Five focused modules on the risks that matter most: third parties inside your perimeter, the privileged identities that hold your Tier-0 keys, the code your teams ship to production, a field-wide foundation that maps the whole discipline, and the NCA regulatory landscape you answer to.
Each module pairs an animated explainer with hands-on content and a short knowledge check. Then sit the final exam — 20 questions sampled from every module — and score 80% to earn your completion certificate. You can retake the exam as many times as you like.
Your security is only as strong as your weakest supplier. Learn how supply-chain attacks unfold and what ECC Domain 4 demands of every vendor relationship.
Identity is the new perimeter. Master the ECC 2-2 minimum requirements — MFA, least privilege, segregation of duties and privileged access management.
Every line of code is attack surface. Build security into the SDLC — from threat modeling to the ECC's secure-development (1-6-3) and web-application (2-15) controls.
The whole field on one map — the CIA triad, threats, secure architecture, operations and governance. Five pillars that structure everything else.
Who the National Cybersecurity Authority is, how ECC-2:2024 is structured, who must comply, and where the wider framework family fits in.
Vendors, integrators, cloud providers and managed services all hold a piece of your attack surface. This module covers how third-party compromise happens — and the controls ECC-2:2024 requires before, during and after every engagement.
Assess the vendor's security posture, certifications, breach history and subcontractors (your fourth parties) before commitment.
Embed cybersecurity clauses: NDA, data handling, incident notification, right to audit, secure data removal at exit.
Provision least-privilege, time-bound, individually attributable access — federated to the vendor’s own identity where possible, so leavers on their side are leavers on yours. No shared accounts, no standing admin, no vendor access to Tier-0 without a brokered, recorded session.
Log and review vendor sessions, track SLA compliance, reassess risk on contract change or after incidents.
Revoke all access immediately, recover assets, and verify secure removal of your data — as contractually required.
Subdomain 4-1 protects the entity's assets against third-party risk across IT outsourcing, cybersecurity outsourcing and managed services. Expand each control:
AI services are third parties too — and so are the pre-trained models, datasets and AI-powered tools your teams adopt. ECC 4-1 and 4-2 apply to them in full, with some new failure modes to assess.
Staff pasting source code, credentials or classified documents into unapproved public AI tools is an unassessed third-party data flow. Treat AI tool adoption like any vendor onboarding: approved list, DLP controls, clear usage policy.
Pre-trained models, weights and training datasets pulled from public hubs are software components from external parties: they can carry poisoned behaviour, backdoors or malicious serialization payloads. Verify sources, pin versions, scan artifacts.
Some AI vendors reserve the right to train on customer inputs. Contract review must cover data residency, retention and training-use clauses — the AI-era extension of the 4-1-2-1 secure-removal requirement.
AI also strengthens vendor management: continuous vendor-risk scoring, anomaly detection on third-party connections and sessions, and automated contract-clause analysis at scale.
Most breaches don't break in — they log in, and then they escalate. This module covers the full IAM chain, the five minimum requirements of ECC 2-2-3, and — in depth — the crown-jewel problem of administrative and remote administrative access: standing domain admin, Tier-0 assets, jump hosts, and the lateral-movement techniques that turn one stolen credential into full control in minutes.
Subdomain 2-2 exists to prevent unauthorized logical access and restrict access to what the task requires. Control 2-2-3 sets five minimum requirements:
Administrative access is the endgame of almost every serious intrusion. Attackers rarely breach the firewall — they steal one credential and escalate. In a poorly segmented network, the path from a phished helpdesk password to full domain control can take under an hour; red teams routinely demonstrate "ten minutes to domain admin." The danger multiplies when that admin access is reachable over the internet. ECC 2-2-3-2, 2-2-3-4 and 2-2-3-5 exist precisely to make privileged access hard to reach, impossible to reuse silently, and fully accountable.
Not all admin is equal. A tiered model stops a compromised workstation from ever reaching a domain controller — credentials never cross tiers.
Anything that can control identity for the whole estate. Administered only from dedicated, hardened Privileged Access Workstations — never from a device that browses email.
Server and app administration. Separate admin identity, JIT elevation, recorded sessions. Tier-1 admins can never log on to Tier-0 assets, and vice-versa.
Endpoint and user support — the tier most exposed to phishing, so it holds the least privilege and can reach nothing above it.
