The enterprise management plane (SCCM and Intune) is trusted by design, which makes it the attack surface nobody's watching; this is the detection coverage and posture checks to start watching it.
Concentrating trust in one control plane means one compromise reaches everything it controls.
Windows 11 Recall let me pull and potentially alter exemptions without elevated privileges.
Ongoing work on making 800-series controls less of a paperwork exercise and more of something you can actually verify. (coming soon)
Real Projects. Practical Skills. Shared Knowledge. Every Month.
Cyber Lab Night is a free, monthly gathering in Colorado Springs where students, IT professionals, and experienced engineers come together to demonstrate projects, learn practical skills, and meet people who love technology.
Here's what to expect:
Got something you've built? We want to see it. Five-to-ten-minute demos, no slide decks, and no sales pitches.
Just want to watch and learn? You're welcome, too.
Whether you're building experience for your first IT job or exploring something new after years in the industry, Lab Night is a place to learn from one another.
Bring your curiosity. Build your experience. Grow your network.
Free admission. All experience levels welcome.
Hosted by Skip to Secure.
Pizza and drinks provided by Skip to Secure.
| Time | Activity |
|---|---|
| 5:30–6:15 | Optional Workshop - Week 2: AWS & STIGs - Launch your EC2 instance, secure the SG, learn to STIG and check your work. |
| 6:30–6:40 | Pizza, introductions, and getting settled. |
| 6:40–7:30 | Lightning demos. |
Come and go as your schedule allows.
Please RSVP so we can estimate food and seating. We'll email registered attendees additional details before the event.
Confirmed
Open Demo Spots
| Month | Lab | Core takeaway | Anchors |
|---|---|---|---|
| Nov 2026 | Automated STIG Hardening | Automate a security configuration change and verify that it actually worked. | RHEL 9, Ansible, SCC, STIG Viewer, GitHub |
| Dec 2026 | AWS Cloud Security | Cloud security failures often come from permissions and exposure, not exotic attacks. | EC2, IAM, S3, security groups, CloudTrail |
| Jan 2027 | Pentesting / Enumeration | Enumerate first. Understand what is exposed before trying to exploit anything. | Nmap, HTTP, service discovery, networking, controlled exploit |
| Feb 2027 | Splunk Investigation / Threat Hunting | Use logs to reconstruct what happened and find suspicious behavior. | SPL, Splunk, Linux/auth logs, timelines, MITRE ATT&CK |
| Mar 2027 | Malware Analysis | Safely inspect a suspicious file and determine what it does. | Hashes, strings, static analysis, dynamic analysis, indicators, detonation, write detection |
| Apr 2027 | Design a Secure System | Turn security requirements into a real architecture. | NIST controls, diagrams, data flows, trust boundaries, system components |
| May 2027 | Zero Trust | Access should depend on identity and policy, not simply network location. | IAM, least privilege, SSM, S3/resource policy, CloudTrail |
| Jun 2027 | Terraform + Ansible Deployment | Define infrastructure as code, deploy it, then configure it automatically. | Terraform, Ansible, AWS, Git, IAM, security groups |
And underneath almost all of them, the recurring satellites keep compounding:
AWS • Linux • SSH • Git • networking • CLI • YAML • IAM
You also will have code provided to you each week that can be customized if desired, then uploaded to github. By the end of the year you will have solid experience and an impressive github repo to match.
Registering helps ensure everyone has a desk.
We've got five community demo slots available each night. Register for one further below.
You'll have 5–15 minutes to demonstrate something interesting, explain what you learned, and answer a few questions.
No PowerPoints. No slide decks.
Show us the actual thing!
Bring your laptop, pull up your terminal, demonstrate your dashboard, or show us the hardware you've built. Got a 3D-printed component that's part of your home lab? Bring it! We'd love to see it.
Share your code on GitHub if you're willing. Maybe someone else can take your idea and build something entirely different.
Your project doesn't have to be groundbreaking. Sometimes a simple solution to an everyday problem demonstrates valuable skills and inspires someone else's next project.
You might not care about gardening, but the code behind someone's automated watering system could inspire your next sensor driven project.
That's the point. Learn something, adapt it, and build on it.
Dazzle us with your ingenuity!
Tell us what you've built, what you'll demonstrate, and what people might learn from it.
First-time presenters are strongly encouraged to submit. You don't need a fancy title, a polished presentation, or years of experience.
Five slots are available. Selected demonstrations and the featured lab topic will be announced two weeks before the event.
This is a community lab, not a vendor event.
We're here to share ideas, demonstrate things we've built, and learn from one another. That means:
We're interested in what you learned and how things work, not what you're trying to sell.
Teach us something. Don't sell us something.
Your first IT job is often your first cybersecurity job. But how do you get hands-on experience before someone gives you the opportunity?
You build it.
Whether you're exploring cybersecurity for the first time or have spent decades in the industry, you're welcome here. Bring your laptop if you'd like to follow along, experiment, or work on something of your own.
