Python, n8n and cyber security, mixed together like real work. Tiny steps, cartoons and games. Made for brains that get bored fast, including ADHD brains.
Next up
My path
One route through the best of the academy, in the right order. Just press the button in the orange box at the top, every day. Anything marked "Extra · later" can wait until the path is done.
Your 3 portfolio projects
Certificates get you seen. Projects get you hired. Each one appears on your path at the right moment. Peek now, build when the button sends you.
Daily 5-minute review
Five quick questions a day. Anything you got wrong comes back after one day, then three, then seven, until it sticks.
Why this works
Not how school teaches. How brains actually learn.
One thing at a timeEach step shows one idea. Do it, then move on. Nothing else on screen.
See it firstEvery idea starts with a cartoon or animation, then words, then code.
Play, don't cramTap, sort, spot the bug, fill the gap. Wrong answers are part of learning.
Breaks countBrain breaks are built in. Five minutes a day beats five hours once.
Season 1: Mama Rudo's Kitchen
Help a busy Harare kitchen go online, then defend it from attackers. Twelve missions, about five minutes each. Python, n8n and cyber, all in one story.
Season 2: Breaking the firewall
Msasa Homes gets a firewall. Learn how it decides, how it fails, and how to make it strong. Six missions, with Python mixed in. Links to Security+ Domains 2, 3 and 4.
Into the Breach, episode 1: Breaking the firewall
OPSWAT docuseries hosted by Kari Byron, filmed at Black Hat, RSA and DEF CON. Made Season 2.
Key takeaways
A firewall is a checkpoint that allows or blocks traffic using rules people write.
Rules run in order, so one badly placed rule can open a gap.
Allow-everything rules and thousands of unmanaged rules are common real-world failures.
Attackers fingerprint the firewall, look up known flaws and even study patches to build exploits.
Two firewalls help most when they are different brands, at a cost in complexity and speed.
Data diodes enforce one-way flow in hardware, for critical systems like power and water.
Our call
Good, practical episode, but it is made by OPSWAT, which sells data diodes. Treat "unhackable" as the sponsor's claim: a diode closes the return path, but people, suppliers and bad data flowing the allowed way are still risks. The flamethrower and robot dog are TV props.
More seasons are coming. Every new video or tutorial becomes new missions here.
Cyber in the age of AI
Eleven modules, each with a lesson, a drill and a hands on task. You practise on a pretend company, so nothing real ever gets touched.
Meet the practice company. Msasa Homes is a made up rental agency. It runs Zuri, a WhatsApp bot that answers tenants and books viewings, and Mita, a system that reads water and electricity meters and bills tenants. Both run on n8n with a database and an AI model. You will attack them, find the holes and fix them.
Season 2: MIT 6.858, how real systems break
Eight beginner-friendly lectures from MIT's graduate course Computer Systems Security (Fall 2014): threat models, the web, the network, HTTPS, passwords and the money behind cybercrime. One lecture per mission, plus a boss level. Do it after modules 1 to 6 above.
DANGER: MIT shows real attacks so you understand them. Practise only on Msasa Homes on paper, your own sites, and TryHackMe's machines. Never test a site or network you do not own.
Sources
MIT 6.858: Computer Systems Security
Prof. Nickolai Zeldovich and guest lecturers, MIT OpenCourseWare, Fall 2014. Made Cyber Season 2.
Creative Commons BY-NC-SA 4.0. We link to MIT, credit it, and explain in our own words. Free, never sold.
Our call
We kept lectures 1, 8, 9, 12, 13, 14, 17 and 23 and skipped the deep systems ones (buffer overflows, sandboxing, symbolic execution) until your Python and Linux are stronger. It is from 2014: the ideas hold, but some details have moved on. SSL is now called TLS, and passkeys came later.
Building a cybersecurity career in the age of AI
Kat in Cyber livestream with guest Faan Rossouw, 15 Oct 2026. Added modules 8 and 9.
Key takeaways
Attackers now use swarms of agents, so alerts will multiply. Defenders must answer with agents of their own.
The defender shifts from analyst to engineer: you design what agents may do and when they call you in.
Fundamentals still matter. You cannot direct agents on work you do not understand.
Nobody has more than a year or two of real agent experience, so a focused newcomer can catch up fast.
Build in public. Shared experiments with agents stand out more than another certificate.
Use AI to learn, not to skip learning. Ask why at every step.
Unprompted conference: search YouTube for its AI security talks
Our call
The speaker sells a paid course of about $499, with a 50% community code. Skip it for now: do modules 8 and 9 with Claude first. Treat the news examples in the talk as his claims. The method is what matters.
