Part 0 — Start here
0.1 Who this is for, and what the first guide assumed
You should be comfortable, without looking things up, with: the CIA triad and trust boundaries; hashing vs encryption vs encoding; AEAD and nonce discipline; public-key crypto, signatures, and PKI; the TLS 1.3 handshake; SSH keys and CAs; the OWASP Top 10 bug classes and their fixes; OAuth 2.0 authorization-code + PKCE and OIDC; secrets management; STRIDE threat modeling; and the incident response lifecycle. All of that is G1 (the first guide). If two or more of those are fuzzy, spend a week back there first — everything here builds on them.
| You are... | This guide fits? |
|---|---|
| A software engineer who finished G1 and now owns security for a cloud service | Yes — this is the target reader |
| A security engineer moving from "web pentest" into cloud / platform / detection | Yes |
| An SRE or platform engineer who needs to secure Kubernetes and CI/CD properly | Yes |
| A security manager who wants to understand what their engineers are doing | Mostly — skim the hands-on, read the "Where we are" and program chapters |
| Brand new to security | No — read G1 first |
| Preparing for OSCP-style binary exploitation | Partly — this is defence-and-appsec-heavy; see Ch 69 for that track |