Cloud Hacking & Cloud Defence.
How Modern Breaches Really Happen
Organisations are moving to the cloud, and attackers moved there too. Many recent incidents affecting major companies and public institutions started with a compromised cloud account, an identity attack or a misconfiguration. This bootcamp shows how those attacks work, and how defenders catch them.
Methodology
- MITRE ATT&CK-aligned
- APT-focused campaign
2
Training days
6
Core modules
100%
Online delivery
8
Sessions
The new battlefield: cloud, identity and data
Built on real-world attack scenarios, this bootcamp gives a practical understanding of how cyber attacks happen in modern cloud environments and how organisations detect and respond to them.
01
Inside a Microsoft tenant
How Azure and Microsoft 365 fit together: tenants, subscriptions and the services where an organisation's people, mail and documents actually live.
02
The cloud attack surface
Why attackers moved to the cloud with everyone else, and what a cloud environment looks like from an attacker's point of view.
03
Identity and access attacks
Account compromise, consent abuse and over-permissioned roles, and how a stolen token walks past MFA: the entry point behind most modern breaches.
04
Persistence and escalation
How attackers keep a way back in by registering their own MFA device or backdooring an app, then abuse service principals to reach tenant-wide control.
05
How data gets stolen
Following the data out of a cloud environment: discovery, staging and exfiltration from real-world incidents.
06
Shared responsibility
What the cloud provider secures, what the customer must secure, and why that boundary is where breaches happen.
Two days, defence then attack
Day one you learn how a Microsoft cloud tenant is built, secured and monitored. Day two you attack one, and see what the defenders would have caught.
Day 1 · The defender's side
Azure Fundamentals
How a cloud environment is actually built: tenants, subscriptions, resource groups, core services and the role-based access model that holds it together.
Microsoft 365 Core Services
Exchange Online, SharePoint, OneDrive and Teams. Where an organisation's people, mail and documents really live, and how those services connect.
Microsoft Entra ID Fundamentals
Identity as the new perimeter: users, groups, roles, applications and service principals, and what happens during a sign-in.
Security, Logging & Detection
Conditional Access, MFA and the shared responsibility model, what Azure, Microsoft 365 and Entra ID log, and the detection capabilities defenders use to catch an attack.
Day 2 · The attacker's side
Threat Landscape & Foundational Concepts
Understand the methodology, reproduce it, then detect it. Why cloud and identity intrusions look nothing like traditional network attacks, who is targeting Microsoft tenants today, and the tokens, sign-in flows and application consent that everything after this depends on.
Initial Access & Token Abuse
How attackers get their first foothold: phishing, device code and consent attacks, and how a stolen token is replayed to walk straight past a password and MFA.
Persistence, Discovery & Privilege Escalation
Holding that access with app registrations, added credentials and mailbox rules, mapping the tenant from the inside, then abusing over-permissioned applications and service principals to reach tenant-wide control.
Collection & Data Exfiltration
Following the data out: locating, staging and pulling it from mail, document stores and cloud storage, exactly as it happens in real incidents.
What you walk away with
- The fundamentals of Microsoft Azure
- The core services of Microsoft 365
- How identity works in Microsoft Entra ID
- The security and compliance basics of Azure and Microsoft 365
- How attacks against Azure, Microsoft 365 and Entra ID work, through a real attack scenario
- What can be logged in Azure, Microsoft 365 and Entra ID
- Experience using detection capabilities to investigate the attack scenario
Prerequisites
- No prior security experience required
- Beginner Azure knowledge (AZ-900 level)
- A laptop and a stable internet connection
- Helpful, but not required: Inside a Cyber Attack, taken first
Key details
- Dates
- 28–29 November 2026
- Format
- Online, 2 training days
- Audience
- University students
- Certificate
- Full attendance, both days
Student pricing
Take this bootcamp on its own, or combine it with Inside a Cyber Attack for the full four-day picture.
Part of Focal Point Academy. Sessions run on Microsoft Teams. Once registered, you join the Academy community on Discord for real-time support and team communication.
Follow us on LinkedIn for registration details and announcements.
Registration is subject to our event terms & conditions, including a refund if you cancel at least 30 days before the event.