The path teaches you to build software that withstands attacks and to demonstrate it: requirements and threat modelling, code, third-party components, verification before release and vulnerability handling afterwards. The method is that of the references the market already uses (NIST SSDF, OWASP, CWE) and the obligations are those of Regulation (EU) 2024/2847 (Cyber Resilience Act), read by those who write the product.
The common thread is that a product's security is not added at the end: it is demonstrated throughout the life cycle. Each module produces a piece of the technical documentation that the Regulation requires and that a careful customer asks for anyway.
Who it is for: developers, software architects, product and quality managers, DevOps, security managers at companies that produce software or connected devices, and those in a NIS2 entity who must assess the software they buy.
Estimated duration: 26 hours. 6 modules, 96 test questions, 6 exercises, final test and personal certificate.
Content updated to October 2026 on Regulation (EU) 2024/2847 (Cyber Resilience Act), Directive (EU) 2022/2555 and Legislative Decree 138/2024, Directive (EU) 2024/2853, NIST SP 800-218 (SSDF), OWASP Top 10 and ASVS, CWE Top 25 and vulnerability handling practices (CVSS, EPSS, KEV catalogue, coordinated disclosure).
Unlock-based progression: the test and exercise of each module open once you pass the test of the previous one (threshold 70%, unlimited attempts). At the end, a final test of 30 questions on the whole path, with three attempts one week apart, and, once passed, the PDF certificate with a verification code.