A firewall blocks traffic, but a SOC finds the enemy already inside. In this video, Sec Guy breaks down the Tiered SOC Model (Analysts vs. Hunters), explains the critical math of Detection Engineering (Precision vs. Recall), and shows how UEBA uses Machine Learning to catch the "Insider Threat" that traditional rules miss.

🔥🔥New Security+ SYO-801 Study Guide Available today: secguy.org/security-study-guide 🔥🔥

[Exam Ready Route - FREE]

Pass your certification for $0.

✅ Training Videos & Practice Tests

✅ Sec Guy Mobile Lab (On-the-go training powered by AI voice)

✅ Discord Access (Study sessions & Industry networking)

👉 Start Here: https://secguy.org

[Job Ready Route - MEMBERSHIP]

Stop studying and start working. Get the hands-on experience hiring managers are asking for.

🔥 Hands-On Labs: Python, Encryption, Hashing, AI, & CTFs

🔥 Salary Negotiator Workshop

🔥 Experience Builder: Real-world projects to fill your resume

👉 Get Hired: https://secguy.org

[Exam Domain Checklist]

This video covers critical objectives for the following exams:

Security+

[ ] Domain 4.1: Security Operations (SOC Roles, Playbooks, Runbooks)

[ ] Domain 4.2: Monitoring and Detection (SIEM, UEBA, SOAR)

[ ] Domain 2.3: Indicators of Malicious Activity (False Positives vs. True Positives)

CISSP

[ ] Domain 7: Security Operations (Logging and Monitoring Activities)

[ ] Domain 1: Security and Risk Management (Security Governance & Roles)

CISM

[ ] Domain 4: Information Security Incident Management (Incident Response Capabilities)

CRISC

[ ] Domain 4: Risk and Control Monitoring (Key Performance Indicators - KPI/KRI)

CCSP

[ ] Domain 5: Cloud Security Operations (Cloud Logging & Monitoring)

SecurityX (CompTIA)

[ ] Domain 3.0: Security Operations (Threat Detection Engineering & Detection as Code)

GIAC GSEC (SANS)

[ ] Incident Handling & Response: SIEM & Log Analysis

AWS CSS (Certified Security – Specialty)

[ ] Domain 4: Incident Response (Centralized Logging with CloudWatch & Security Hub)

Pentest+ (CompTIA)

[ ] Domain 5: Reporting and Communication (Avoiding Detection by SOC)

CEH (Certified Ethical Hacker)

[ ] Domain 1: Information Security Overview (SOC Functions & SIEM Concepts)

SecAI+

[ ] AI Security: Using AI for Anomaly Detection (UEBA) vs. Traditional Rules

[Timestamps]

0:00 - Intro: Manning the Watchtowers

0:25 - The Tiered SOC Model: Tier 1 (Triage), Tier 2 (IR), Tier 3 (Hunters)

1:00 - Detection Engineering: Precision (Quality) vs. Recall (Quantity)

1:40 - UEBA (User & Entity Behavior Analytics): Catching the Insider

2:20 - The SIEM Pipeline: Collection, Normalization, Correlation

3:00 - Cloud Architecture: Security Data Lake vs. SIEM Cost

3:30 - Detection as Code: Git-based Rules & Version Control

3:50 - SOAR (Security Orchestration, Automation, and Response)

4:15 - Summary: Data is Noise until it's Actionable

4:35 - Outro: Stay Safe, Stay Secure.

Original Sec Guy video: https://www.youtube.com/watch?v=H1yf0HuiWNQ

In a cloud-native world, your code is your infrastructure. If the code is hollow, the fortress falls. In this video, Sec Guy breaks down the Secure SDLC, explains how to use STRIDE for Threat Modeling, and details the difference between SAST (Whitebox) and DAST (Blackbox) testing. We also tackle the #1 API threat: BOLA (Broken Object Level Authorization).

🔥🔥New Security+ SYO-801 Study Guide Available today: secguy.org/security-study-guide 🔥🔥

[Exam Ready Route - FREE]

Pass your certification for $0.

