Every black belt started at white
Free. Four weeks beside an AI SOC: build a lab, attack it, investigate, and question the agents. Walk out with a White Belt and public proof.
- 4 weeks
- Less than 2 hours per week
- Build in public
How it works
One hour a week for four weeks. Each week earns a stripe on your white belt, and you take one real incident from first alert to writeup — checking the AI agents’ work at every step.
Week 1 of 4White belt, stripe 1
Foundations
Set up your lab machine and connect it to Jutsu, and learn the language of a SOC from zero — what an alert is, what severity means, and what an AI agent actually does.
- A lab machine — a local VM, or a cloud instance you spin up — connected to Jutsu and streaming events
- The SOC basics down: people, process, technology, and where the AI agents fit the workflow
- A screenshot of your connected machine, and a prediction for week 2
Build and connect your lab
Your post prompt
Week 1 of the Jutsu Ambassador program: I set up my first security lab and connected it to a live SOC. Post the screenshot, then answer three things. What did you build, what broke, and what did fixing it teach you?
Week 2 of 4White belt, stripe 2
Threat intel & detection
Run password-spray and brute-force login attacks against your own lab, then read the alerts the AI agents enrich — IP reputation, geo, and history the raw logs never showed you.
- A password-spray and a brute-force run against a service you control, side by side
- Both alerts found in Jutsu, with the enrichment the AI agents added to each
- A note on how a raw event becomes an alert — and which of the two looked more serious
Attack it, read the alerts
Your post prompt
Week 2: I attacked my own lab. Show the commands you ran and the alerts they set off. What did the SOC's enrichment tell you that the raw logs did not?
Week 3 of 4White belt, stripe 3
Triage
Take one alert through a real triage process — evidence, timeline, verdict — then hold your call up against the AI agent's own assessment of the same alert.
- One alert triaged end to end: true positive, false positive, or needs more work, with reasoning you can defend
- An investigation timeline: what happened, in what order, to which host
- A note comparing your verdict with the AI agent's assessment — where you agreed, and where you did not
Investigate and reach a verdict
Your post prompt
Week 3: I ran my first alert triage. Walk through it start to finish. Where did your judgment and the AI agent's assessment line up, and where did they part ways?
Week 4 of 4White belt, stripe 4
The broader landscape
Turn your verdict into an incident-response report, then zoom out — cloud security, compliance, and the hard question of how far to let an AI agent act on its own.
- An incident-response report: containment, eradication, recovery, and lessons learned
- Your take on the hard question — should an AI agent contain a threat automatically, or wait for a human?
- Your published writeup, plus your Jutsu White Belt certificate and badge
Respond, then zoom out
Your post prompt
Week 4: here is my full writeup, and my White Belt. Lead with the honest version. What could you not do four weeks ago that you can do now?
That is the whole program. Four weeks, four stripes, four posts, one incident — and the White Belt they add up to.
Apply for FreeWhat you walk away with
By the end you have not just learned the words — SOC, triage, AI agent. You have four things that prove you practiced the work behind them.
A real incident report
Your own triage notes, a verdict you can defend, and a full incident report — containment through lessons learned. The kind of evidence a SOC actually keeps, in a document you can hand a hiring manager.
A public learning trail
Four weekly posts that turn quiet lab work into a visible record, reshared from the Jutsu account so it reaches security people who do not know you yet.
Your Jutsu White Belt
A verifiable White Belt certificate and profile badge — a stripe for every week you finished, issued once you complete all four. An honest, introductory credential, and the first belt on a longer path.
A way into the community
The program is your entry point, not the end of it. Finish, and there is a path to keep going — Contributor, Advocate, and the belts beyond — with people building the future of agentic security together.
Who usually applies
Beginners who want to learn security by doing the work, not by collecting another certificate. No security job, no degree in it, and something to prove.
Career switchers
You are coming from support, sales, teaching, or something else entirely, and you need proof, not another course certificate.
Students and new grads
You have the theory and none of the receipts, and every job posting still asks for two years of experience.
IT and helpdesk pros
You already touch the systems, you just need the security side of the work on paper and in public.
Certified but never hands-on
You passed the exam, you have never triaged a real alert, and you know it shows in interviews.
What we ask in return
Five things, and none of them cost money. Two we never bend on: the weekly post that makes your work visible, and the rule that everything stays inside your own lab.
Give it four weeks
Roughly 1 to 1.5 hours a week — a few short lessons, a video, one hands-on lab, and one thing to hand in. Everything is pre-recorded, so you take your hour whenever it suits you.
