A tailored course, built for your situation
Reference of choice on cross-functional SLSA reviews
Become the practitioner your peers turn to when secure software supply chains demand clarity.
$199 one-time
24-hour access provisioning
30-day money-back guarantee
Hand-built implementation playbook
12 modules. 12 chapters per module. 144 chapters total.
12 modules, each with 12 chapters (144 chapters total), text-based, plus downloadable templates and a hand-built implementation playbook delivered alongside course access.
Being seen as just another reviewer instead of the go-to expert on secure software artifacts.
The situation this course is for
Technical contributors often deliver strong work that stays under the radar. Without recognition as a definitive voice on frameworks like SLSA, their input gets diluted in cross-functional discussions, even when they hold the deepest understanding.
Who this is for
Senior individual contributor in a software or platform engineering role focused on security, compliance, or systems architecture within a large tech environment.
Who this is not for
Entry-level engineers, product managers without technical depth, or leaders looking for high-level governance overviews.
What you walk away with
- Lead SLSA tier assessments with confidence and consistency
- Build reusable attestation templates aligned to real-world pipeline designs
- Anticipate pushback on SLSA Level 3+ requirements and respond with precedent
- Guide cross-functional teams through SLSA gap analysis without deferring to external consultants
- Establish personal authority as the internal reference on SLSA implementation
The 12 modules (with all 144 chapters)
Module 1. SLSA fundamentals and tier progression
Ground your understanding in the core principles of SLSA, how tiers map to real infrastructure maturity, and where most implementations fail to progress beyond Level 2.
12 chapters in this module
- What SLSA solves that other frameworks don’t
- The role of provenance in software integrity
- Key differences between SLSA Level 1 and 2
- Common misconceptions about SLSA signing
- How SLSA integrates with CI/CD pipelines
- Real-world examples of SLSA Level 1 adoption
- Barriers to automated provenance generation
- The dependency on reproducible builds
- Signing policies across environments
- Verifiable build definitions explained
- Understanding metadata completeness
- Common tooling gaps in early SLSA
Module 2. Attestation design patterns
Develop templates for generating consistent, verifiable attestations across services, with attention to signing authority and metadata structure.
12 chapters in this module
- Purpose of attestation objects
- Creating DSSE envelopes correctly
- Signing keys lifecycle management
- Key discovery mechanisms
- Timestamping with trusted services
- When to chain multiple attestations
- Attestation scope definition
- Handling multi-team contributions
- Signing thresholds and policies
- Metadata integrity checks
- Schema version control
- Tooling support for attestation
Module 3. Provenance generation in practice
Learn how to implement reliable, automated provenance for builds, including toolchain integration and metadata accuracy.
12 chapters in this module
- Build configuration traceability
- Source integrity verification
- Reproducible build requirements
- Container image provenance capture
- Provenance file structure
- Linking source to build platform
- Build environment sandboxing
- Provenance signing triggers
- Integrating with GitOps workflows
- Handling third-party dependencies
- Provenance validation pre-deploy
- Automated remediation paths
Module 4. SLSA Level 3 implementation
Navigate the shift from basic signing to full isolation and reproducibility, including infrastructure and process requirements.
12 chapters in this module
- Criteria for SLSA Level 3
- Build isolation requirements
- Reproducibility across systems
- Dedicated build service setup
- Code review enforcement
- Separation of duties in builds
- Verification before signing
- Immutable build logs
- Access controls for build systems
- Audit trail completeness
- Toolchain integrity checks
- Documentation for Level 3 claims
Module 5. Verification workflows
Design end-to-end verification processes that validate provenance and attestations before deployment or reuse.
12 chapters in this module
- Verification policy creation
- Trusted timestamp validation
- Signature chain validation
- Metadata completeness checks
- Policy engine integration
- Verification in staging environments
- Handling failed verifications
- Automated rollback triggers
- Manual override governance
- Cross-team verification teams
- Logging verified status
- Reporting on verification gaps
Module 6. SLSA and dependency management
Apply SLSA principles to third-party and open-source components, ensuring supply chain confidence across the stack.
12 chapters in this module
- SBOM integration with SLSA
- Validating upstream attestations
- Trusted source registries
- Pin-based dependency verification
- Vulnerability scanning linkage
- Automated SBOM generation
- Dependency provenance review
- Allowlist enforcement rules
- License compliance checks
- Transitive dependency risks
- Fallback verification paths
- Vendor attestation requirements
Module 7. Cross-team SLSA adoption
Lead organizational rollout by aligning engineering, security, and platform teams around phased implementation.
