The enterprise management plane (SCCM and Intune) is trusted by design, which makes it the attack surface nobody's watching; this is the detection coverage and posture checks to start watching it.
Concentrating trust in one control plane means one compromise reaches everything it controls.
Recall Privacy Flop Dropping Soon
Windows 11 Recall let me pull exemptions without elevated privileges; found it, proved it, reported it to Microsoft.
NIST Controls Research Dropping Soon
Ongoing work on making 800-series controls less of a paperwork exercise and more of something you can actually verify. (coming soon)
About
Our Mission
Making cybersecurity accessible to everyone. We provide practical training and resources for students, newcomers, and professionals looking to sharpen their skills. Whether you just don't get the chance to do this stuff at work, you don't have time for a homelab, or you're a student looking to bridge the gap between classroom and career, we're here to help you succeed.
Our training is informed by real-world experience, not just theory. Our approach is built on the fundamental principle of defense in depth, layers of defense, because true security comes from multiple protective measures working together.
About Me
Hello! My name is Zach and I'm based in Colorado where I have spent nearly two decades working in technology across IT, infrastructure, cybersecurity, and systems engineering. I developed an enjoyment for teaching at Apple, oddly enough, breaking down complex topics for people who just needed it to make sense. That stuck with me. I still enjoy speaking and teaching whenever the opportunity is right.
This site is a place where I share tools, training, and content I wish I'd had earlier in my career. If anything here has been helpful to you, I'd genuinely love to hear about it. And if you've got constructive feedback on how to make it better, I welcome that too. Reach out anytime.
I spent years championing IT and security for school districts and a boarding school: small teams, tight budgets, and infrastructure that had to just work. I know what it's like to be the only person standing between a school network and the next disaster.
This isn't another Sec+ study guide or death-by-slideshow training. These are hands-on labs where the whole point is simple: here's the thing, now try it. The library keeps growing, with everything from Zero Trust and Vulnerability Prioritization to Incident Response, Log Analysis, and Password Security. Need something for general staff? There's phishing and cyber awareness training that's perfect for them too.
Built primarily for high school, CyberPatriot, and college programs, and just as useful for any K-12 IT staff or educator who needs to understand real threats without sitting through another webinar. See the screenshots below, and reach out if you'd like a demo or have questions. You can also follow along on LinkedIn and YouTube for updates.
Ground Zero
No SIEM. No syslog server. No monitoring at all. You're not behind, you're just getting started.
Monitoring is one of my favorite parts of cybersecurity and honestly, one of the most undervalued. You can have policies, frameworks, and compliance checklists all day long. But if you can't see what's happening on your network, none of it means anything. A monitoring stack isn't a nice-to-have. It's the foundation everything else sits on.
No shame. No jargon walls. Just practical steps you can start on a weekend.
$Content coming soon.
Software
Free purpose-built tools for security teams that need results without enterprise overhead, in exchange for sharing your experience to help me improve the software.
DangerMap - Dependency Decision Support
Most vulnerability scanners tell you what's wrong after you've already committed. DangerMap tells you what to pick before you do. Point it at a package manifest and get a version-by-version risk landscape with migration recommendations. Not just a list of CVEs, but an actual upgrade plan with risk estimates for each path. Built for teams that want to make informed dependency choices during sprint planning, not scramble to patch after a scan kicks back findings.
WatchBx - Container Runtime Scanner
You know what's in your images at build time. But do you know what's actually running in production right now? WatchBx inventories live Docker containers, detects runtime drift from the original image, and cross-references installed packages against vulnerability databases. One command gives you the full picture: what changed since deployment, what's exposed, and what to fix first. Designed for teams that need continuous container visibility for CMMC, FedRAMP, or SOC 2 without paying six figures for an enterprise platform.
Stickers for the people who actually read the audit findings.
These aren't motivational posters. They're inside jokes for anyone who has ever closed a CAB ticket, fought a firewall rule, or watched a git push --force go sideways. Sticker bundles, 3-pack, shipped to your door.
All orders are fulfilled by Printful and processed securely through Shopify. Currently shipping to the US, Canada, UK, and Germany.
Pick Your Pain Point
3-Pack
The Compliance Pack
For when the auditors arrive and nothing is documented.
Includes: NA vs NC • 230 Controls Need Review • Returned for Rework Specs: 3×3" die-cut vinyl, printed on demand
$19.99
Free shipping
3-Pack
The Developer Meltdown Pack
For the sprint that started with a rebase and ended in therapy.
Includes: Put It in the Backlog • git rebase --abort • rm -rf * Specs: 3×3" die-cut vinyl, printed on demand
$19.99
Free shipping
3-Pack
The Security Engineer Pack
For everyone who has ever said no and had to explain why.
Includes: Can You Just Whitelist It? No. • Drop It Like It's Caught • Connection Closed by Remote Host Specs: 3×3" die-cut vinyl, printed on demand
$19.99
Free shipping
Drinkware
Drop It Like It's Caught — Mug
15 oz. of morning courage for the person who runs the firewall.
$25.00
Free shipping
×
Privacy
Skip to Secure provides free cybersecurity resources, tools, and training for professionals and educators. Its K-12 training platform collects zero student personally identifiable information (PII).
What We Don't Collect
No individual student accounts, logins, names, or emails. No IP addresses, device identifiers, or behavioral data tied to individual users. No cookies. No advertising. No third-party tracking or data processing services.
Access is managed through shared classroom passwords provided directly to the requesting educator. Passwords may be rotated upon request at any time.
FERPA, COPPA & CIPA
Because Skip to Secure does not receive, access, or store any education records or student PII, the platform is compliant with FERPA (20 U.S.C. § 1232g), COPPA (15 U.S.C. §§ 6501–6506), and CIPA (47 U.S.C. § 254) by design. Skip to Secure is willing to execute a Data Privacy Agreement (DPA) with any district that requires one.
Hosting & Security
The platform is hosted on Netlify, which maintains SOC 2 Type 2, ISO 27001, ISO 27018, PCI DSS v4.0, and HIPAA certifications. All traffic is encrypted with TLS 1.2 minimum and AES-256 for data at rest and in transit. The firewall trainer is hosted on Amazon Web Services (AWS).
Skip to Secure is built entirely as static HTML — no server-side processing, no database, no session management. Administrative access to hosting environments is restricted to the platform owner and protected by multi-factor authentication.
Analytics
This site uses GoatCounter, an open-source, privacy-first analytics tool. GoatCounter sets no cookies, stores no IP addresses, does not track individual users, does not create user profiles, and shares no information with third parties. It provides only aggregate page view counts. No data point collected by GoatCounter can be linked to an individual student or user. The source code is publicly auditable at github.com/arp242/goatcounter.
Data Retention
Because Skip to Secure does not collect or store student data, there is no student data to retain. Standard infrastructure-level logs maintained by hosting providers follow their respective retention and security policies.
Incident Response
In the unlikely event of a security incident affecting hosting infrastructure, participating districts will be notified promptly.
Accessibility
Skip to Secure strives to meet accessibility standards for educational environments and is continuously tested and improved for usability across screen sizes, operating systems, and device types commonly found in K-12 classrooms.
