Human judgement, AI speed.
Aveas Advanced
Leading Continuous Offensive Security Programs
Design and lead a continuous penetration testing program: threat-model complex cloud and multi-tenant systems, test cloud, CI/CD and AI features, run human and AI testing at scale, and produce audit-ready evidence for SOC 2, ISO 27001, HIPAA and PCI DSS.
About this certification
Aveas Advanced is for the people who own security assurance across many products and release trains. It adds the hardest technical ground, from cloud and pipeline attack paths to testing AI features, and the leadership work of running a program that keeps pace with continuous delivery.
It finishes with a capstone: a multi-stage engagement in a lab environment and a program design that the candidate presents and defends in a live review.
Who it is for
- Senior penetration testers and red team leads
- Application and product security leaders
- CISOs and engineering leaders who own security assurance
- GRC leads responsible for SOC 2, ISO 27001, HIPAA and PCI DSS evidence
What you will be able to do
- Design a continuous penetration testing program across many applications and release trains
- Threat-model cloud, microservice and multi-tenant architectures, including payment and health data flows
- Test cloud identity, container, Kubernetes and CI/CD attack paths
- Assess AI and LLM features for prompt injection, data leakage and tool abuse
- Decide what to automate and where expert judgement is required, and assure the quality of both
- Produce audit-ready evidence for SOC 2, ISO 27001, HIPAA and PCI DSS, and report risk to executives and boards
Course outline
10 modules · 32 topics · outline may be refined before launch
1Threat modelling complex systems3 topics
Decide what to test, and why, before testing it.
- Data-flow diagrams and trust boundaries at scale
- Threat modelling payment and health data flows
- Turning a threat model into a test plan
2Cloud attack paths3 topics
Where application flaws meet cloud privileges.
- Identity and access misconfiguration
- Metadata services, keys and storage exposure
- From an application foothold to the cloud account
3Containers, Kubernetes and CI/CD3 topics
The software supply chain as an attack surface.
- Container escape and cluster misconfiguration
- Secrets in pipelines and build systems
- Dependency and build integrity
4Advanced exploitation and attack chaining3 topics
Demonstrate impact the way a determined attacker would.
- Chaining across applications and services
- Lateral movement in SaaS architectures
- Proving impact without causing harm
5Testing AI and LLM features4 topics
New features, new classes of weakness.
- Prompt injection, direct and indirect
- Data leakage through models and retrieval
- Tool and agent abuse
- The OWASP Top 10 for LLM Applications
6Running human and AI testing at scale3 topics
Coverage at machine speed, judgement where it counts.
- What to automate, and what needs an expert
- Quality control of findings
- Safety controls for continuous testing in production
7Continuous testing in the delivery pipeline3 topics
Testing that keeps pace with every release.
- Release-triggered testing and change-based scope
- Findings into Jira or GitHub, with service levels
- Regression and retest automation
8Audit-ready evidence4 topics
Testing evidence that stands up to an auditor.
- PCI DSS penetration testing requirements
- ISO 27001 technical vulnerability management and security testing
- SOC 2 monitoring and HIPAA evaluation
- Evidence packages auditors accept
9Metrics, risk and executive reporting3 topics
Show the program is working.
- Programme metrics: coverage, time to fix, recurrence
- Risk language for executives and boards
- Budgeting and resourcing a testing program
10Capstone3 topics
Put it all together.
- A multi-stage lab engagement
- A program design for a fictional company
- Presenting and defending it in a live review
The exam
Planned format. The final details are published when the certification opens.
- Format
- A capstone in two parts
- Practical
- A multi-stage engagement across application, cloud and pipeline in a lab environment
- Programme
- A written program design for a fictional company, presented and defended in a live review with an assessor
- Details
- Durations, rubric and pass criteria are published when the certification opens
Prerequisites
Aveas Professional, or equivalent professional penetration testing experience.
Certificate and badge
an authorized certificate authority, verified on VeraGen LearnA certificate issued by Aveas, with a unique ID and QR code that anyone can check on the Verify page, and an Aveas Advanced digital badge.
Get notified when it opens
Aveas Advanced opens in 2027. Leave your email and we will tell you when enrollment opens.