| Exposure | Severity | Why It's Dangerous | Control |
|---|---|---|---|
| RDP exposed to the internet | Critical | Brute-forced and sold as initial access; the top ransomware entry vector. | Bastion / ZTNA + MFA, never public 3389 (2-2-3-2) |
| Standing domain admin | Critical | One phished session = full estate; the endgame of every lateral-movement chain. | JIT elevation, tiered model, no permanent membership (2-2-3-4) |
| VPN appliance, unpatched | Critical | Internet-facing and trusted; pre-auth RCEs hand attackers a foothold with no credentials. | Aggressive patch SLA, MFA in front, shift to ZTNA |
| Flat network, no segmentation | High | Any foothold reaches every server — nothing contains the blast radius. | Segment admin VLANs; jump hosts between tiers |
| Shared local-admin password | High | Pass-the-hash spreads one credential across every workstation. | Unique per-host passwords (LAPS-style), vaulted & rotated |
| Unrecorded admin sessions | High | No replayable evidence when an admin account is abused. | Session recording & monitoring (2-2-3-4) |
| Area | Do | Don't |
|---|---|---|
| Admin exposure | RDP/SSH reachable only via bastion; internet-facing 3389/22 closed | Public RDP "for convenience" — brute-forced within minutes |
| Admin work | Separate privileged identity, JIT elevation, logged sessions | Day-to-day work from a domain-admin account |
| Remote access | Phishing-resistant MFA; admin brokered through a bastion/ZTNA | RDP/SSH exposed to the internet, or a flat password-only VPN onto Tier-0 |
| Service accounts | Vaulted, rotated, scoped to one function, monitored | Static passwords in scripts and config files |
| Leavers | Same-day revocation wired into HR offboarding | "IT will get to it" — accounts alive weeks after exit |
| Access requests | Role-based, approved, time-limited, recertified | Copy the permissions of a colleague ("mirror access") |
Generative AI has industrialised identity attacks: flawless phishing at scale, cloned voices, and synthetic video. Your IAM controls are the counterweight — if they don't rely on "sounding legitimate".
Cloned voices and live video deepfakes are used to push helpdesk password resets and approve fraudulent transfers — in a Feb 2024 case reported at engineering firm Arup, a finance employee paid out ~US$25M after a deepfaked video call impersonating the CFO and colleagues. Verification must use callbacks and strong identity proofing, never voice or face familiarity.
LLMs remove the typos and awkward phrasing users were trained to spot, and generate fluent, personalised lures in any language. Assume perfect text: verify via the request's context and channel, not its polish.
AI automates password spraying, MFA-fatigue timing and target research. Weak factors fall fast — which is why phishing-resistant MFA (FIDO2 / certificate-based) matters more every year.
Modern IAM fights back with behavioural analytics (UEBA), identity threat detection & response (ITDR), and risk-based conditional access that challenges or blocks impossible travel, anomalous sessions and token replay in real time.
Now zoom out. Here is the whole discipline on one map — the concepts, threats, defences, operations and governance every practitioner is expected to know. Five pillars that turn "cybersecurity" from a vague word into a structured field, and set the stage for the regulation that follows.
Every cybersecurity topic — and every professional certification — organises the field into the same handful of pillars. These are mandatory: read each pillar and mark it complete to unlock the next, and to open the knowledge check.
You can't secure what you don't understand. Every control, threat and attack in this course rides on a network — so here is the wiring beneath it all: how data moves layer by layer, how devices are addressed, and the ports attackers scan for.
| Layer | Name | What It Does | Lives Here |
|---|---|---|---|
| 7 | Application | Services people actually use | HTTP, DNS, SMTP |
| 6 | Presentation | Formats & encrypts data | TLS, JPEG |
| 5 | Session | Opens & manages sessions | RPC, NetBIOS |
| 4 | Transport | End-to-end delivery & ports | TCP, UDP |
| 3 | Network | Logical addressing & routing | IP, routers, ICMP |
| 2 | Data Link | Local frames & MAC addresses | Switches, VLANs, ARP |
| 1 | Physical | Bits on the medium | Cables, Wi-Fi, fibre |
Two models, same idea: the 7-layer OSI model is how we teach and troubleshoot networks; the leaner 4-layer TCP/IP model (Link · Internet · Transport · Application) is what they actually run on.
Generative AI is now woven through the whole field — a sharper threat, a new attack surface, and a powerful defensive tool all at once. Every pillar above now has an AI dimension.
LLMs write flawless phishing in any language, clone voices for fraud, and speed up malware and reconnaissance. Assume attackers move faster — and verify by context, never by how convincing something sounds.
The most common AI risk today is an employee pasting sensitive data into a public chatbot. Classify your data, approve specific tools, and keep confidential information out of external models.
The same technology strengthens defence: anomaly detection, alert triage that cuts false positives, log summarisation, and faster incident analysis for stretched security teams.
AI systems are information assets — inventory them, classify their risk, and apply the same access, logging and third-party controls. In the Kingdom, SDAIA's principles and the ECC already apply.
The National Cybersecurity Authority sets the cybersecurity baseline for the Kingdom. Know its mandate, the structure of ECC-2:2024, who must comply, and how compliance is actually assessed.
The 2024 revision streamlined ECC-1:2018 (which had 5 domains and 114 controls) into four sharper domains. Here's the map:
Strategy · management · policies & procedures · roles & responsibilities · risk management · project management · compliance · periodical review & audit · human resources · awareness & training.
15 subdomains: asset management · identity & access management (2-2) · systems protection · email · network · mobile devices · data protection · cryptography · backup · vulnerabilities · pentesting · logs & monitoring · incident & threat management · physical security · web applications.
One subdomain (3-1): cybersecurity resilience aspects of Business Continuity Management — keeping critical services running through and after an incident.
