A firewall blocks traffic, but a SOC finds the enemy already inside. In this video, Sec Guy breaks down the Tiered SOC Model (Analysts vs. Hunters), explains the critical math of Detection Engineering (Precision vs. Recall), and shows how UEBA uses Machine Learning to catch the "Insider Threat" that traditional rules miss.

🔥🔥New Security+ SYO-801 Study Guide Available today: secguy.org/security-study-guide 🔥🔥

[Exam Ready Route - FREE]

Pass your certification for $0.

✅ Training Videos & Practice Tests

✅ Sec Guy Mobile Lab (On-the-go training powered by AI voice)

✅ Discord Access (Study sessions & Industry networking)

👉 Start Here: https://secguy.org

[Job Ready Route - MEMBERSHIP]

Stop studying and start working. Get the hands-on experience hiring managers are asking for.

🔥 Hands-On Labs: Python, Encryption, Hashing, AI, & CTFs

🔥 Salary Negotiator Workshop

🔥 Experience Builder: Real-world projects to fill your resume

👉 Get Hired: https://secguy.org

[Exam Domain Checklist]

This video covers critical objectives for the following exams:

Security+

[ ] Domain 4.1: Security Operations (SOC Roles, Playbooks, Runbooks)

[ ] Domain 4.2: Monitoring and Detection (SIEM, UEBA, SOAR)

[ ] Domain 2.3: Indicators of Malicious Activity (False Positives vs. True Positives)

CISSP

[ ] Domain 7: Security Operations (Logging and Monitoring Activities)

[ ] Domain 1: Security and Risk Management (Security Governance & Roles)

CISM

[ ] Domain 4: Information Security Incident Management (Incident Response Capabilities)

CRISC

[ ] Domain 4: Risk and Control Monitoring (Key Performance Indicators - KPI/KRI)

CCSP

[ ] Domain 5: Cloud Security Operations (Cloud Logging & Monitoring)

SecurityX (CompTIA)

[ ] Domain 3.0: Security Operations (Threat Detection Engineering & Detection as Code)

GIAC GSEC (SANS)

[ ] Incident Handling & Response: SIEM & Log Analysis

AWS CSS (Certified Security – Specialty)

[ ] Domain 4: Incident Response (Centralized Logging with CloudWatch & Security Hub)

Pentest+ (CompTIA)

[ ] Domain 5: Reporting and Communication (Avoiding Detection by SOC)

CEH (Certified Ethical Hacker)

[ ] Domain 1: Information Security Overview (SOC Functions & SIEM Concepts)

SecAI+

[ ] AI Security: Using AI for Anomaly Detection (UEBA) vs. Traditional Rules

[Timestamps]

0:00 - Intro: Manning the Watchtowers

0:25 - The Tiered SOC Model: Tier 1 (Triage), Tier 2 (IR), Tier 3 (Hunters)

1:00 - Detection Engineering: Precision (Quality) vs. Recall (Quantity)

1:40 - UEBA (User & Entity Behavior Analytics): Catching the Insider

2:20 - The SIEM Pipeline: Collection, Normalization, Correlation

3:00 - Cloud Architecture: Security Data Lake vs. SIEM Cost

3:30 - Detection as Code: Git-based Rules & Version Control

3:50 - SOAR (Security Orchestration, Automation, and Response)

4:15 - Summary: Data is Noise until it's Actionable

4:35 - Outro: Stay Safe, Stay Secure.

Original Sec Guy video: https://www.youtube.com/watch?v=H1yf0HuiWNQ

In a cloud-native world, your code is your infrastructure. If the code is hollow, the fortress falls. In this video, Sec Guy breaks down the Secure SDLC, explains how to use STRIDE for Threat Modeling, and details the difference between SAST (Whitebox) and DAST (Blackbox) testing. We also tackle the #1 API threat: BOLA (Broken Object Level Authorization).

🔥🔥New Security+ SYO-801 Study Guide Available today: secguy.org/security-study-guide 🔥🔥

[Exam Ready Route - FREE]

Pass your certification for $0.

