The ENISA Secure by Design and Default Playbook provides practical guidance for SMEs on integrating cybersecurity into the entire product development lifecycle. It presents clear principles, actionable recommendations, and repeatable practices for implementing secure-by-design and secure-by-default approaches throughout engineering, development, testing, release, and maintenance processes. The playbook helps organisations strengthen product security, reduce vulnerabilities, and support compliance with the Cyber Resilience Act (CRA).
Technical Skills Development
Access a wealth of resources including articles, whitepapers, tools, and guides to support your learning.
Category
Type
More
Difficulty Level
- Application Security
Secure-by-Design System Development with UML
- Published date:
- Author: MERIT Project Consortium
This self-paced MOOC introduces system security from a design-oriented perspective, helping learners integrate security requirements during the early stages of system development. The course covers secure system architecture, security-focused requirements engineering, UML-based modelling, vulnerability identification, and secure-by-design methodologies. Through video lectures, practical modelling exercises, and assignments, participants learn how to build more robust and resilient systems before implementation begins.
- Network Security
Foundations of Zero Trust Cybersecurity
- Published date:
- Author: European Union Agency for Cybersecurity (ENISA)
The Zero Trust Cybersecurity Foundation course introduces the principles of Zero Trust (ZT) and Zero Trust Architecture (ZTA), providing learners with the knowledge required to design and implement modern security architectures based on the “never trust, always verify” approach. Following the guidance of NIST SP 800-207, the course covers Zero Trust concepts, implementation strategies, architecture options, planning considerations, and practical use cases to help organisations strengthen their cyber resilience and reduce the risk of data breaches and cyberattacks.
- AI Security
EU Action Plan on Cybersecurity and Artificial Intelligence
- Published date:
- Author: European Commission
The EU Action Plan on Cybersecurity and Artificial Intelligence outlines the European Commission’s strategy for promoting the safe and responsible use of AI while strengthening Europe’s cybersecurity and resilience. The Action Plan focuses on secure AI deployment, AI-assisted cyber defence, resilience of critical infrastructure, implementation of the AI Act, NIS2 Directive, and Cyber Resilience Act, and the development of European AI capabilities for cybersecurity through research, innovation, and secure testing environments.
- Endpoint Security
European Union Vulnerability Database (EUVD)
- Published date:
- Author: European Union Agency for Cybersecurity (ENISA)
The European Union Vulnerability Database (EUVD) is the official EU platform for collecting and publishing information on publicly disclosed cybersecurity vulnerabilities. Managed by ENISA under the NIS2 Directive, the database provides information on security flaws affecting software and hardware products, assigns EUVD identifiers, references CVE entries where applicable, and supports vulnerability management, risk assessment, and timely remediation for organisations across Europe.
- Application Security
File Inclusion Vulnerabilities: Hands-on Web Application Security Module
- Published date:
- Author: Hack The Box Academy
This module introduces file inclusion vulnerabilities in web applications, including Local File Inclusion, Remote File Inclusion, path traversal, PHP filters and wrappers, log poisoning, malicious file uploads, and exploitation paths leading to remote code execution. Through practical exercises and a skills assessment, learners develop hands-on offensive security skills while also learning prevention techniques. The module is designed for learners with basic knowledge of Linux, networking, web requests, and information security fundamentals.
- Application Security
OWASP Juice Shop: Intentionally Vulnerable Web Application for Security Training
- Published date:
- Author: Open Worldwide Application Security Project (OWASP)
OWASP Juice Shop is an intentionally insecure web application designed for hands-on security training, awareness exercises, capture-the-flag challenges, and testing of security tools. Built with modern web technologies, it includes vulnerabilities from the OWASP Top 10 and other common application security flaws, allowing learners to practice identifying and exploiting weaknesses in a safe environment. It is widely used for ethical hacking, secure coding awareness, and application security education.
- Application Security
KIOKU: Gamified Scenario-Based Cybersecurity Training for SMEs (NeRO Project)
- Published date:
- Author: NERO - AdvaNced cybErsecurity awaReness ecOsystem for SMEs
KIOKU is an online, gamified cybersecurity training platform offering AI-supported, scenario-based learning tailored to SMEs in healthcare, finance, and logistics. Participants engage in realistic cyber incident scenarios from the perspectives of IT personnel, non-IT staff, and managers, receiving immediate feedback on their decisions. With multiple difficulty levels and performance analytics dashboards, KIOKU supports behavioural learning, strengthens cyber awareness, and enhances organisational decision-making and resilience across diverse workplace environments.
- Application Security
CEPOL Cybercrime Training Portfolio
- Published date:
- Author: European Union Agency for Law Enforcement Training (CEPOL)
CEPOL’s Cybercrime Academy offers a comprehensive training portfolio to strengthen the digital skills of EU law enforcement officials in combating cybercrime and cyber-enabled threats. With courses addressing emerging technologies like AI, blockchain, and IoT, the Academy supports cross-border collaboration and capacity-building through specialised training delivered at its centre in Budapest and online. Explore the full catalogue of courses designed to enhance operational readiness in tackling complex cyber threats across Europe.
- Application Security
Ethical Hacking: Web Application Security Training
- Published date:
- Author: EIT Digital
The Ethical Hacking course on Web Application Security, delivered under the SPECTRO project, provides a hands-on introduction to identifying and preventing vulnerabilities in web applications. Covering core topics such as information gathering, OWASP Top 10 security risks, client- and server-side security flaws, and API vulnerabilities, the course equips learners with the skills to analyze, test, and secure web applications against malicious attacks. Designed for students and developers, the training combines theory with practical exercises and quizzes to reinforce learning outcomes. Co-funded by the EU’s Digital Europe Programme, the course is free, self-paced, and accessible to ICT professionals and digital experts seeking advanced cybersecurity skills.