Learn
Learn Defense with RoamSwitch
Learn how attacks work, reproduce them with harmless data, and check the detection yourself.
- 5Published modules
- 9Hands-on labs
- 12 / 129Features covered (9%)
- 23In preparation
Choose your path
There are three paths, depending on who you are. Start anywhere.
Start here
For: People considering RoamSwitch
What it protects, and what it does not. Get the whole picture before you install, by running it.
The big picture of RoamSwitch
Learn the layers (detect, block, isolate, audit), the role of each product, and the no-telemetry design, then check that your own machine is ready.
Editions: Mac / Linux Client / Server / Sensor
Which edition protects what, and what it does not. How to choose.
The no-telemetry design
What the product sends out, what it never sends, and how to check it.
Know the attack, stop the attack
For: People learning security
For each thing to protect: how the attack works, a harmless reproduction, how RoamSwitch detects it, and what it cannot see. One module per feature chapter.
Ransomware
Decoys, mass-encryption detection, and a way back to the state before the damage.
Credential theft and leaked secrets
Find API keys that slipped into code or public files, and learn what to do after you find one.
Suspicious execution and malware
Spot suspicious behavior in downloaded files and execution chains.
Persistence and tampering
Watch autostart entries, schedules, and tampering with critical files.
Network defense
ARP spoofing, rogue access points, suspicious traffic, and exposed ports.
Web and email
Web shells, lure sites, and dangerous attachments.
SSH and remote access
Brute force, and the abuse of remote-access tools.
Containers and servers
Server-specific defenses: runtime monitoring, resource exhaustion, and egress.
Supply-chain attacks
Find install-time code hidden in dependencies, and look-alike fake packages.
AI agents and MCP
Dangers hidden in AI agent settings and permissions.
Peripherals
Keyboard-impersonating devices and USB-borne attacks.
Diagnosis and vulnerabilities
How to read the health check, and tell which vulnerabilities are likely to be exploited.
Log analysis and investigation
Read the traces of an attack out of access logs and audit logs.
Evidence, notifications, and operations
Incident records, notifications, and preserving evidence.
Crisis response for server operators
For: People who run and manage servers
Realistic crises, as playbooks: the first 15 minutes of decisions, recovery, and prevention. The focus is on decision points and what not to do.
A containment fired: the first hour
Experience, in a simulation, the hour after a server isolates itself on a serious threat. Build the order of confirm, record, decide, release, and watch as judgment.
2An actively exploited vulnerability has no fix yet
When a warning cannot be resolved by updating: check exposure, mitigate, and accept the risk with an expiry.
SSH brute force, and when you lock yourself out
How blocking works, allow lists, and lifting a block you caused.
A web shell was found
Quarantine, tracing the entry point, rotating keys, and preventing a repeat.
Ransomware starts on a server
The decision to stop it, preserving evidence, and the order of recovery.
A dependency was hijacked
Scoping the impact, rotating secrets, and revisiting pinning.
A key or token was published
The order of revocation, and how to look for signs of use.
CPU or memory is exhausted and the server stops responding
Narrowing down the cause, and telling a crypto miner apart.
Logs were deleted or rewritten
Rebuilding the facts from what remains, and knowing what you cannot see.
An alert fired: false alarm or real?
Reading a notification, and when it is safe, and unsafe, to call it harmless.
Upgrading a server's OS remotely
Surviving a dropped connection, what gets disabled, and what cannot be undone.
Coverage
Features are counted per chapter. Chapters still in preparation will be turned into modules in turn.
- RansomwareIn preparation (6)
- Credential theft2 / 6 features
- Suspicious execution and malware1 / 10 features
- Persistence and tamperingIn preparation (7)
- Network defenseIn preparation (19)
- Web and emailIn preparation (4)
- SSH and remote accessIn preparation (3)
- Containers and serversIn preparation (6)
- Supply chain4 / 9 features
- AI agents and MCPIn preparation (10)
- PeripheralsIn preparation (3)
- Diagnosis and vulnerabilities2 / 10 features
- Log analysis and investigation1 / 22 features
- Evidence, notification and operations2 / 14 features
How you learn
Every module follows the same flow.
- 1Understand
See how the attack works, from the mechanism.
- 2Reproduce
Build the same situation with harmless dummy data. No real secrets, no production machines.
- 3See the detection
Check, from real output, what RoamSwitch finds and what it does not.
- 4Know the limits
Knowing what is invisible is the foundation of a sound defense.
The labs use only harmless dummy data, never real keys or passwords. Some steps create files in a practice folder. Operations that change settings or records are not run in the labs, and where they appear they are marked "This changes state." Try the labs on a practice machine, not a production one.
The "Done" marks are saved only in this browser. Nothing is sent out.