Post on LinkedIn every week
This one is not optional. The weekly post is how four weeks of quiet lab work becomes a visible learning trail, and we hand you the prompt each week so you never face a blank box.
Bring a machine that can run a VM
Anything that can run one virtual machine is enough — roughly 8GB of RAM and some free disk. It is the one hardware requirement, because the whole program is a hands-on lab that lives on that VM.
Keep everything in your own lab
This is defensive training. You only ever run these tools against a lab you own — never a system you do not, and never with real company or customer data. That line does not bend.
Question the AI, do not just trust it
The agents are fast, not infallible — they can miss evidence or overstate risk. Half the skill is checking their reasoning: treat what they conclude as a starting point, then decide for yourself.
Week 1 prompt
I built my first security lab tonight. One VM, one log source, and a live event stream landing in Jutsu.
About two minutes of writing.
We write the prompt. You write three sentences and press post. That is the whole requirement.
There is no bar to clear
No degree, no experience, no budget. If you are curious and you show up, you already qualify.
A degree
We do not ask where you studied, or whether you did.
A security job
Most do not have one yet. That is why they applied.
Prior SIEM or SOC experience
Week 1 assumes you have never opened one in your life.
A budget
The program is free, and the lab runs on the laptop you own.
Frequently Asked Questions
The things worth knowing before you fill anything in.
How much does it cost?
Nothing. The program is free, your Jutsu workspace is free, and everything the lab needs is either free or already on your laptop.
How much time does this actually take?
About 1 to 1.5 hours a week for four weeks. There are no live classes you have to sit through, so you can take your hour whenever it fits your week.
What do I need to know before I start?
Enough to be curious and follow instructions. If you have never built a VM, never run Nmap, and never opened a SIEM, you are exactly who this was built for.
How much of this is about AI?
A fair amount, on purpose. Modern SOCs increasingly run AI agents that normalize data, enrich alerts, and reason through evidence, and you work alongside them the whole way. The real skill is learning to check that reasoning instead of trusting it: by week 3 you compare your own verdict with the AI's assessment, and by week 4 you decide how much you would let it act on its own.
What hardware do I need?
A personal computer that can run a single virtual machine, so around 8GB of RAM and 40GB of free disk. That is the one hard requirement: the whole program is a hands-on lab that runs on a VM, so a machine that cannot run one cannot do the work.
Do I need to know Linux?
No. Week 1 hands you a written setup guide and a walkthrough video, and you can ask for a live hand if you want one. You will use the Linux command line during the labs, but you do not need to know it going in.
Is this a job or a paid internship?
No. It is unpaid in both directions: we do not charge you and we do not pay you. What you get is real experience, a public track record, and an introduction into our hiring network if you stand out.
What is the belt system?
The four weeks are your White Belt, in training. Each week you finish adds a stripe, and all four earn the Jutsu White Belt certificate. Beyond the program there is an ongoing ambassador track — Blue, Purple, Brown, and Black — for people who keep creating, mentoring, and building with the community.
Is the certificate a professional certification?
No, and we are upfront about it. The White Belt certificate reflects an introductory, hands-on program — it is not Security+, ISC2 CC, or an industry credential, and you should describe it honestly for what it is. What makes it worth showing is the public work behind it: your weekly posts, your writeup, and a lab you actually built.
What happens if I miss a week?
Nothing happens. Everything is pre-recorded, so a week you miss is a week that waits for you. Say so in the channel and pick it back up when you can.
Do I really have to post on LinkedIn?
Yes, once a week, and it is not optional. The posts are what turn four weeks of quiet lab work into a visible learning trail, and we give you the prompt each week so writing them takes minutes. Keep them public-safe — no private screenshots, real IP addresses, or employer details.
Is this legal, and is it safe?
Yes. This is defensive training: everything runs inside your own lab, against machines you own, and never with real company or customer data. You never point a tool at a system you do not control — that rule is the first thing every lab reminds you of, and it is one we never bend on.
When can I start?
As soon as we let you in. Every week is pre-recorded and self-paced, so there is no start date to wait for and no live session to be awake for.
Is it open worldwide?
Yes. It is fully remote, fully async, and in English. Nothing is scheduled, so your time zone never costs you anything.
Come in at white belt
No stripes yet — that is the point. Everyone starts here. Put in your hour a week, earn them one at a time, and finish with a belt, a writeup, and a way into the community.
Subscribe to our newsletter
Get the latest security tips, product updates, and news delivered to your inbox.