs
Basic command line use (Linux shell or PowerShell)
Basic networking such as IP addresses, ports, DNS and HTTP/HTTPS, plus basic Git and Docker
No prior security or penetration testing experience is needed
Curriculum
Course Details
This is a hands-on course that uses the 5 CompTIA Security+ domains as its framework: general security concepts; threats, vulnerabilities and attacks; security architecture; security operations; and security program management and oversight. It is based on the SY0-801 exam objectives, which CompTIA expects to launch around 17 November 2026, and covers the core of SY0-701, which is still available. It is not an official CompTIA course, does not include an exam voucher and does not focus on practice exams. Learners who want the certification book the exam with CompTIA themselves. It differs from Ethical Hacking and Penetration Testing basics, which focuses on penetration testing, DevSecOps in Practice, which focuses
on pipeline security, and AI Security and LLM Red Teaming, which goes deep into AI system security, by building a complete security foundation from a developer's point of view. It runs for 5 days, 6 hours per day (30 hours in total, 09:00-16:00), as a continuous workshop on a deliberately vulnerable sample system, SecureLoan Portal, using generated data only. All testing takes place in a simulated lab on the learner's own laptop, isolated from real systems. Learners bring a laptop that can run VirtualBox or VMware and Docker, and should check antivirus or EDR policies with their IT team before the class. CompTIA and Security+ are trademarks of CompTIA, Inc.
Day 1General Security Concepts
Section 1: Security Fundamentals
The CIA triad, non-repudiation and AAA (authentication, authorisation, accounting)
Security control categories: technical, managerial, operational and physical
Control types: preventive, detective, corrective, deterrent and compensating
An overview of the SecureLoan Portal project and the 5 Security+ domains
Section 2: Zero Trust and Defence in Depth
The never trust, always verify principle
Policy decision points and policy enforcement points
Applying Zero Trust to APIs and microservices
Lab: map the defensive layers of SecureLoan Portal and find places where trust is assumed without checks
Section 3: Change Management and the Secure Development Lifecycle
How change management affects security
Approval, impact analysis, rollback plans and version control
Building security into every stage of the SDLC
Case study: an unreviewed system change that became a vulnerability
Section 4: Lab: Cryptography and PKI
Symmetric versus asymmetric encryption and when to use each
Hashing, salting and key stretching for password storage
Digital signatures, certificates, certificate authorities, TLS and key management
Lab: use OpenSSL to create keys and certificates for HTTPS in the lab and check the system's TLS
Section 5: Workshop Day 1: Threat Modelling
Identify data assets and trust boundaries
The STRIDE model for developers, and ranking threats by impact and likelihood
Workshop: build a data flow diagram and threat model for SecureLoan Portal
Workshop: change password storage from plain text to a secure hash
Day 2Threats, Vulnerabilities and Attacks
Section 6: Threat Actors and Attack Vectors
Types of threat actor, their motivations and capabilities
Attack vectors: email, social engineering, supply chain, removable media and unsecured networks
Phishing, pretexting and business email compromise
Case study: analyse a sample phishing email and its warning signs
Section 7: Lab: Application Vulnerabilities and OWASP
Injection, cross-site scripting and broken access control
Authentication failures, security misconfiguration and vulnerable components
Race conditions, memory issues and insecure deserialisation at a conceptual level
Lab: find vulnerabilities from the latest OWASP Top 10 in OWASP Juice Shop
Section 8: Lab: AI-Related Risks
Prompt injection and attacks through model inputs
Leaks of personal and internal data through AI
Attackers' use of AI, such as automated phishing and deepfakes
Lab: try prompt injection against the system's simulated chatbot and work out defences
Section 9: Network, Cloud and Supply Chain Attacks
DDoS, on-path attacks, DNS attacks and credential replay
Cloud misconfiguration and the risks of third-party dependencies
Indicators of compromise and signs of an attack
Lab: inspect unencrypted traffic in Wireshark to see the risk to credentials
Section 10: Workshop Day 2: Vulnerability Assessment in the Lab
Scope, ethics and getting permission before any test
Scan services with Nmap and test the web application with ZAP, reading the results correctly
Workshop: test SecureLoan Portal in the simulated lab within the agreed scope
Write a vulnerability report ranked by risk
Day 3Security Architecture and Secure Development
Section 11: Secure Architecture Models
Security for on-premises, cloud, hybrid and operational technology (OT) environments
Network segmentation, DMZs and microsegmentation
Security for containers, serverless and infrastructure as code
Lab: separate the database network from the public tier with Docker networks
Section 12: Data Protection
Data classification and data states (at rest, in transit, in use)
Encryption, tokenisation, masking and data minimisation
Data sovereignty and data storage requirements
Lab: classify SecureLoan customer data and mask the data that is displayed
Section 13: Lab: Secure Coding Practices
Input validation, output encoding and parameterised queries
Handling sessions, cookies and JSON Web Tokens securely
Error handling and logging that do not expose sensitive data
Lab: fix injection, XSS and broken access control flaws in the system's code
Section 14: Lab: Secrets Management
The risks of secrets in code, .env files and Git history
Storing secrets in Vault or a cloud secret manager (demonstration)
Secret rotation and responding when a secret leaks
Lab: use Gitleaks to find leaked secrets in the repository and move them out of the code
Section 15: Workshop Day 3: Resilience and Retesting
High availability, redundancy and backup
Disaster recovery and business continuity planning, and testing recovery
Workshop: retest SecureLoan Portal to confirm that yesterday's vulnerabilities are closed
Record before and after results in the vulnerability report
Day 4Security Operations
Section 16: Lab: Identity and Access Management
Authentication factors, MFA and passwordless sign-in
OAuth 2.0, OpenID Connect, SAML and single sign-on
