Level 1 Foundation

Opening

Why this matters

Quiz Time!

A caution before you go further: why "shift left" keeps failing

Where security requirements come from

Drag and drop the correct boxes in the correct requirements

The framework that organizes it all: OWASP ASVS

Explore ASVS levels

NIST SSDF: the process layer

Getting requirements into the hands of developers

Fill in the blanks

The tools that operationalize this

Drag the drop the boxes into the correct elements

In practice: working through a real feature

A Branching Scenario

An Engineering Team's Sprint

Where this connects

Lesson 1: Security requirements — key takeaways

Editorial note — added post-audit against Writing Guidelines §11

LESSON 1: Security requirements

Core concept

STRIDE Diagnostic Questions

Rank the threats from highest to lowest priority

In practice: mapping SolarWinds onto a data flow diagram

Lesson Summary

LESSON 2: Threat modeling

Core Concepts: The Four Pillars

Mark the correct words

In practice: the AI-reasoning category, examined honestly

Check yourself

LESSON 3: Static analysis

Core Concepts

Sort the findings by their severity

In practice: what a real pentest report structure looks like

LESSON 4: Dynamic testing

Drag & Drop

In practice: the cattle-not-pets test for your own pipeline

LESSON 5: Release gating

Final Knowledge Check

Course Summary

LESSON 6: Runtime defense

Shift left is the right idea. It's also been implemented badly across the industry for a decade — and Gloria Institute’s CPSE says so, directly, in its first lesson, before teaching you how to do it properly.This is the second of two mandatory foundation courses in the Gloria Institute’s security certification path. Where CGSL taught you to diagnose structural risk, CPSE teaches you the engineering practice for building against it: a six-stage pipeline running from security requirements through threat modeling, static analysis, dynamic testing, release gating, and runtime defense — each stage producing a specific, testable artifact the next stage depends on.Every stage is grounded in a real, dated, independently verified incident, chosen deliberately to avoid the trap most security training falls into of over-relying on one company or one vendor's marketing. SolarWinds anchors threat modeling — a build-pipeline compromise most 2020-era threat models weren't built to name as a category. Log4Shell anchors static analysis and the case for a current, accurate software bill of materials. Capital One anchors dynamic testing, illustrating exactly the class of vulnerability that only exists once a system is live. Codecov anchors release gating, and the discipline of treating infrastructure as cattle, not pets. A 29-year-old flaw in the Squid proxy, surfaced by AI-accelerated vulnerability discovery in 2026, anchors runtime defense and the argument that no amount of upstream rigor ever makes detection optional.Where this course discusses emerging AI-assisted security tooling — Anthropic's Claude Security and OpenAI's Daybreak — it names both, every time, deliberately, because a course that only credits one vendor's capability in a genuinely industry-wide shift would be exactly the kind of vendor favoritism this certification is built to avoid.CGSL must be completed first. Together, the two foundation courses are mandatory prerequisites for every Gloria Institute’s security Level 2 field specialization and Level 3 role specialization certification.What's included:&nbsp;<ol><li>Six interactive lessons with branching scenarios</li><li>Knowledge checks and ready reckoner</li><li>Free companion guide</li></ol>

The 6-stage security engineering pipeline, from requirements to runtime defense — built on real incidents like SolarWinds and Log4Shell, and an honest reckoning with why "Shift-Left" keeps failing. Second mandatory foundation course before specialization.

Course content

Certified in Proficiency of Security Engineering (CPSE)

Haroon Mansoori

This Course Includes