✅ Training Videos & Practice Tests

✅ Sec Guy Mobile Lab (On-the-go training powered by AI voice)

✅ Discord Access (Study sessions & Industry networking)

👉 Start Here: https://secguy.org

[Job Ready Route - MEMBERSHIP]

Stop studying and start working. Get the hands-on experience hiring managers are asking for.

🔥 Hands-On Labs: Python, Encryption, Hashing, AI, & CTFs

🔥 Salary Negotiator Workshop

🔥 Experience Builder: Real-world projects to fill your resume

👉 Get Hired: https://secguy.org

[Exam Domain Checklist]

This video covers critical objectives for the following exams:

Security+

[ ] Domain 3.2: Application Security (OWASP Top 10, Injection, BOLA)

[ ] Domain 4.2: Security Operations (Vulnerability Scanning: SAST, DAST)

[ ] Domain 5.1: Risk Management (Supply Chain Risk, SBOM)

CISSP

[ ] Domain 8: Software Development Security (SDLC, STRIDE, Fuzzing)

[ ] Domain 3: Security Architecture (High Cohesion, Low Coupling, Encapsulation)

CISM

[ ] Domain 3: Information Security Program (Secure Development Practices)

CRISC

[ ] Domain 2: IT Risk Assessment (Application Vulnerabilities)

CCSP

[ ] Domain 4: Cloud Application Security (SAST/DAST in CI/CD, API Security)

SecurityX (CompTIA)

[ ] Domain 2.0: Security Architecture (Secure Coding Practices & Input Validation)

GIAC GSEC (SANS)

[ ] Application Security: OWASP, Fuzzing, & Defense in Depth

AWS CSS (Certified Security – Specialty)

[ ] Domain 5: Data Protection (Encryption at Rest/Transit in Apps)

Pentest+ (CompTIA)

[ ] Domain 3: Attacks and Exploits (SQL Injection, XSS, IDOR/BOLA)

CEH (Certified Ethical Hacker)

[ ] Domain 10: Web Server & Application Hacking (OWASP Top 10)

SecAI+

[ ] AI Security: AI-Generated Code Vulnerabilities & Supply Chain Attacks

[Timestamps]

0:00 - Intro: Code is Infrastructure

0:25 - Environment Isolation: Dev, Test, Staging, Prod (Data Masking)

0:48 - Threat Modeling: The STRIDE Framework (Spoofing, Tampering, etc.)

1:06 - Secure Design Patterns: Encapsulation & Polymorphism

1:24 - CISSP Concepts: High Cohesion vs. Low Coupling

1:40 - Testing: Fuzzing (Mutation vs. Generational)

2:06 - Defending Against Injection: Input Validation vs. Parameterization

2:31 - API Security: BOLA (Broken Object Level Authorization) & IDOR

3:00 - Supply Chain Security: SCA & SBOM (Software Bill of Materials)

3:13 - The Toolchain: SAST (Whitebox) vs. DAST (Blackbox)

3:26 - Runtime Defense: IAST & RASP (The Bodyguard)

3:44 - Summary: Security is an Architectural Requirement

3:52 - Outro: Stay Safe, Stay Secure.

Original Sec Guy video: https://www.youtube.com/watch?v=f31bpUbkefs

A deep dive into the vulnerability lifecycle. We cover authenticated vs. agent-based scanning, the shift from CVSS severity to EPSS probability, and how to build a Risk-Based Vulnerability Management (RBVM) program.

New Security+ SYO-801 Study Guide Available today: secguy.org/security-study-guide

Timestamps:

00:00 – Intro: The Maintenance of the Fortress

01:15 – Asset Discovery: The "Step Zero"

02:30 – Scanning: Authenticated, Unauthenticated, and Agent-based

04:00 – CVSS Explained: Base, Temporal, and Environmental

05:30 – Prioritization: EPSS and the CISA KEV Catalog

07:15 – The Patch Lifecycle and Regression Testing

08:45 – Vulnerability Disclosure Programs (VDP)

10:00 – Outro and Labs (secguy.org)

Original Sec Guy video: https://www.youtube.com/watch?v=Ct5ILeDSM5w

It isn't enough to know the phases; you have to master the mechanics. In this video, Sec Guy goes deep into the offensive toolkit. We move from Passive Reconnaissance to Active Scanning with Nmap and hping3, explain how to poison networks with Responder, and show you how to automate SQL Injection with SQLMap. If you are studying for CEH or PenTest+, this is your tactical field guide.