Top 5 cybersecurity courses 2026
Simplilearn YouTube video, 29 May 2026. Added modules 10 and 11.
Key takeaways
Choose a course by your level: beginner, experienced or leader.
Security+ is the usual first certificate. CISSP is for people with about five years of experience.
AI skills, ethical hacking, cloud security and threat detection are the growth areas.
Learn the main tools by name: Nmap, Nessus, Shodan, Metasploit.
Think like an attacker, respond like a defender.
Our call
Mostly an advert for Simplilearn's own paid programmes, so we kept only the career ladder and the tool names. Salary figures are the speaker's claims and were not checked. The video names SY0-701; this academy teaches SY0-801. It mentions US DoD 8570, which has since been replaced by DoD 8140.
Paste the next transcript into the chat with Claude to add another source.
Security+ : the real exam, made simple
This season maps to CompTIA Security+, the beginner certificate employers ask for most. Learn it here, then sit the real exam to get certified. It covers five domains. All five are live, plus free labs and a timed mock exam at the bottom.
Domain 1: General security concepts
Exam view: Domain 1 facts to memoriseThe five domains (SY0-801, official weights)
General Security Concepts, 16% (this one)
Threats, Vulnerabilities, and Attacks, 24%
Security Architecture, 19%
Security Operations, 27%
Security Program Management and Oversight, 14%
Domain 1 key terms
CIA triad: Confidentiality, Integrity, Availability.
AAA: Authentication (who you are), Authorization (what you may do), Accounting (what you did).
Auth factors: something you know, something you have, something you are. Two different types = MFA.
Least privilege: give the smallest access needed.
Zero trust: verify every request, never trust by location.
Defense in depth: many layers, physical + technical + administrative.
Encryption: reversible with a key. In transit (HTTPS/TLS) vs at rest (disk/db).
Hashing: one-way fingerprint. Store passwords hashed, never encrypted or plain.
The real exam is SY0-701 now; CompTIA confirms SY0-801 launches 17 Nov 2026 and 701 retires about mid 2027. As a 2027 learner, aim for SY0-801. Always check CompTIA's site for the current date before booking.
Story view: play through Domain 1
Six missions with Pip, games and exam drills. Nothing real is touched; the practice company is made up.
Domain 2: Threats, vulnerabilities and attacks
About 24% of the exam. Who attacks, how they get in, the weak spots they use, the signs they leave, and the new AI risks.
Exam view: Domain 2 facts to memoriseThe five official topics
Common threat actors and their motivations
Threat vectors and attack surfaces
Indicators of malicious activity
Common vulnerabilities and their risks
Security risks of artificial intelligence (new)
Threat actors
Nation-state / APT: most resources, patient, spying or disruption.
Organised crime: money. Hacktivist: a cause. Unskilled attacker: fame or fun.
Insider: already has access, often revenge or money. Shadow IT / accidental: no intent, still harmful.
Compare by: internal vs external, sophistication, resources and funding.
Vectors and social engineering
Vectors: email, SMS, IM, attachments, QR codes, USB, open Wi-Fi, Bluetooth, NFC, supply chain, watering hole.
Fail-open lets traffic through when broken, fail-closed blocks it. VPN (IPsec, TLS), full vs split tunnel, SASE, SD-WAN.
Data
Labels: public, private, sensitive, confidential, restricted, critical. States: at rest, in transit, in use.
Encryption, hashing, masking (****1234), tokenization (swap for a token), obfuscation, DLP, data sovereignty, geolocation.
Resilience
High availability, redundancy, clustering, load balancing, UPS and generator, multi-cloud.
Sites: hot (ready now), warm (partly), cold (empty space).
Backups: full, incremental (since last backup), differential (since last full), snapshots, replication, 3-2-1. Test restores. Tabletop, failover and simulation tests.
Story view: play through Domain 3
Domain 4: Security operations
The biggest domain, about 27% of the exam. The day job of a security analyst.
Exam view: Domain 4 facts to memoriseThe eight official topics
Security techniques for endpoints, networks, applications and data
Asset management across the lifecycle
Finding, prioritising and fixing vulnerabilities
Security monitoring and alerting
Identity and access management, federation and privileged access
Automation and orchestration, including AI-assisted workflows
Incident response, from preparation to lessons learned
30 questions in 30 minutes, weighted like the real exam, including hands-on style matching and ordering tasks. No feedback until the end, just like test day. Anything you get wrong goes into your daily review.
The real exam: up to 90 questions, 90 minutes, multiple-choice and performance-based, pass mark 750 on a 100 to 900 scale. Book it only when you score 800+ here several times and can explain every answer.
Free hands-on labs
TryHackMe rooms matched to each domain. Free account needed.
