Sefism Cybersecurity Cheat Sheet

What this cheat sheet is

The Cybersecurity cheat sheet is the quick-revision companion to Sefism's Cybersecurity roadmap. It runs from the CIA triad and a safe home lab, through the core work of one security path, to certifications, a portfolio and a first job. Each concept is explained in a line or two with why it matters and the classic mistake to avoid, and a few include a short snippet, such as a Sigma rule, a parameterised query or a log query.

Like the roadmap, it is written for defence and for legal, authorised practice. The testing chapters describe the profession and its rules rather than attack techniques, and the AI security chapters cover how to recognise, prevent and detect each risk, with no payloads.

Four editions, one per path

The sheet has an edition for each roadmap path. Five chapters are shared (foundations, home lab, certifications, portfolio and first job); the rest belong to your path:

Every edition is public at its own address.

The shared chapters

Security foundations (12 concepts)

The CIA triad, risk, threat and vulnerability, CVSS, defence in depth, least privilege, networking basics for security, TLS, authentication and authorisation, multi-factor authentication, hashing, symmetric and asymmetric encryption, and authorised testing and the law.

A safe home lab (8 to 9 concepts)

Virtual machines, snapshots, isolated lab networks, intentionally vulnerable apps, practice platform rules, running targets in containers, lab notes and scripting for security. The AI security edition adds a local LLM lab.

Certifications (6 to 7 concepts per edition)

The certification ladder, CompTIA Security+, ISC2 Certified in Cybersecurity, cloud security certifications, renewal and continuing education, and exam dumps and fake vouchers, plus path-specific options for three editions: CompTIA CySA+ for defensive, testing certifications for penetration testing, and AI security certifications. The chapter repeats one rule: exam versions change, so check the official page.

Portfolio (4 concepts)

The security portfolio, write-ups, open source security contributions and honest titles.

Your first security job (7 to 8 concepts)

Entry routes, what SOC analyst, junior AppSec and junior penetration tester roles involve, technical rounds, job and training scams, and keeping up. The AI security edition adds AI security roles.

The path chapters

Defensive edition

• Logs and telemetry (7): log sources, the Windows Security event log, Sysmon, Linux authentication logs, network and cloud telemetry, collection and normalisation, and baselines.
• Detection, triage and threat intelligence (9): SIEM, MITRE ATT&CK, detection rules, Sigma rules, alert triage, false positives and tuning, threat intelligence, the Pyramid of Pain and phishing analysis.
• Incident response (8): the lifecycle, NIST SP 800-61 Rev. 3, playbooks and runbooks, containment, eradication and recovery, evidence handling, escalation, post-incident review and the incident report.

Application security edition

• Web and API weaknesses (10): the OWASP Top 10 (2025), broken access control, injection, parameterised queries, cross-site scripting, authentication failures, security misconfiguration, software supply chain failures, the OWASP API Security Top 10 (2023) and SSRF.
• Threat modelling, secure coding and review (8): threat modelling, data flow diagrams, STRIDE, secure coding principles, secrets management, security code review, OWASP ASVS, and secure error handling and logging.
• Security in the pipeline (8): security checks in CI, SAST, SCA, SBOMs, secret scanning, DAST, container and IaC scanning, and finding triage. Most of these come with a short pipeline snippet.

Penetration testing edition

• How penetration testing works (8): the penetration test, scans versus pentests versus red teams, bug bounty programmes, methodology, scope and rules of engagement, written authorisation, reconnaissance and tools by purpose.
• Practising legally (6): guided practice platforms, capture the flag, programme scope and policy, safe harbour, coordinated disclosure and testing notes.
• Reporting and retesting (7): the report, the executive summary, finding write-ups, severity rating, remediation advice, retesting and handling client data.

AI security edition

• LLM apps, risk maps and governance (12): machine learning basics for security, the anatomy of an LLM app, why the model is not a security boundary, RAG, tools, agents and MCP, human in the loop, the OWASP Top 10 for LLM Applications, MITRE ATLAS, threat modelling an LLM app, the NIST AI RMF, AI rules and standards, and monitoring.
• LLM attacks, defences and testing (16): direct and indirect prompt injection, sensitive information and system prompt leakage, improper output handling, excessive agency, poisoning, the AI supply chain, model theft, vector and embedding weaknesses, unbounded consumption, misinformation, guardrails, AI red teaming, testing tools, and security evals.

Rules of thumb and glossary

Each edition has seven rules of thumb: five shared ones (only test what you own or have written permission to test; isolate, snapshot and take notes; check the exam version on the official page before buying study material; three finished portfolio pieces beat ten half-done ones; never pay an employer for a job or buy a voucher from an unknown seller) and two for your path, such as "learn what normal looks like before hunting for what is unusual" for defenders or "the report is the product" for testers. The A to Z glossary adds between 93 and 122 smaller terms, depending on the edition.

How to use it with the roadmap

• After each stage: read the matching chapter and explain each concept in your own words. Your stage 1 milestone is exactly this kind of notes page.
• In the lab: keep the home lab chapter's rules in view, and the relevant path chapter open while you work.
• Before a technical round: the foundations chapter plus your path's chapters cover the ground junior security roles expect.
• Before buying a course or exam: reread the certifications chapter, then check the official page.

How it works on Sefism

The public page at /cheatsheets/cybersecurity/ shows every chapter's title and introduction, with the first chapters open in full. Everything on Sefism is free to learn from. Keeping a cheat sheet uses credits; new members get starting credits, and if you are learning seriously and run out you can ask for more. Keeping the sheet opens every chapter in the member area.

Following the Cybersecurity roadmap also unlocks this sheet, and your first roadmap is free. Roadmap topics link to the concepts here that cover them.

Related on Sefism

• The Cybersecurity roadmap this sheet accompanies.
• OWASP Cheat Sheet Series for the AppSec chapters.
• Burp Suite Community Edition and Hacker101 for the testing chapters.
• Where do I start if I want a career in cybersecurity or IT operations?
• Security awareness micro-lessons and consent-based phishing drills, a beginner project.

Frequently asked questions

Does the sheet teach hacking techniques? No. The testing chapters cover the profession: methodology, scope, authorisation, legal practice and reporting. The AI security chapters cover recognition, prevention and detection without payloads.

Are the OWASP lists current? The AppSec edition uses the OWASP Top 10 2025 and the API Security Top 10 2023, as named in the sheet. Lists are revised over time, so check the official OWASP pages.

Which edition should I read first? The one for the path you chose on the roadmap. The shared chapters are the same in every edition.