Two subdomains: third-party cybersecurity (4-1) and cloud computing & hosting cybersecurity (4-2) — eight controls governing every external dependency.
The ECC is the baseline. Depending on what your entity is and what it runs, additional NCA control sets apply on top:
Essential Cybersecurity Controls — the minimum for government agencies and CNI operators. Everything else builds on it.
Critical Systems Cybersecurity Controls — stricter requirements for systems whose disruption has national-level impact.
Cloud Cybersecurity Controls — obligations for both cloud service providers and cloud service tenants.
Data Cybersecurity Controls — protecting data across its lifecycle, aligned with national data classification.
Operational Technology Cybersecurity Controls — for ICS/OT environments in industrial and utility sectors.
Telework Cybersecurity Controls — securing remote-work systems and the people who use them.
Organizations' Social Media Accounts Cybersecurity Controls — protecting official accounts from hijacking and misuse.
The financial sector's Cyber Security Framework from the Saudi Central Bank — a sector regulator's overlay, alongside (not from) the NCA.
ECC: government agencies and affiliates, plus private-sector owners, operators or hosts of Critical National Infrastructure.
Each entity complies with every control applicable to it: applicability is scoped by what you are and what you run. Subdomain 4-2 binds only cloud users; 2-15 only those exposing web apps; sector overlays (SAMA CSF) and stricter sets (CSCC, OTCC) layer on top. Document your applicability decisions — "not applicable" is an auditable claim.
NCA evaluates via entity self-assessment, periodic reports through the ECC-2:2024 Assessment & Compliance Tool, and field audit visits.
Compliance is ongoing, not annual theatre: periodic reviews are built into the controls themselves (2-2-4, 4-1-4, 4-2-4...).
AI governance in the Kingdom sits alongside the NCA's cybersecurity mandate. If your entity builds or deploys AI, these are the instruments IT and security teams must know.
SDAIA's Principles and Controls of AI Ethics set the national framework for responsible AI — fairness, privacy & security, reliability & safety, transparency, accountability, humanity, and social benefit — with a risk-based classification applied across the AI lifecycle.
Issued in two editions — one for government employees, one for the public — covering responsible adoption, transparency, human oversight and incident handling for GenAI systems, cross-referencing existing cybersecurity and procurement rules.
There is no AI exemption: AI workloads are information and technology assets, so ECC controls apply in full — identity and access (2-2) for model endpoints and pipelines, third-party rules (4-1/4-2) for AI vendors and cloud-hosted models, logging (2-12) for AI platforms.
The Personal Data Protection Law (PDPL) governs personal data feeding AI systems. There is no dedicated AI law yet — the Kingdom governs AI through SDAIA's frameworks, while the draft Global AI Hub Law (2025 consultation) focuses on "data embassies", and SDAIA has declared 2026 the Year of AI. Build compliance-ready AI practices now.
Every application your teams build is production attack surface. This module covers the secure development lifecycle, the attacks that exploit rushed code, and the ECC controls — 1-6-3 and 2-15 — that make security a requirement, not a patch.
Security requirements written alongside functional ones — data classification, authn/authz needs, regulatory constraints (ECC 1-6-1).
Threat modeling: what can go wrong, who attacks, what hurts most. Multi-tier architecture decided here (2-15-3-2).
Secure coding standards (1-6-3-1), trusted and licensed tools and libraries (1-6-3-2), no secrets in source, peer review.
SAST, DAST, dependency and secrets scanning in CI; compliance testing against the entity's cybersecurity requirements (1-6-3-3).
Secure config and hardening review before launch (1-6-3-5), WAF and HTTPS in front (2-15-3), then monitor, patch, and periodically review (2-15-4).
Two subdomains anchor application security: 1-6 makes security part of every project, and 2-15 protects what you expose to the internet.
AI coding assistants accelerate delivery — and replicate insecure patterns at scale. Meanwhile, the LLM features you embed in products open a brand-new attack surface. Both need engineering discipline.
Assistants reproduce the patterns they were trained on — including vulnerable ones — with confident, plausible-looking output. AI code gets zero trust: same review, same SAST, same compliance testing (1-6-3-3) as human code.
Assistants sometimes suggest packages that don't exist — until an attacker registers them with malware inside ("slopsquatting"). Verify every suggested dependency against trusted, licensed sources (1-6-3-2) before installing.
If your app feeds user content, documents or web pages into an LLM, attackers can embed instructions that hijack the model's behaviour — exfiltrating data or triggering tool actions. Treat all model input as untrusted, and model output as untrusted too.
Use AI to strengthen the pipeline: AI-assisted code review, smarter SAST triage that cuts false positives, test-case generation, and anomaly detection on application behaviour in production.
20 questions, sampled from all five modules and re-shuffled on every attempt. Score 80% (16/20) to unlock your Certificate of Achievement. You can retake the exam as many times as you like — only a passing attempt counts.
for successfully completing the interactive Cybersecurity Essentials Training Program covering Third-Party Risk Management, Identity & Access Management, Application Development Security, Cybersecurity Fundamentals, and NCA Regulation Awareness (ECC-2:2024), passing the final exam with a score of —.