Training info at a glance: Download the one-pager (PDF).
Hands-on attack & defense
Prior to conducting the training with your team, we’ll have an initial scoping call. This meeting is designed to customize the course to your specific requirements, helping us decide on the most suitable approach and focus areas to address your needs effectively.
In my fully packed hands-on bootcamp-style training, you will experience how hackers approach a typical web application to learn about the security vulnerabilities seen in many web applications and backends/APIs.
Also, we often switch the sides during the training into the defender’s perspective to learn how primary and secondary countermeasures harden the security posture of today’s applications and backends in a defense-in-depth way.
All exercises are executed against a participant-individual training environment, which I prepare and individually spawn for each participant in my cloud. Just a web browser is required to attend and no pre-installations are necessary on the participants’ machines. To allow recapping the practical exercises, participants receive Docker containers after the course with the training environment and all exercises to be able to run them locally on their machines.
To enhance interactivity and engagement, whether delivered remotely or on-site, my trainings incorporate live engagement elements using Workshop Board that augment the hands-on exercises with real-time participant input, collaborative brainstorming walls, questions, knowledge checks, and collaborative discussions.
The material and hands-on exercises cover the OWASP Top 10:2025 and the OWASP API Security Top 10. Optionally, when of interest, the training can also include the OWASP Top 10 for LLM Applications and the OWASP Top 10 for Agentic AI Security — covering attack and defense scenarios for modern AI-driven systems such as RAG pipelines, MCP tool integrations, and agentic architectures.
Vulnerabilities and Defense Measures
My hands-on web security bootcamp covers many vulnerabilities and their defense measures, including:
- Injection Vulnerabilities, including Post-Exploitation towards Remote Code Execution (RCE)
- XML External Entity Attacks (XXE)
- Path-Traversals (including ClassPath-Traversals)
- Cross-Site Scripting (XSS): Reflected, Persistent, DOM-based and different contexts
- Session Attacks, etc.
- Authentication Bypass
- Information Disclosures
- Server-Side Request Forgery (SSRF), especially in cloud-based environments
- Attacks on File-Uploads and -Downloads
- Attacks on WebSockets
- Java Deserialization Vulnerabilities & Attacks
- Advanced XML Attacks (leading to RCEs)
- JSON Attacks (leading to RCEs)
- GenAI Attack Surfaces: Prompt Injection, RAG Corpus Poisoning, MCP Tool Attacks, Agentic AI Goal Hijacking
- AI-Generated Code Security: Reviewing AI-written code for injection flaws, XSS, and cryptographic failures; secure prompting techniques; automation bias awareness
- and many more
This bootcamp-style training introduces the mentioned vulnerabilities and focuses also on defensive aspects to remediate these vulnerabilities in a defense-in-depth style. If instead you’re more offensive-oriented and interested in the art of exploitation of these vulnerabilities rather than the defensive approaches, the Pentesting Training might be of more interest to you.
Being a full-fledged bootcamp training, also DevSecOps scan automation techniques are presented. If you’re interested in automation of security scans inside CI/CD build pipelines, the DevSecOps Coaching might also be of more interest to you, either as an addition or a replacement.
AI-Generated Code Security
AI coding assistants like GitHub Copilot, Claude Code, Codex, or Cursor can significantly boost your team’s productivity. But that speed comes with a catch: studies show that a large share of AI-generated code ships with security flaws, from injection vulnerabilities and XSS to broken cryptographic implementations. Developers who rely on these tools without knowing what to look for end up trusting suggestions they shouldn’t.
To still get the most out of these tools, the bootcamp covers AI-Generated Code Security as an additional module: how to review and validate AI-written code, secure prompting techniques that produce safer output, and building awareness of automation bias, the tendency to accept AI suggestions at face value.
What participants will receive
All my trainings can be held in German (native speaker) or English (business fluent).
Participants receive the following along with my training:
- Access to cloud-based training environments (individually spawned for each participant).
- All slides and workshop material as a set of PDFs.
- Lifetime access to GitHub and DockerHub repos with my training environments in order to recap all exercises with a working setup (including freshly added stuff in the future).
- Support via mail for setup and exercise handling afterwards.
- Printed and signed Certificate of Participation listing the training contents.
Interested in your organization’s individual quote? Let’s talk
This service also supports technical security requirements commonly referenced in modern cybersecurity regulations.
Different Options
As always in life, there is no one-fits-all solution. So regarding the concrete setup and execution of my trainings and workshops, you have different options and variants to choose from.
Fully customizable training agenda
In case you want certain aspects of your technology stack or specific internal process or tools covered during the training: The training agenda can be customized to your needs, resulting in an individual setup and content.
On-site or Remote? – Choice is yours!
My trainings and workshops can be executed on-site (either directly at your office or at one of my training sites) as well as fully remote for home-office workers. Even hybrid variants are possible, where some remote-only workers can join online, while I execute the training on-site for the majority of the participants. I’ve already conducted numerous online-based variants of my training, even for bigger audience groups.
Either way, participants just need a browser as nothing needs to be installed locally, since my training runs with participant-individual environments in my cloud.
Alternative option: Professional training recording
In case you would like to have a customized version for your company recorded as a set of chapters and lessons for your in-house video-based electronic learning platform: Let’s talk
I can record a customized training session (without participants) and provide you with professionally cut chapters exported as SCORM (useful for import into LMS systems), MPEG, and other formats. This package includes digital training slides and the runnable training environment for local offline training. If you and all participants prefer to record a live training while being held, this is also possible and would produce a video handout of the full course.
That way, several companies have successfully enriched their own internal video-based training offers with my hands-on security workshops imported into their own electronic learning platforms.
Self-paced training preferred? — no problem
My live Web Security Bootcamp is also available as a set of self-paced training video sets along with the training material and a cloud-based training environment for the exercises. This package encompasses over 25 high-quality module videos, each lasting between 30 and 60 minutes, tailored for participants to learn at their own pace.
As participants advance through the course in their personalized cloud environment, they might have questions or need clarification on certain topics. Therefore, learners can opt to jump into regular Q&A sessions with me (for example, offered weekly or bi-weekly) to discuss their queries and delve deeper into specific areas of interest. Participants are also welcome to email me for tailored guidance on the module they’re currently working on, ensuring an interactive and supportive learning experience.
As a company, you can opt to incorporate special topic update-modules into the subscription. These modules are designed to cover the latest trends and advancements in web security, keeping your employees abreast of the ever-evolving landscape of the cybersecurity world.
This subscription model is perfect for larger groups seeking the freedom of self-paced learning with the benefits of still having live interaction with me as their trainer and ongoing support. Upon successfully completing the course units, learners will be awarded a certificate of participation, showcasing their commitment and expertise in web security.
Let’s discuss the details and tailor a solution that best fits your needs in web security training.
Follow-up options
After completing the course, you may want to deepen or broaden your team’s security expertise through a range of further options. Depending on your goals and interests, follow-up possibilities include:
- Review & Reflect Workshop: Facilitated, team-based security review to help your team analyze architectures, codebases, and operations for actionable improvements
- Custom Focus Sessions: Short, focused sessions to dive deeper into specific topics identified during the workshop
- DevSecOps Pipeline Coaching: Help implementing security automation for findings related to CI/CD and build processes
- Security Sparring Partner: Ongoing support for addressing architectural recommendations and other security topics
Ready to apply security knowledge to your own systems? Contact me to discuss your workshop requirements.