New Security+ SYO-801 Study Guide Available today: secguy.org/security-study-guide

[Exam Ready Route - FREE]

Pass your certification for $0.

✅ Training Videos & Practice Tests

✅ Sec Guy Mobile Lab (On-the-go training powered by AI voice)

✅ Discord Access (Study sessions & Industry networking)

👉 Start Here: https://secguy.org

[Job Ready Route - MEMBERSHIP]

Stop studying and start working. Get the hands-on experience hiring managers are asking for.

🔥 Hands-On Labs: Python, Encryption, Hashing, AI, & CTFs

🔥 Salary Negotiator Workshop

🔥 Experience Builder: Real-world projects to fill your resume

👉 Get Hired: https://secguy.org

[Exam Domain Checklist]

This video covers critical objectives for the following exams:

Security+

[ ] Domain 4.2: Security Operations (Vulnerability Scanning vs. Penetration Testing)

[ ] Domain 2.2: Vulnerabilities (SQL Injection, XSS)

CISSP

[ ] Domain 6: Security Assessment and Testing (Penetration Testing Methodologies)

CISM

[ ] Domain 3: Information Security Program (Managing Technical Assessments)

CRISC

[ ] Domain 2: IT Risk Assessment (Technical Vulnerabilities & Exploits)

CCSP

[ ] Domain 4: Cloud Application Security (OWASP Testing)

SecurityX (CompTIA)

[ ] Domain 3.0: Security Operations (Advanced Enumeration & Exploitation)

GIAC GSEC (SANS)

[ ] Penetration Testing: Tools & Techniques (Nmap, Metasploit)

AWS CSS (Certified Security – Specialty)

[ ] Domain 1: Threat Detection (Recognizing Port Scanning & Enumeration)

Pentest+ (CompTIA)

[ ] Domain 3: Attacks and Exploits (Network Attacks, Web App Attacks, Wireless Attacks)

[ ] Domain 2: Information Gathering (Nmap, Enumeration)

CEH (Certified Ethical Hacker)

[ ] Domain 3: Scanning Networks (Nmap, Hping3)

[ ] Domain 4: Enumeration (SNMP, SMB, RPC)

[ ] Domain 10: Web Server Hacking (SQLMap, XSS)

SecAI+

[ ] AI Security: Automating Vulnerability Scanning with AI Agents

[Timestamps]

0:00 - Intro: From Passive Observer to Active Explorer

0:23 - Scanning: Packet Crafting with Hping3 & Nmap (Idle Scans)

0:40 - Enumeration: Extracting Usernames via SNMP, RPC, and SMB (Enum4Linux)

1:16 - System Hacking: Cracking Passwords & Escalating Privileges

1:26 - Network Poisoning: LLMNR/NBT-NS with Responder

1:37 - Password Cracking: Hashcat & John the Ripper

1:53 - Web App Hacking: SQL Injection (SQLMap) & XSS (BeEF)

2:24 - Wireless Hacking: Aircrack-ng (WPA2 Handshakes) & Reaver (WPS)

2:49 - Mobile & IoT: ADB & MobSF (APK Analysis)

3:00 - Cloud Exploitation: S3 Buckets & Container Escape

3:16 - Post-Exploitation: Clearing Tracks (Shred Command & Event Viewer)

3:39 - Outro: Get the Reps In.

Original Sec Guy video: https://www.youtube.com/watch?v=UXHs3dsmPGQ

Welcome to the Sec Guy Channel and the start of your journey to becoming a cybersecurity professional! 🛡️ This is the first video in our comprehensive training series designed to help you pass the new CompTIA Security+ (SY0-701) exam.

In this foundational video, "Exam Overview," we're breaking down everything you need to know before you start studying the core content. Understanding the exam logistics is the first step to success!

