Cloud Hacking & Cloud Defence.
How Modern Breaches Really Happen
Organisations are moving to the cloud, and attackers moved there too. Many recent incidents affecting major companies and public institutions started with a compromised cloud account, an identity attack or a misconfiguration. This bootcamp shows how those attacks work, and how defenders catch them.
Methodology
- MITRE ATT&CK-aligned
- APT-focused campaign
2
Training days
6
Core modules
100%
Online delivery
8
Sessions
The new battlefield: cloud, identity and data
Built on real-world attack scenarios, this bootcamp gives a practical understanding of how cyber attacks happen in modern cloud environments and how organisations detect and respond to them.
01
Inside a Microsoft tenant
How Azure and Microsoft 365 fit together: tenants, subscriptions and the services where an organisation's people, mail and documents actually live.
02
The cloud attack surface
Why attackers moved to the cloud with everyone else, and what a cloud environment looks like from an attacker's point of view.
03
Identity and access attacks
Account compromise, consent abuse and over-permissioned roles, and how a stolen token walks past MFA: the entry point behind most modern breaches.
04
Persistence and escalation
How attackers keep a way back in by registering their own MFA device or backdooring an app, then abuse service principals to reach tenant-wide control.
05
How data gets stolen
Following the data out of a cloud environment: discovery, staging and exfiltration from real-world incidents.
06
Shared responsibility
What the cloud provider secures, what the customer must secure, and why that boundary is where breaches happen.
Two days, foundations then attack
Day one you learn how a real Microsoft cloud tenant is built and secured. Day two you attack one, and see what the defenders would have caught.
Day 1 · The cloud foundations
Azure Fundamentals
How a cloud environment is actually built: tenants, subscriptions, resource groups, core services and the role-based access model that holds it together.
Microsoft 365 Core Services
Exchange Online, SharePoint, OneDrive and Teams. Where an organisation's people, mail and documents really live, and how those services connect.
Microsoft Entra ID Fundamentals
Identity as the new perimeter: users, groups, roles, applications and service principals, and what happens during a sign-in.
Security & Compliance Basics
Conditional Access, MFA, audit logging and the shared responsibility model: what the platform protects, and what the customer has to configure.
Day 2 · The attacker's side
Threat Landscape & Foundational Concepts
Understand the methodology, reproduce it, then detect it. Why cloud and identity intrusions look nothing like traditional network attacks, who is targeting Microsoft tenants today, and the tokens, sign-in flows and application consent that everything after this depends on.
Initial Access & Token Abuse
How attackers get their first foothold: phishing, device code and consent attacks, and how a stolen token is replayed to walk straight past a password and MFA.
Persistence, Discovery & Privilege Escalation
Holding that access with app registrations, added credentials and mailbox rules, mapping the tenant from the inside, then abusing over-permissioned applications and service principals to reach tenant-wide control.
Collection & Data Exfiltration
Following the data out: locating, staging and pulling it from mail, document stores and cloud storage, exactly as it happens in real incidents.
What you walk away with
- Understand how Azure and Microsoft 365 environments are built
- Understand identity as the new security perimeter in Microsoft Entra ID
- Understand how Conditional Access, MFA and audit logging protect a tenant
- Understand the shared responsibility model in cloud security
- Understand how attackers gain a first foothold through tokens and consent
- Understand how attackers persist and escalate to tenant-wide control
- Understand how data is located and stolen from a cloud environment
- Understand the cloud threat landscape facing organisations today
Prerequisites
- No prior cloud or security experience required
- Basic computer literacy is enough to follow along
- A laptop and a stable internet connection
- Helpful, but not required: Inside a Cyber Attack, taken first
Key details
- Dates
- 28–29 November 2026
- Format
- Online, 2 training days
- Audience
- University students
- Certificate
- Full attendance, both days
Student pricing
Take this bootcamp on its own, or combine it with Inside a Cyber Attack for the full four-day picture.
Part of Focal Point Academy. Once registered, you join the Academy community on Discord, where everyone taking the bootcamps comes together.
Follow us on LinkedIn for registration details and announcements.
Registration is subject to our event terms & conditions, including a refund if you cancel at least 30 days before the event.