Role-based and attribute-based access control, least privilege and privileged access management
Lab: add MFA to the login and enforce role-based permissions
Section 17: Lab: Hardening and Secure Baselines
Hardening servers, containers and endpoints
Running containers as non-root with a read-only filesystem, and reducing the attack surface
Secure configuration baselines and compliance checks
Lab: harden the SecureLoan containers to run as non-root
Section 18: Vulnerability Management
The identify, analyse, prioritise, remediate and verify cycle
CVE, CVSS and prioritising fixes by real risk
SAST, DAST, SCA and container image scanning
Lab: scan dependencies and images with Trivy and prioritise the fixes
Section 19: Lab: Security Monitoring
Collecting and analysing application, system and network logs
SIEM (demonstration), alerting and reducing false positives
Detecting unusual behaviour from system logs
Lab: set up log collection and detect unusual login attempts
Section 20: Workshop Day 4: Automation and DevSecOps
Bringing security scanning into the CI/CD pipeline (shift left)
Security gates and criteria for blocking the pipeline
Using AI to help analyse scan results and logs, with a critical eye
Workshop: add Semgrep, Gitleaks and Trivy to the pipeline with a security gate
Day 5Incident Response, Governance and the Master Workshop
Section 21: Incident Response
Preparation, detection, analysis, containment, eradication, recovery and lessons learned
Writing playbooks and runbooks for common incidents
Communication during an incident and reporting to stakeholders
Lab: write a playbook for a leaked secret
Section 22: Lab: Digital Forensics Basics
Chain of custody and preserving evidence
Analysing logs and building an incident timeline
Root cause analysis
Lab: build a timeline from a sample log set of a simulated attack
Section 23: Governance and Risk Management
Security policies, standards, procedures and guidelines
Risk identification, risk assessment and risk treatment
Third-party and vendor risk management
Build a risk register for SecureLoan Portal
Section 24: Compliance and Security Awareness
Relevant laws and standards such as Thailand's PDPA and ISO/IEC 27001
Audits and assessments
Security awareness training for development teams and users
Review how the 5 days of work map to the 5 Security+ domains
Section 25: Master Workshop: A Customer Data Leak
Groups respond to a simulated data leak caused by a leaked secret and an unfixed vulnerability
Analyse logs, build a timeline, find the root cause, contain the damage and restore the system
Write an incident report that takes PDPA duties into account
Write the team's security policy and secure development checklist, and present how to prevent a repeat
Schedule & training options
For individuals — public rounds
No public rounds are open right now. Join the waiting list and we will contact you first when the next round opens, or ask us on LINE. Or call 02-570-8449 or 088-807-9770
How does this course differ from Ethical Hacking, DevSecOps in Practice and AI Security and LLM Red Teaming?
Ethical Hacking and Penetration Testing basics takes the penetration tester's view, DevSecOps in Practice focuses on security in the pipeline, and AI Security and LLM Red Teaming goes deep into AI system security. This course builds a foundation across all 5 Security+ domains from a developer's point of view, from core concepts, cryptography and threat modelling to secure coding, IAM, monitoring, incident response and governance, so it works well as a base before those specialist courses.
Is this an official CompTIA course, and does it include the exam fee?
No. It is not an official CompTIA course and does not include an exam voucher. It is a hands-on course by IT Genius Institute that uses the Security+ exam objectives as its framework. Learners who want to sit the exam book and pay for it with CompTIA themselves, and should review the official objectives for the version they plan to take on comptia.org.
Which Security+ version does the course follow, SY0-701 or SY0-801?
The content follows the SY0-801 exam objectives, which CompTIA expects to launch around 17 November 2026 and which add AI-related risks. Both versions share a similar 5-domain structure, so the course also covers the core of SY0-701. According to comptia.org in October 2026, the English SY0-701 exam retires on 11 June 2027 and the Thai version on 13 August 2027. Dates can change, so check comptia.org before booking.
Will I be ready to take the Security+ exam after the course?
The course covers all 5 domains and builds understanding through hands-on work, which is a good foundation for exam preparation, but it does not focus on practice exams and does not guarantee a result. Physical security, in-depth wireless security and advanced digital forensics are covered at a conceptual level. Learners who plan to sit the exam should review the exam objectives and practise questions on their own.
Are the attack exercises in the labs safe and legal?
All testing targets deliberately vulnerable systems, OWASP Juice Shop and SecureLoan Portal, running in VMs and containers on the learner's laptop and isolated from real networks, with generated data only. The instructor stresses scope, ethics and written permission before testing any system. Learners must not use the techniques against systems they are not authorised to test.
How should I prepare my laptop?
Learners bring their own laptop with 16 GB RAM or more, at least 60 GB of free disk and virtualisation enabled in the BIOS, with VS Code, Git, Docker and VirtualBox or VMware installed and rights to install software. Check with your IT team in advance, as antivirus or EDR may block security tools or lab images. A setup list is sent before the class.
An organization can only defend well when it understands how attackers think and operate. This course teaches ethical penetration testing following a standard methodology: defining scope and obtaining written authorization, reconnaissance, scanning and…
Development teams now ship code to production several times a day with CI/CD, yet much of the security work still waits for a final check just before release. Vulnerabilities are found late, when they are hard and expensive to fix, or they slip into…
LLM applications, from chatbots and RAG systems to AI agents that call tools on their own, are moving into real business systems. Their weaknesses are unlike those of ordinary web applications. Plain text in an email or a document can instruct the model to do…