🔑 What We Cover:

Exam Logistics: Format, number of questions, and scoring.

PBQs & Multiple Choice: What to expect from different question types.

Exam Objectives: A high-level look at the six domains you need to master.

Study Tips: Strategies for approaching the exam effectively.

Whether you're new to IT or looking to formalize your security knowledge, this series is for you.

🔔 Don't forget to Like, Comment, and Subscribe for more cybersecurity training! Hit the notification bell so you don't miss the next video in this series.

➡️ Next Video in the Series: [Link to next video when available]

📚 Resources Mentioned:

CompTIA Security+ (SY0-701) Objectives: https://www.comptia.org/en-us/certifications/security/

Recommended Study Materials:

Cheat Sheet: https://mega.nz/file/rVdWnQCL#oL80-0nSlu3_bs35fc52CO8UGCLmkqBC7way0CDKgZM

Practice Test

Domain 1: Test A: https://mega.nz/file/XYNySIYA#IG57yLOhdlD5VvMd1AdHTXaD9fVJg4ISsK7t9LRBIjQ

Domain 1: Test B: https://mega.nz/file/3IsSWQyD#Ak4Y0MOfqzOXBdSjTu0twaDsQqG-5OKQrwo0m8vYFZ4

Domain 1: Test C: https://mega.nz/file/6BVghCYS#vycOnNv3KkRRK0e7MMvSQ0gSFTw05FgmgSOlAMOjGcA

Domain 1: Test D: https://mega.nz/file/jZMkGLII#wc74MYCpBKWkM44mLFKcX4mrTngr-Q1bQ5rE1Xk6Xso

Connect with My Sec Guy Channel:

📘 Facebook: https://www.facebook.com/share/1HGdh1m51U/

#CompTIA #SecurityPlus #SY0701 #CybersecurityTraining #ITCertification #MySecGuy #ExamOverview #CyberSec #ITSecurity

Original Sec Guy video: https://www.youtube.com/watch?v=PjvDwhUA_GA

You don't need a zero-day exploit to hack a Fortune 500 company—you just need a phone and a story. In this video, Sec Guy breaks down the MGM Resorts Breach, explaining how attackers used Vishing to trick a help desk into resetting credentials. We also cover the rise of AI Deepfakes in CEO Fraud, why Tailgating works because of human courtesy, and how Business Email Compromise (BEC) stole $100M from Facebook and Google.

New Security+ SYO-801 Study Guide Available today: secguy.org/security-study-guide

[Exam Ready Route - FREE]

Pass your certification for $0.

✅ Training Videos & Practice Tests

✅ Sec Guy Mobile Lab (On-the-go training powered by AI voice)

✅ Discord Access (Study sessions & Industry networking)

👉 Start Here: https://secguy.org

[Job Ready Route - MEMBERSHIP]

Stop studying and start working. Get the hands-on experience hiring managers are asking for.

🔥 Hands-On Labs: Python, Encryption, Hashing, AI, & CTFs

🔥 Salary Negotiator Workshop

🔥 Experience Builder: Real-world projects to fill your resume

👉 Get Hired: https://secguy.org

[Exam Domain Checklist]

This video covers critical objectives for the following exams:

Security+

[ ] Domain 2.4: Social Engineering (Phishing, Vishing, Smishing, BEC, Pretexting)

[ ] Domain 2.1: Threat Actors (Motivation: Financial vs. Chaos)

CISSP

[ ] Domain 1: Security and Risk Management (Social Engineering Training & Awareness)

[ ] Domain 7: Security Operations (Physical Security: Tailgating & Piggybacking)

CISM

[ ] Domain 3: Information Security Program (Human Firewall & Security Culture)

CRISC

[ ] Domain 2: IT Risk Assessment (Human Element Risks)

CCSP

[ ] Domain 1: Cloud Concepts (Social Engineering Cloud Admins)

SecurityX (CompTIA)

[ ] Domain 3.0: Security Operations (Analyzing Social Engineering Campaigns)

GIAC GSEC (SANS)

[ ] Social Engineering: Principles of Persuasion (Authority, Consensus, Urgency)

