Flagship course
Control Grid Studio
An eight-week cockpit for people who will run an application security audit and then have to explain it. Informational fee: £1,240. Places are arranged by email, never through a cart on this site.
Who it is for
Developers who inherited a scary admin panel, testers who are tired of scanner PDFs, and analysts who can already use a proxy but freeze when asked for residual risk. You need permission to practise on a system you control or a provided lab outline. You do not need a CISSP, and we will not pretend this studio replaces one.
Modules
-
Scope and the asset ledger
Build a grid of pages, APIs, jobs, mobile endpoints, and “temporary” callbacks. If it is not named, it is not in scope — and we will catch you adding it later as a surprise finding.
-
Authentication and authorisation walks
Live traversal of login, reset, impersonation, and role gates. Emphasis on the hop between cookie and server decision, not on collecting CVE trivia.
-
Data-flow tracing
A slow drawing of where personal data and secrets actually travel, including the batch job nobody booked time for.
-
Injection and request tampering labs
Guided tampering against a lab application. We stay inside the outline you agreed. Production heroics are not part of the course.
-
Session and token hygiene
Timeouts, rotation, logout that does not logout, and the refresh token living in localStorage because “the mobile team needed it”.
-
The findings memo and residual risk
Write for a person with a backlog. Include at least one limitation. We mark tone, evidence, and whether the recommended fix is something a team could schedule.
What you should be able to do afterwards
- Produce an asset ledger another tester could continue from.
- Walk authentication without treating every 302 as a novel.
- Explain one data-flow in language a product owner recognises.
- Write four findings with evidence, impact, and a plausible next action.
- State clearly what you did not test, without burying it in an appendix.
Informational pricing
Cockpit Seat £1,240 for the eight-week Studio, including recordings and two marked drafts. Ground Brief notes (£95) are optional beforehand. Tower Watch (£3,800) is a separate team clinic, not an upgrade button. Confirm a place via the contact form or info@monitorpilotgrid.digital.
Questions we actually get
Do I need to be a full-time security person?
No. Several of the last cohort were backend developers. You do need comfort with HTTP and a willingness to write in complete sentences.
What is a real limitation of this studio?
We do not take you through a full mobile binary or a thick-client reverse-engineering path. If your estate is mostly native apps, you will finish this programme with a stronger web grid and an honest gap on the mobile side. Runtime Watch helps a little; it is not a substitute for a specialist mobile course.
Can I use my employer’s production site as the lab?
Only with written permission that names the environment. We would rather you use the lab outline. A surprising number of “staging” systems are just production with a different hostname.
Is there a certificate?
You receive a letter describing the modules and that you submitted a memo. We do not sell a badge graphic. Some employers find that refreshing; some find it annoying. We will not pretend otherwise.
Voices from Studio seats
The ledger template is still on my desktop. I used it on a forgotten CSV export the week after we finished. Helen’s comments on my first draft were drier than I wanted, which was probably the point.
3 / 5 on the recordings — they are clear, but I had to rewatch the token session twice. The live clinic is where it clicked. I would not skip those even if the files are available.