Each Lab Night also features a guided lab led by someone experienced in a weekly determined subject. We'll explore topics such as building your first home lab, AI agents, automation, networking, and practical security skills.
The goal is to walk away with something useful, something you can try yourself, and maybe someone new to learn alongside.
We want Lab Night to be a welcoming place for everyone, from first-time builders to experienced researchers.
Organizers may intervene or ask attendees to leave if they violate these expectations.
We're creating a place for curious people in Colorado Springs to build things, share what they've learned, develop practical experience, and help each other grow.
You don't need a fancy title, an impressive résumé, or a groundbreaking project.
Just bring your curiosity.
We'll bring the pizza.
Cyber Lab Night is independently organized and hosted by Skip to Secure.
Making cybersecurity accessible to everyone. We provide practical training and resources for students, newcomers, and professionals looking to sharpen their skills. Whether you just don't get the chance to do this stuff at work, you don't have time for a homelab, or you're a student looking to bridge the gap between classroom and career, we're here to help you succeed.
Our training is informed by real-world experience, not just theory. Our approach is built on the fundamental principle of defense in depth, layers of defense, because true security comes from multiple protective measures working together.
Hello! My name is Zach and I'm based in Colorado where I have spent nearly two decades working in technology across IT, infrastructure, cybersecurity, and systems engineering. I developed an enjoyment for teaching at Apple, oddly enough, breaking down complex topics for people who just needed it to make sense. That stuck with me. I still enjoy speaking and teaching whenever the opportunity is right.
This site is a place where I share tools, training, and content I wish I'd had earlier in my career. If anything here has been helpful to you, I'd genuinely love to hear about it. And if you've got constructive feedback on how to make it better, I welcome that too. Reach out anytime.
If you'd like to know a little more about me, check out My LinkedIn Profile .
CISSP | CCNA | AWS Architect | CCISO Associate | Blue Team | TCM Security | OffSec (in progress)
Stop reading about it, start doing it.
I spent years championing IT and security for school districts and a boarding school: small teams, tight budgets, and infrastructure that had to just work. I know what it's like to be the only person standing between a school network and the next disaster.
This isn't another Sec+ study guide or death-by-slideshow training. These are hands-on labs where the whole point is simple: here's the thing, now try it. The library keeps growing, with everything from Zero Trust and Vulnerability Prioritization to Incident Response, Log Analysis, and Password Security. Need something for general staff? There's phishing and cyber awareness training that's perfect for them too.
Built primarily for high school, CyberPatriot, and college programs, and just as useful for any K-12 IT staff or educator who needs to understand real threats without sitting through another webinar. See the screenshots below, and reach out if you'd like a demo or have questions. You can also follow along on LinkedIn and YouTube for updates.
No SIEM. No syslog server. No monitoring at all. You're not behind, you're just getting started.
Monitoring is one of my favorite parts of cybersecurity and honestly, one of the most undervalued. You can have policies, frameworks, and compliance checklists all day long. But if you can't see what's happening on your network, none of it means anything. A monitoring stack isn't a nice-to-have. It's the foundation everything else sits on.
No shame. No jargon walls. Just practical steps you can start on a weekend.
Free purpose-built tools for security teams that need results without enterprise overhead, in exchange for sharing your experience to help me improve the software.
Most vulnerability scanners tell you what's wrong after you've already committed. DangerMap tells you what to pick before you do. Point it at a package manifest and get a version-by-version risk landscape with migration recommendations. Not just a list of CVEs, but an actual upgrade plan with risk estimates for each path. Built for teams that want to make informed dependency choices during sprint planning, not scramble to patch after a scan kicks back findings.
You know what's in your images at build time. But do you know what's actually running in production right now? WatchBx inventories live Docker containers, detects runtime drift from the original image, and cross-references installed packages against vulnerability databases. One command gives you the full picture: what changed since deployment, what's exposed, and what to fix first. Designed for teams that need continuous container visibility for CMMC, FedRAMP, or SOC 2 without paying six figures for an enterprise platform.
Follow along for updates and additional resources:
Stickers for the people who actually read the audit findings.
These aren't motivational posters. They're inside jokes for anyone who has ever closed a CAB ticket, fought a firewall rule, or watched a git push --force go sideways. Sticker bundles, 3-pack, shipped to your door.
All orders are fulfilled by Printful and processed securely through Shopify.
Currently shipping to the US, Canada, UK, and Germany.
Skip to Secure provides free cybersecurity resources, tools, and training for professionals and educators. Its K-12 training platform does not require individual student accounts or collect student personally identifiable information (PII) through its training activities.
Skip to Secure also organizes Cyber Lab Night, a community event for students, IT professionals, cybersecurity practitioners, and technology enthusiasts. Lab Night registration and demonstration submissions involve limited personal information, as described below.
The K-12 training platform does not require individual student accounts, logins, names, or email addresses. Skip to Secure does not intentionally collect IP addresses, device identifiers, or behavioral data tied to individual students through its training applications. The training platform does not use advertising cookies or third-party behavioral tracking services.