AWS CSS (Certified Security – Specialty)

[ ] Domain 1: Threat Detection (Identifying Compromised Credentials via Phishing)

Pentest+ (CompTIA)

[ ] Domain 3: Attacks and Exploits (Social Engineering: Pretexting & Elicitation)

[ ] Domain 1: Planning and Scoping (Physical Assessments: Tailgating)

CEH (Certified Ethical Hacker)

[ ] Domain 9: Social Engineering (Types, Phases, & Countermeasures)

SecAI+

[ ] AI Security: Deepfake Audio & Synthetic Voice Attacks (Vishing)

[Timestamps]

0:00 - Intro: Hacking Humans, Not Hardware

0:22 - Case Study: MGM Resorts (Vishing the Help Desk)

1:08 - AI Threats: Synthetic Voice & Deepfake CEO Fraud

1:40 - Physical Security: Tailgating & Piggybacking (The Pizza Trick)

2:03 - Reconnaissance: Dumpster Diving for Intel

2:30 - Business Email Compromise (BEC): The $100M Invoice Scam

3:13 - Defense: Out-of-Band Verification

3:30 - Summary: The Human Firewall

3:50 - Outro: Stay Safe, Stay Secure.

Original Sec Guy video: https://www.youtube.com/watch?v=VKcS9eeH4Ys

Firewalls aren't enough. To build a true defense-in-depth strategy, you need to understand the three pillars of security controls: Preventive, Detective, and Corrective. In this video, Sec Guy breaks down how these controls work together to secure your network, using real-world analogies to make the concepts stick for your exam and your career.

[Exam Ready Route - FREE]

Pass your certification for $0.

✅ Training Videos & Practice Tests

✅ Sec Guy Mobile Lab (On-the-go training powered by AI voice)

✅ Discord Access (Study sessions & Industry networking)

👉 Start Here: https://secguy.org

[Job Ready Route - MEMBERSHIP]

Stop studying and start working. Get the hands-on experience hiring managers are asking for.

🔥 Hands-On Labs: Python, Encryption, Hashing, AI, & CTFs

🔥 Salary Negotiator Workshop

🔥 Experience Builder: Real-world projects to fill your resume

👉 Get Hired: https://secguy.org

[Exam Domain Checklist]

This video covers critical objectives for the following exams:

Security+ (SY0-701)

[ ] Domain 1.2: Types of Security Controls (Preventive, Detective, Corrective)

CISSP

[ ] Domain 3: Security Architecture (Control Selection)

[ ] Domain 7: Security Operations (Foundational Concepts)

CISM

[ ] Domain 3: Information Security Program (Control Design & Implementation)

CRISC

[ ] Domain 3: Risk Response and Reporting (Control Design)

CCSP

[ ] Domain 1: Cloud Concepts & Architecture (Control Frameworks)

SecurityX (CompTIA)

[ ] Domain 1.0: Security Architecture (Enterprise Security Controls)

GIAC GSEC (SANS)

[ ] Network Security Essentials: Defense in Depth & Access Controls

AWS CSS (Certified Security – Specialty)

[ ] Domain 2: Infrastructure Security (Security Groups/NACLs as Preventive Controls)

Pentest+ (CompTIA)

[ ] Domain 3: Attacks and Exploits (Understanding Defenses to Bypass Them)

CEH (Certified Ethical Hacker)

[ ] Domain 1: Information Security Overview (Defense in Depth Fundamentals)

SecAI+

[ ] AI Security Fundamentals: Implementing Guardrails (Preventive Controls)

[Timestamps]

0:00 - Intro: The 3 Types of Security Controls

0:58 - Preventive Controls: The Frontline Defenders (Firewalls, MFA)

2:27 - Detective Controls: Spotting the Suspicious (IDS, Logs)

3:42 - Corrective Controls: Fixing the Damage (Backups, Patching)

4:42 - Summary: Building Defense in Depth

5:32 - Outro: Stay Safe, Stay Secure.

