MAD SOCA
MITRE ATT&CK Defender — SOC Assessment
MAD20 track for assessing SOC capabilities using the ATT&CK framework. 17 lectures, heatmap and defensive recommendation walkthroughs. Teaches methodology for systematic assessment of detection coverage. Not a traditional certificate, but a badge upon course completion (9 CPE hours).
› Quality score
Four-axis SecProve rubric, each 0–10. SecProve editorial assessment — each axis carries a written justification so you can push back on any single call without dismissing the whole score.
› Built for these roles
› Exam format
Course-based with badge: 17 lectures + hands-on walkthroughs. No separate exam. 9 CPE hours.
› Recertification
Annual AMF program required to keep certification current. Access to updated course content and exclusive webinars.
› NICE Framework work roles
The NIST NICE work-role IDs this cert maps to. NICCS lookup.
› Core domains covered
The 2 domains this cert is centrally about. Passing the exam demonstrates working knowledge of each.
› Prerequisites
MAD ATT&CK Fundamentals (prerequisite). Recommended: SOC experience.
› Progression
requiredrecommendedWhere this cert fits in the typical learning path. Required edges are vendor-gated; recommended edges reflect de facto industry progression.
No vendor-gated prereqs.
No certs require this one.
No follow-on certs reference this one yet.
See this cert’s domains highlighted on the interactive map, or compare it against the rest of the catalog.