Level 1 Foundation

The Software You Did Not Mean to Build

Why this matters

Quiz Time!

The core concept, built progressively

Let's review!

Why the frameworks you already trust don't catch this

Some frameworks to note

In practice: the Canvas moment, examined properly

A Cross-Sectional Illustration of an Enterprise Software Estate

A Branching Scenario

Where This Connects

Knowledge Check

Lesson Summary

LESSON 1: The fossil record nobody designed

An Introduction

Core Concept

Some things to note.

Drag & Drop the cards to the correct boxes

In practice: the Equifax pattern, generalized

Check yourself

In Summary

LESSON 2: Secure at birth, rot in production

Opening

The Ten Patterns, Defined

LESSON 3: The ten structural failure patterns — running the diagnostic

Core concept: building the model from the inside out

The primary entry point controls

Drag & drop each case to the correct layer

How this connects

LESSON 4: Where trust breaks, part one — the inside-out model

<h3 id="e562c646-2283-47bf-ad67-e4d015358628" data-toc-id="e562c646-2283-47bf-ad67-e4d015358628" style="text-align: left; font-size: 20px; line-height: 1.2;"><strong>Most security certifications teach you frameworks. </strong></h3><h2 id="d006f33b-2978-4771-a9d3-9d9c17e259ad" data-toc-id="d006f33b-2978-4771-a9d3-9d9c17e259ad" style="text-align: left; font-size: 24px; line-height: 1.2;"><strong>Governance and Structural Literacy foundation certification teaches you to see.</strong></h2><p class="font-claude-response-body break-words whitespace-normal">This is the first of two mandatory foundation courses in the Eigen Security certification path, and it exists because of a pattern Haroon Mansoori kept seeing across three decades of hands-on security engineering: organizations with real budgets, real tooling, and real security teams kept getting breached by the same structural failures — not because anyone was careless, but because nobody had a vocabulary for what was actually going wrong. STRIDE, the OWASP Top 10, and NIST's frameworks are all, by design, backward-looking. They catch what's already been named. ES-SF1 teaches you to recognize the failure mode before it has a name.</p><p class="font-claude-response-body break-words whitespace-normal">Across six lessons, you'll learn to distinguish a proximate cause from a structural one — the difference between a single bug and a condition that will keep producing failures no matter who's on the team. You'll work through the ten structural failure patterns, a real diagnostic instrument you can score against any organization, including your own. You'll build an inside-out trust model, starting at identity rather than the network perimeter, because that's where most modern breaches actually begin. And you'll finish with the Monday Morning framework — turning diagnosis into action with a named owner, a verifiable completion state, and a target date, every time.</p><p class="font-claude-response-body break-words whitespace-normal">Every concept is anchored to a real, dated, independently sourced incident: Uber, Optus, MOVEit, CircleCI, MGM Resorts, Canvas LMS, and the CRA/H&amp;R Block Canada case, deliberately drawn from seven different industries and countries so you see the pattern, not a company's reputation. Where public reporting is disputed, this course tells you so — you'll learn to separate what a company confirms from what an attacker only claims, a discipline most certification material skips entirely.</p><p class="font-claude-response-body break-words whitespace-normal">ES-SF1 is mandatory before any Eigen Security Level 2 specialization or Level 3 role certification. It's also the foundation this certification's entire practitioner-experience approach is built on — inside-out, not outside-in, and grounded in what actually breaks, not what a framework says should.</p><h3 id="29afc81f-8dae-4e04-bebf-98d780e16afe" data-toc-id="29afc81f-8dae-4e04-bebf-98d780e16afe" class="font-claude-response-body break-words whitespace-normal" style="text-align: left; font-size: 20px; line-height: 1.2;"><strong>What's included:</strong> </h3><ol><li><p class="font-claude-response-body break-words whitespace-normal">Six interactive lessons with branching scenarios</p></li><li><p class="font-claude-response-body break-words whitespace-normal"> Knowledge checks and ready reckoners</p></li><li><p class="font-claude-response-body break-words whitespace-normal">A free companion guide</p></li></ol>

Learn to see the structural failures other security certs miss. 10 diagnostic patterns, real breaches, and an inside-out trust model — built from 30+ years of practitioner experience, not a framework committee. Mandatory foundation for all certifications.

Course content

Certified in Governance and Structural Literacy

Haroon Mansoori