#CompTIASecurityPlus #CISSP #CISM #CyberSecurity #InfoSec #SecurityControls #SecGuy #SY0701 #NetworkDefense #CRISC #CCSP #ITTraining

Original Sec Guy video: https://www.youtube.com/watch?v=cjMqzX1Vs0Q

If your data is breached in the cloud, is it Amazon's fault or yours? In this video, Sec Guy breaks down the Shared Responsibility Model, explaining why Capital One was liable for their massive breach (SSRF) despite using a secure cloud provider. We also cover the evolution from IaaS to Serverless (FaaS) and why Data Sovereignty (Microsoft Ireland Case) means your data is subject to the laws of the physical land it sits on.

New Security+ SYO-801 Study Guide Available today: secguy.org/security-study-guide

[Exam Ready Route - FREE]

Pass your certification for $0.

✅ Training Videos & Practice Tests

✅ Sec Guy Mobile Lab (On-the-go training powered by AI voice)

✅ Discord Access (Study sessions & Industry networking)

👉 Start Here: https://secguy.org

[Job Ready Route - MEMBERSHIP]

Stop studying and start working. Get the hands-on experience hiring managers are asking for.

🔥 Hands-On Labs: Python, Encryption, Hashing, AI, & CTFs

🔥 Salary Negotiator Workshop

🔥 Experience Builder: Real-world projects to fill your resume

👉 Get Hired: https://secguy.org

[Exam Domain Checklist]

This video covers critical objectives for the following exams:

Security+

[ ] Domain 3.2: Cloud Computing Concepts (IaaS, PaaS, SaaS, Public/Private/Hybrid)

[ ] Domain 5.3: Third-Party Risk Management (Shared Responsibility Model)

[ ] Domain 2.2: Vulnerabilities (SSRF - Server-Side Request Forgery)

CISSP

[ ] Domain 3: Security Architecture (Cloud Service Models & Microservices)

[ ] Domain 1: Security and Risk Management (Legal & Regulatory Issues - Data Sovereignty)

CISM

[ ] Domain 2: Information Risk Management (Cloud Risk Assessment)

CRISC

[ ] Domain 2: IT Risk Assessment (Outsourcing & Cloud Vendor Risk)

CCSP

[ ] Domain 1: Cloud Concepts (IaaS, PaaS, SaaS, FaaS, Shared Responsibility)\

[ ] Domain 6: Legal, Risk, and Compliance (Cross-Border Data Transfer & GDPR)

SecurityX (CompTIA)

[ ] Domain 2.0: Security Architecture (Cloud Native Security Controls - CNAPP, CWPP, CSPM)

GIAC GSEC (SANS)

[ ] Cloud Security: Fundamentals & Shared Responsibility

AWS CSS (Certified Security – Specialty)

[ ] Domain 2: Infrastructure Security (Shared Responsibility Model)

Pentest+ (CompTIA)

[ ] Domain 3: Attacks and Exploits (Cloud Metadata Attacks & SSRF)

CEH (Certified Ethical Hacker)

[ ] Domain 11: Cloud Computing (Cloud Attacks & Misconfigurations)

SecAI+

[ ] AI Security: Securing AI Models on Serverless Infrastructure (FaaS)

[Timestamps]

0:00 - Intro: The Cloud is Just Someone Else's Computer?

0:37 - IaaS (Infrastructure as a Service): Renting the House (AWS EC2)

1:00 - PaaS (Platform as a Service): Staying in a Hotel (Google App Engine)

1:23 - SaaS (Software as a Service): Dining Out (Salesforce, Gmail)

1:38 - FaaS (Serverless): The Ultimate Abstraction (AWS Lambda)

2:10 - The Shared Responsibility Model: Security "OF" vs. Security "IN"

2:45 - Case Study: Capital One Breach (SSRF & Misconfiguration)

3:30 - Data Sovereignty: The Microsoft Ireland Case & GDPR

4:20 - The Cloud Security Stack: CSPM, CWPP, CASB, & CNAPP

5:20 - Summary: Control vs. Convenience

5:40 - Outro: Stay Safe, Stay Secure.

Original Sec Guy video: https://www.youtube.com/watch?v=oxDZf-7dzVQ