Training built around the work your team owns.
Live, custom product security training for the people who make, select, deploy, operate, and support connected and safety-critical products.
Your teams do not need the same lecture at different volumes. Leaders need clear oversight and risk decisions. Engineers need methods they can apply. Quality, regulatory, procurement, operations, and security teams need to understand their part of the lifecycle and the handoffs between them.
The Product Security Guild builds each engagement around your products, roles, processes, technologies, risks, and desired level of participation.
Product security is learned in the decisions.
A generic course can define a threat model, an SBOM, or a compensating control. Custom training shows your team when it needs one, who owns it, how it connects to the next activity, and what a useful result looks like.
We start with the outcome you need. That might be preparing leaders to oversee a program, helping engineers apply a Secure Product Development Framework, teaching procurement teams to assess supplier evidence, or exercising an incident involving a product that cannot simply be switched off.
The session is then built for the people in the room, the products they support, and the decisions they must make after the training ends.
One subject can require four different conversations.
Developers and engineers
Build practical capability through technical workshops and hands-on exercises. Content can be adapted for systems, software, cloud, mobile, embedded, firmware, hardware, test, and security engineering teams.
Possible focus areas
- Threat modeling and cybersecurity risk assessment.
- Security requirements, architecture, controls, and traceability.
- Secure design and implementation practices.
- SBOMs, third-party software, software composition analysis, and vulnerability review.
- Attack-surface analysis, security test planning, static analysis, fuzzing, malformed-input testing, protocol testing, and penetration testing.
- Finding assessment, remediation decisions, retesting, and evidence.
Executive and board leadership
Connect product security to organizational risk, safety, regulatory and customer expectations, investment, oversight, and accountability. Briefings are designed for leaders who need to make decisions and ask better questions, not perform the engineering work.
Possible focus areas
- Product-security governance, accountability, and risk ownership.
- Regulatory, customer, safety, operational, and business expectations.
- Program strategy, priorities, investment, and resource decisions.
- Metrics, management reporting, risk acceptance, and oversight.
- Executive and board roles during a significant product-security incident.
Functional and program leadership
Help product, engineering, quality, regulatory, security, IT, operations, procurement, and compliance leaders understand how their work connects across the lifecycle. Sessions can focus on operating models, decision paths, deliverables, and the handoffs that often create gaps.
Possible focus areas
- Roles, responsibilities, escalation paths, and cross-functional workflows.
- Product classification, criticality, risk tiering, and minimum requirements.
- Secure development, verification, release, maintenance, and retirement processes.
- Supplier evidence, exceptions, vulnerability decisions, and management review.
- Program assessments, maturity roadmaps, and practical implementation planning.
Product users and operators
Prepare the teams that select, deploy, operate, maintain, and retire connected products. Training can bring procurement, IT, security, engineering, operations, clinical or technical users, privacy, compliance, and incident-response teams into the same decision process.
Possible focus areas
- Security-informed procurement and supplier evidence review.
- Secure deployment, segmentation, configuration, identity, remote access, and logging.
- Product, software, component, owner, location, and support-status inventory.
- Manufacturer advisories, SBOM and VEX use, vulnerability applicability, patching, compensating controls, and risk acceptance.
- Product-specific incident readiness, manufacturer coordination, recovery, and return to service.
- Unsupported-product, replacement, retirement, and disposal planning.
Choose the format that helps the team act.
Executive or board briefing
A focused live session for decision-makers who need a clear view of product-security risk, expectations, priorities, and oversight. Delivered in person or live online.
Lunch-and-learn
A concise introduction to a defined topic, product-security issue, or shared responsibility. Useful for awareness, a program launch, or bringing multiple functions into the same conversation.
Working session
A facilitated session built around a real decision, process, product category, or artifact. The goal is to leave with shared understanding and a practical next step, not simply a completed presentation.
Interactive workshop
A deeper live session combining instruction, discussion, and guided application. Workshops can use realistic scenarios, sample artifacts, or agreed customer context to help participants practice the method.
