Academy track
Penetration Testing
Penetration testing as a workmanlike practice. PEN-101 walks the full kill chain from reconnaissance through post-exploitation on academy-hosted CTF targets. The lab discipline (write your own tools when commercial frameworks lie to you; document every step in a real client-facing report; map every finding to a CVE or a primitive) is the differentiator.