The website uses privacy-focused analytics and third-party hosting services, as described in the Analytics and Hosting & Security sections below. These services are separate from the collection of individual student registration information.
Access is managed through shared classroom passwords provided directly to the requesting educator. Passwords may be rotated upon request at any time.
Skip to Secure collects limited personal information when individuals register for Cyber Lab Night or submit a demonstration proposal.
Information collected may include names, email addresses, attendance counts, demonstration titles, project descriptions, GitHub links, and other information voluntarily provided through our registration and submission forms.
This information is used to:
Registration and demonstration information is collected using Microsoft Forms and stored through the associated Microsoft account and Microsoft 365 services. Microsoft processes information in accordance with its applicable privacy and service terms.
Skip to Secure does not sell attendee information or provide registration lists to event sponsors or other organizations for their independent marketing purposes.
Access to registration information is restricted to the event organizer.
Registration information is retained only as long as reasonably necessary for event administration, follow-up communications, and related recordkeeping. Information that is no longer needed will be deleted, subject to any applicable legal or operational retention requirements.
Attendees may request access to, correction of, or deletion of their registration information by contacting info@skiptosecure.com. Requests will be reviewed and fulfilled as appropriate, subject to applicable requirements.
Registering for Lab Night does not automatically enroll attendees in unrelated commercial marketing campaigns.
Lab Night registration information is separate from the K-12 training platform. The training platform does not require individual student registration or the submission of student personal information.
Skip to Secure's K-12 training platform is designed to minimize the collection and processing of student information. It does not require individual student accounts, names, email addresses, or education records to deliver its training activities.
These design choices are intended to reduce privacy risks and support the requirements of educational institutions operating under the Family Educational Rights and Privacy Act (FERPA, 20 U.S.C. § 1232g), the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501–6506), and the Children's Internet Protection Act (CIPA, 47 U.S.C. § 254), where applicable.
Compliance with these laws depends on the specific activities, responsibilities, and circumstances of each organization. The absence of student accounts or direct student PII collection does not, by itself, establish compliance with every requirement of these laws.
Skip to Secure is willing to execute a Data Privacy Agreement (DPA) with any district that requires one, subject to mutually acceptable terms.
The website and K-12 training platform are hosted on Netlify, which publishes security and compliance information concerning its infrastructure and services, including SOC 2 and applicable ISO certifications. The applicability of particular certifications and controls depends on the services and environments within their documented scope. The firewall trainer is hosted on Amazon Web Services (AWS).
Website traffic is protected using HTTPS and Transport Layer Security (TLS). Encryption of stored information and other infrastructure security controls are provided according to the configurations and security practices of the applicable hosting and service providers.
The primary Skip to Secure website is built as static HTML and does not operate its own application database, user account system, or server-side session management. Certain services, including Lab Night registration, use external platforms such as Microsoft Forms that process and store information separately from the static website.
Administrative access to hosting environments is restricted to authorized administrators and protected by multi-factor authentication.
This site uses GoatCounter, an open-source, privacy-first analytics tool. GoatCounter does not use visitor tracking cookies, store IP addresses, or create individual behavioral profiles. Its analytics are designed to provide aggregate website usage information rather than identify individual visitors.
GoatCounter does not store full user-agent headers or persistent tracking identifiers. It maintains aggregated information about website usage, such as page views and general browser statistics, without linking those measurements into individual browsing histories.
No individual student accounts or registration information are supplied to GoatCounter through the K-12 training platform. Skip to Secure does not use GoatCounter data to identify individual students or attendees.
GoatCounter's source code is publicly available at github.com/arp242/goatcounter.
The K-12 training platform does not require individual student accounts or collect student registration records, and therefore has no corresponding student account or registration data to retain.
Lab Night registration and demonstration information is retained only as long as reasonably necessary for event administration, follow-up communications, and related recordkeeping. Attendees may request deletion of their information by contacting info@skiptosecure.com, subject to applicable retention requirements.
Standard infrastructure-level logs and other operational data maintained by hosting providers and third-party services follow their respective retention and security policies.
In the event of a security incident affecting hosting infrastructure or information processed through Skip to Secure's services, the incident will be assessed and appropriate action taken.
Participating districts will be notified promptly when an incident affects their information or services and notification is warranted under applicable agreements or legal requirements.
Lab Night attendees will be notified when an incident involving their personal information requires notification under applicable law or otherwise warrants direct communication.
Skip to Secure strives to meet accessibility standards for educational environments and is continuously tested and improved for usability across screen sizes, operating systems, and device types commonly found in K-12 classrooms.
Lab Night registration and event information are provided through web-based services intended to support access across common devices and assistive technologies. Attendees who experience accessibility difficulties may contact Skip to Secure for assistance.
For questions about privacy, requests concerning Lab Night registration information, or a downloadable version of this privacy overview, contact info@skiptosecure.com.