| Advanced Web Security: Scaling CSP & Cutting-Edge Browser Defences for Bug Class Elimination | Modern web security has shifted. Patching individual vulnerabilities no longer scales, especially across organisations with hundreds of services. This hands-on training teaches you how to eliminate entire bug classes using the newest browser security standards - including several features that have only just been published or are still in development, such as client-side Reporting API and or the new integrity policies (SRI). You’ll work with a pre-secured training app and progressively enforce CSP3 (Content-Security-Policy), Trusted Types, Sec-Fetch-Metadata, COOP/COEP, and other modern defences, test their effectiveness, and learn how to automate adoption at scale. No coding experience is required - everything is provided. The course blends deep technical exercises with architectural guidance for rolling out secure-by-default protections across real environments. You’ll leave with practical, forward-looking expertise that moves your organisation from reactive patching to proactive bug-class elimination, using the most current standards available. | 1-Day Training
Not available yet - CfT outstanding. |
| Proactive Security Engineering: Building Secure-by-Design Architectures That Scale | Most engineers can fix vulnerabilities. Far fewer can design systems where entire bug classes simply can’t exist. This two-day, hands-on training teaches how to do exactly that: build secure-by-design architectures that prevent defects rather than chase them.
You’ll exploit realistic flaws in enterprise-grade applications, trace them back to architectural roots, and then rebuild the systems using scalable patterns that embed security directly into design and DevSecOps workflows. Each module follows a repeatable cycle: exploit → test → defend → pattern → re-test. Turning isolated fixes into reusable engineering practices.
Across access control, input validation, identity, secrets, configuration, browser security, dependency governance, observability, you’ll learn how to replace patching with proactive architecture.
All labs and applications are purpose-built for this course, not textbook demos, and attendees receive lifetime access to the full environment. | 2-Day Training
Not available yet - CfT outstanding. |
| Think like a hacker, code like a pro: Secure Coding Training | This training provides a comprehensive understanding of the most common and dangerous security vulnerabilities in web applications, using the OWASP Top 10 as a reference. Through a combination of theoretical lectures and practical exercises, participants will learn to identify critical vulnerabilities in web applications, understand how attacks on them work, and how to take necessary measures to fix these vulnerabilities and prevent attacks. The training consists of a mix of theory about current threats and real-world examples, and practical exercises that address and handle these threats. Participants have the opportunity to examine an insecure web application (OWASP Juice Shop) using the methods they have learned and to identify vulnerabilities. Once the vulnerabilities are identified and attacked, the training covers relevant defensive measures to prevent attacks, thus providing a useful catalogue of measures for secure programming. Through practical exercises, participants can directly apply the knowledge they have learned and thereby improve their skills in assessing and enhancing the security of web applications. | 2-Day Training
Available on request. |
| Software Quality Engineering - Master's Lecture 🇩🇪 | Joint master lecture with Prof. Dr. Katja Wengler about Software Quality Engineering, Secure Software Development Lifecycle and Secure Coding Practices. | Available at:
DHBW CAS Heilbronn, Germany
|
| Security Hackathon 🇩🇪 | I am lecturing in Software Engineering with a focus on Secure Coding. Using a mix of theory and practice, students learn about commonly exploited vulnerabilities in web applications and learn ways to exploit these, as well as measures to prevent or fix these vulnerabilities through secure software development. | Available at:
DHBW Karlsruhe, Germany |
| ISC2 CISSP / CSSLP / CCSP Training 🇩🇪 🇬🇧 | Comprehensive preparation for the Certified Information Systems Security Professional (CISSP), Cloud Certified Security Professional (CCSP) and Certified Secure Software Lifecycle Professional (CSSLP) certifications.
ISC2 Authorized Instructor
Can be provided in German (🇩🇪) or English (🇬🇧) / in-house / remote / on-site. | Cooperation with:
IT-Schulungen.de |