Tabletop exercise
A facilitated scenario that tests roles, escalation, communication, evidence, containment, continuity, manufacturer coordination, recovery, and decision-making. Scenarios can be designed around a product vulnerability, supplier notification, security incident, regulatory deadline, or operational disruption.
Hands-on technical lab
Instructor-led exercises for engineers, developers, testers, and security practitioners. Labs can focus on threat modeling, architecture review, vulnerability analysis, security testing, remediation, or risk decisions using an agreed technical environment.
Recurring training program
A series of live sessions that develops capability over time. Programs can follow the product lifecycle, support a program rollout, or provide role-based training to different groups while keeping the terminology and operating model consistent.
Recorded or blended delivery
Live instruction can be combined with approved recordings, reference material, exercises, and follow-up sessions when teams are distributed or need a reusable internal resource. Recording scope and access are agreed in advance.
Build the agenda around your product-security challenge.
The examples below are starting points, not fixed courses. Topics can be combined, narrowed, or adapted to the audience, product, industry, market, and level of technical depth.
Product security foundations
Terminology, lifecycle responsibilities, product versus enterprise security, roles, governance, risk decisions, and the relationship between engineering, evidence, and operations.
Governance and program implementation
Operating models, policies, procedures, responsibility mapping, quality-system integration, maturity assessment, roadmaps, metrics, reporting, and management oversight.
Secure product development
Secure Product Development Frameworks, threat modeling, cybersecurity risk assessment, architecture, requirements, controls, traceability, third-party software, release readiness, and product change.
Security verification and testing
Attack surfaces, test strategy, penetration testing, static analysis, vulnerability scanning, software composition analysis, fuzzing, protocol testing, finding assessment, remediation, and retesting.
Regulatory and customer evidence
Training can be organized around the requirements and evidence relevant to the agreed product and market. Examples may include FD&C Act Section 524B, FDA premarket cybersecurity guidance, the Quality Management System Regulation, IEC 81001-5-1, GLI standards, IEC 62443, the EU Cyber Resilience Act, or customer-imposed supplier requirements. Applicability is confirmed before the agenda is built.
Postmarket and vulnerability management
Security-signal surveillance, coordinated vulnerability disclosure, SBOM maintenance, advisory assessment, vulnerability triage, patch and remediation planning, communications, legacy products, and end of support.
Secure product procurement and operation
Security requirements, supplier evidence, product risk assessment, secure deployment, configuration, inventory, access, monitoring, maintenance, vulnerability decisions, exceptions, and retirement.
Product-security incident readiness
Product-specific plans, roles, evidence, manufacturer coordination, safety and operational constraints, containment, continuity, recovery, return-to-service criteria, and corrective action.
Industry-specific application
Scenarios and terminology can be adapted for medical devices and healthcare technology, casino and gaming systems, biotechnology and laboratory environments, industrial and operational technology, manufacturing, semiconductor environments, energy infrastructure, and other connected or safety-critical products.
The training starts before the session does.
1. Define the outcome
We identify the audience, the decisions they own, what should change after the training, and how the session fits the wider product-security program.
2. Set the context
We agree the product, process, technology, regulatory, customer, or operating context that should shape the material. Sensitive information is handled through an appropriate channel after the engagement is established.
3. Design the session
We propose the agenda, technical depth, delivery format, level of participation, scenarios, and any exercises or supporting material. The scope is agreed before development begins.
4. Deliver and apply
The Guild leads the live session, facilitates discussion and exercises, and keeps the work connected to the decisions participants need to make. Agreed reference material, outputs, or follow-up actions are included in the engagement scope.
How can we help?
Start with the audience, the product-security challenge, and the outcome you want. We will recommend a scope, format, and level of participation that fits the work.
Request Custom Training
Tell us who the training is for and what should change after the session. We will follow up to discuss the context and the right way to deliver it.