✅ Training Videos & Practice Tests

✅ Sec Guy Mobile Lab (On-the-go training powered by AI voice)

✅ Discord Access (Study sessions & Industry networking)

👉 Start Here: https://secguy.org

[Job Ready Route - MEMBERSHIP]

Stop studying and start working. Get the hands-on experience hiring managers are asking for.

🔥 Hands-On Labs: Python, Encryption, Hashing, AI, & CTFs

🔥 Salary Negotiator Workshop

🔥 Experience Builder: Real-world projects to fill your resume

👉 Get Hired: https://secguy.org

[Exam Domain Checklist]

This video covers critical objectives for the following exams:

Security+

[ ] Domain 3.2: Application Security (OWASP Top 10, Injection, BOLA)

[ ] Domain 4.2: Security Operations (Vulnerability Scanning: SAST, DAST)

[ ] Domain 5.1: Risk Management (Supply Chain Risk, SBOM)

CISSP

[ ] Domain 8: Software Development Security (SDLC, STRIDE, Fuzzing)

[ ] Domain 3: Security Architecture (High Cohesion, Low Coupling, Encapsulation)

CISM

[ ] Domain 3: Information Security Program (Secure Development Practices)

CRISC

[ ] Domain 2: IT Risk Assessment (Application Vulnerabilities)

CCSP

[ ] Domain 4: Cloud Application Security (SAST/DAST in CI/CD, API Security)

SecurityX (CompTIA)

[ ] Domain 2.0: Security Architecture (Secure Coding Practices & Input Validation)

GIAC GSEC (SANS)

[ ] Application Security: OWASP, Fuzzing, & Defense in Depth

AWS CSS (Certified Security – Specialty)

[ ] Domain 5: Data Protection (Encryption at Rest/Transit in Apps)

Pentest+ (CompTIA)

[ ] Domain 3: Attacks and Exploits (SQL Injection, XSS, IDOR/BOLA)

CEH (Certified Ethical Hacker)

[ ] Domain 10: Web Server & Application Hacking (OWASP Top 10)

SecAI+

[ ] AI Security: AI-Generated Code Vulnerabilities & Supply Chain Attacks

[Timestamps]

0:00 - Intro: Code is Infrastructure

0:25 - Environment Isolation: Dev, Test, Staging, Prod (Data Masking)

0:48 - Threat Modeling: The STRIDE Framework (Spoofing, Tampering, etc.)

1:06 - Secure Design Patterns: Encapsulation & Polymorphism

1:24 - CISSP Concepts: High Cohesion vs. Low Coupling

1:40 - Testing: Fuzzing (Mutation vs. Generational)

2:06 - Defending Against Injection: Input Validation vs. Parameterization

2:31 - API Security: BOLA (Broken Object Level Authorization) & IDOR

3:00 - Supply Chain Security: SCA & SBOM (Software Bill of Materials)

3:13 - The Toolchain: SAST (Whitebox) vs. DAST (Blackbox)

3:26 - Runtime Defense: IAST & RASP (The Bodyguard)

3:44 - Summary: Security is an Architectural Requirement

3:52 - Outro: Stay Safe, Stay Secure.

Original Sec Guy video: https://www.youtube.com/watch?v=f31bpUbkefs

A deep dive into the vulnerability lifecycle. We cover authenticated vs. agent-based scanning, the shift from CVSS severity to EPSS probability, and how to build a Risk-Based Vulnerability Management (RBVM) program.

New Security+ SYO-801 Study Guide Available today: secguy.org/security-study-guide

Timestamps:

00:00 – Intro: The Maintenance of the Fortress

01:15 – Asset Discovery: The "Step Zero"

02:30 – Scanning: Authenticated, Unauthenticated, and Agent-based

04:00 – CVSS Explained: Base, Temporal, and Environmental

05:30 – Prioritization: EPSS and the CISA KEV Catalog

07:15 – The Patch Lifecycle and Regression Testing

08:45 – Vulnerability Disclosure Programs (VDP)

10:00 – Outro and Labs (secguy.org)

Original Sec Guy video: https://www.youtube.com/watch?v=Ct5ILeDSM5w