DANGER: only attack TryHackMe's own practice machines. Never scan or attack a network or website you do not own. If a room shows a lock, it has become paid: skip it.
Use this season to understand, Professor Messer to hear it explained a second way, TryHackMe to do it with your hands, and the mock exam to prove it. Never use dumps of real exam questions: they break CompTIA's rules and can cost you the certificate.
Tools: The Missing Semester
Eleven missions from MIT's free class on the tools every developer uses: the shell, Git, GitHub, editors, AI coding agents, automatic checks and everyday crypto. You need these to launch the academy on GitHub.
Your practice ground. Everything happens in a folder called academy-practice on your own laptop, with made-up files from Mama Rudo's Kitchen. No real client code or data, ever.
Sources
The Missing Semester of Your CS Education (MIT, 2026)
Free MIT class taught by Anish, Jon and Jose, plus their 2020 Security and Cryptography lecture. Made this season.
The best free tools course we found, and current: it now teaches AI coding agents. We explain it in our own words and link to MIT's lectures rather than copying them. MIT teaches on Linux and Mac; on Windows, use Git Bash now and WSL later. Skipped for now: Vim in depth, advanced profilers and containers in depth.
n8n labs
Five guided builds for the practice company. Use your own free accounts, never a real client's. Each step says exactly what to click and what you should see.
n8n templates: free workflows to take apart and learn from.
n8n community: search your exact error message here first.
When a lab works, export it from the workflow menu (Download) and save the file in your Academy folder.
Python from zero
Season 1: ten tiny lessons, each linked to something you already do in n8n. Season 2: MIT's real first-year course, below.
Season 2: MIT 6.100L, real computer science
MIT's free first programming course, taught by Dr. Ana Bell (Fall 2022). 26 lectures in 14 missions: two lectures per mission, one watch card per lecture, then games and a practice task in Mama Rudo's Kitchen. Start after the ten lessons above.
How to do this season. One lecture per sitting, never two. Watch with the mission open, pause when Pip's ideas show up, then do the check. Each lecture runs over an hour: watching 20 minutes a day is a win.
MIT 6.100L: Introduction to CS and Programming using Python
Dr. Ana Bell, MIT OpenCourseWare, Fall 2022. Made Python Season 2.
MIT OpenCourseWare material is shared under Creative Commons BY-NC-SA 4.0. We link to it, credit MIT and Dr. Ana Bell, and explain it in our own words. This season is free and never sold. If you copy MIT videos into your offline pack, keep them free, credited and under the same licence.
Our call
The best free university Python course we found, and the deepest on how computers think: loops, recursion, objects and speed. The problem sets are hard. Do them with Claude as a tutor that explains, never one that writes the answer.
The best free courses, in the order to take them
Story mode and these ten lessons. One idea at a time. Finish them first.
Season 2: MIT 6.100L, above. Real computer science, with watch cards and games.
Python for Everybody: the slowest, friendliest course. Use it whenever something feels too fast.
Harvard CS50P: the gold standard, free. Watch one lecture, then do its problems with Claude as your tutor.
Rule: never let Claude just write the code for you. Ask it to explain, then type it yourself.
Tracks
To add one, tell Claude: "I need to learn ___".
Story mode, Seasons 1 and 2Active
Cyber in the age of AI + MIT 6.858 seasonActive
Security+ (all 5 domains, labs, mock exam)Active
Tools: MIT Missing SemesterActive
n8n labsActive
Python from zero + MIT 6.100L seasonActive
My path + 3 portfolio projectsActive
Launch on GitHub Pages, offline mode and the laptop packNext
How this course grows
It keeps evolving, on any computer.
Find a great video or tutorial.
Copy its transcript.
Give it to Claude together with the Course Builder guide from the Academy folder.
Claude breaks it into small chunks and adds new missions, drills and labs to this page.
Use it anywhere
Online: edmundgumbo.github.io/tafadzwa, on any phone or laptop.
Install it: open that link in Chrome, then the menu (three dots), then Install app (on a phone: Add to Home screen). After one visit it opens with no internet.
Laptop pack: unzip the offline pack, double-click index.html. Put lecture videos in the videos folder (see get-videos.html there) and they play inside the watch cards.
STOP: progress is saved per address. Online, installed app and laptop pack each keep their own progress. Moving? Back up below first, then restore in the new place.
Keep your progress safe
Your progress lives in this browser only. A new laptop, a new browser or clearing your history starts you at zero. Back it up once a week.
Tap Copy.
Open your email, start a new email to yourself.
Subject: Academy backup. Paste the code in the body. Send.
Open your latest "Academy backup" email and copy the whole code.