12 chapters in this module
- Phased rollout planning
- Team-specific SLSA goals
- Onboarding template distribution
- Internal training materials
- SLOs for SLSA compliance
- Feedback loops from teams
- Common objections and rebuttals
- Documentation standardization
- Internal audit coordination
- Progress reporting dashboards
- Leadership update frameworks
- Celebrating early wins
Module 8. SLSA in regulated environments
Adapt SLSA practices to meet compliance mandates including auditability and reporting requirements.
12 chapters in this module
- Mapping SLSA to SOC 2
- NIST CSF alignment points
- Evidence for ISO 27001 controls
- GDPR software provenance needs
- Audit trail retention policies
- Regulator-facing documentation
- SLSA in financial services
- Healthcare software validation
- Government software standards
- Third-party assessment readiness
- Internal control assertions
- Compliance automation strategies
Module 9. Tooling ecosystem integration
Select and configure tooling to support full SLSA coverage without creating workflow friction.
12 chapters in this module
- Build system compatibility
- Sigstore integration options
- TUF and Rekor use cases
- In-toto with SLSA
- CI pipeline modifications
- Policy engines: Kyverno and Gatekeeper
- Logging and observability setup
- Key management solutions
- Secrets handling in builds
- Automated attestation triggers
- Tool interoperability testing
- Vendor tool evaluation
Module 10. SLSA gap analysis and remediation
Conduct assessments of existing pipelines and deliver actionable roadmaps for SLSA compliance.
12 chapters in this module
- Assessment scope definition
- Tier gap identification
- Provenance completeness scoring
- Signing process audit
- Build environment inspection
- Dependency validation check
- Attestation coverage review
- Verification mechanism test
- Policy enforcement evaluation
- Remediation prioritization
- Stakeholder reporting format
- Post-remediation validation
Module 11. Advanced SLSA Level 4 strategies
Design for full hermetic, reproducible builds with independent verification.
12 chapters in this module
- Hermetic build environments
- Reproducibility guarantees
- Trusted hardware roots
- Independent build verification
- Multi-party build consensus
- Time-based verification windows
- Tamper-proof logs
- Hardware-backed key storage
- Formal verification integration
- Zero-trust build pipelines
- Cross-organization validation
- Long-term retention planning
Module 12. Establishing personal authority on SLSA
Turn technical mastery into recognized influence through documentation, mentorship, and leadership visibility.
12 chapters in this module
- Creating internal playbooks
- Presenting at tech forums
- Mentoring junior engineers
- Publishing internal memos
- Leading design reviews
- Responding to escalations
- Building credibility preemptively
- Handling peer challenges
- Documenting precedent cases
- Influencing architecture boards
- Shaping internal policy
- Becoming the reference point
How this maps to your situation
- When onboarding new microservices to SLSA
- During audit preparation cycles
- Before third-party software integration
- After security incident reviews
Before vs. after
Before
Contributing to SLSA discussions without being the default reference.
After
Peers proactively seek your input on SLSA design and compliance, and your frameworks get adopted org-wide.
What's included with your purchase
- 12 modules with 12 chapters each (144 chapters)
- Downloadable templates and worked examples for every module
- Hand-built implementation playbook delivered alongside course access
- 30-day money-back guarantee
Delivery and format
- Course and learning environment access provisioned within 24 hours of purchase
- Hand-built implementation playbook delivered alongside course access
Format: Text-based modules and chapters in the Art of Service learning environment, plus downloadable templates and worked examples for every chapter, plus the hand-built implementation playbook delivered alongside course access.
Time investment: Approximately 2.5 hours per module, designed for technical practitioners balancing production work. Total course time: 30 hours.
If nothing changes
Without deliberate positioning, even strong technical work remains peer-level input rather than leadership influence, missing the opportunity to define standards and shape direction.
How this compares to the alternatives
Unlike generic compliance courses or vendor documentation, this course delivers field-tested implementation patterns, peer-tested rebuttals, and real-world templates designed for practitioners leading actual SLSA adoption, not just passing audits.
Frequently asked
Is this course focused on SLSA specifically?
Yes, every module is deeply grounded in SLSA frameworks, tiers, and implementation patterns.
How is the course structured?
12 modules, each containing 12 chapters (144 chapters total).
Can I use this if I’m not in security?
Absolutely. Platform engineers, build specialists, and senior ICs in regulated software delivery benefit most.
$199 one-time. Approximately 2.5 hours per module, designed for technical practitioners balancing production work. Total course time: 30 hours..
Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.
30-day money-back guarantee·
144 chapters·
Hand-built playbook included·
Account access within 24 hours