A tailored course, built for your situation
Deeper command of the SLSA framework for secure software supply chains
Master the framework defining modern software integrity verification
$199 one-time
24-hour access provisioning
30-day money-back guarantee
Hand-built implementation playbook
12 modules. 12 chapters per module. 144 chapters total.
12 modules, each with 12 chapters (144 chapters total), text-based, plus downloadable templates and a hand-built implementation playbook delivered alongside course access.
Frustrated by fragmented tooling and unclear SLSA implementation paths?
The situation this course is for
Most engineers approach SLSA through piecemeal tool integration without grasping the full control hierarchy. This leads to partial adoption, audit gaps, and rework when security reviews intensify.
Who this is for
Senior software engineer or platform specialist implementing supply chain security in product-first organizations
Who this is not for
Engineers focused only on runtime security, application pentesting, or network-layer controls without ownership of build pipelines or artifact provenance
What you walk away with
- Full command of SLSA’s four integrity levels and their technical thresholds
- Ability to design tier-appropriate build environments with reproducible outputs
- Confidence mapping third-party SBOMs to internal SLSA compliance benchmarks
- Mastery of signed attestations using Sigstore and Fulcio integration patterns
- Clarity on how SLSA integrates with internal tooling without requiring Jira or Atlassian-specific extensions
The 12 modules (with all 144 chapters)
Module 1. SLSA framework fundamentals and evolving adoption
Understand the core motivations behind SLSA, its relationship to NIST SSDF and SBOMs, and how it is being implemented across product-led engineering organizations today.
12 chapters in this module
- Origins of SLSA
- Key stakeholders in adoption
- SLSA vs SPDX vs CycloneDX
- Integration with CI CD
- Build vs release integrity
- Attestation basics
- Sigstore overview
- Tier 1 requirements
- Tier 2 thresholds
- Tier 3 objectives
- Tier 4 goals
- Framework versioning
Module 2. Artifact provenance and provenance signing
Learn how to generate verifiable metadata for software components and implement cryptographic signing to establish trust in origin and build process.
12 chapters in this module
- Provenance definition
- Envelope formats
- DSSE standard
- Signing with Cosign
- Keyless signing flow
- Fulcio certificate authority
- OIDC identity
- Rekor transparency log
- Verification workflow
- Provenance schema
- Provenance storage
- Provenance access
Module 3. Build integrity and reproducible outputs
Master techniques for ensuring builds are hermetic and deterministic, reducing drift and increasing confidence in artifact consistency across environments.
12 chapters in this module
- Hermetic builds
- Deterministic compilation
- Source capture
- Environment isolation
- Dependency pinning
- Container base security
- Build config signing
- Reproducibility testing
- Diff systems
- Build reproducibility score
- Toolchain trust
- Layered verification
Module 4. SLSA Level 1 implementation
Implement basic SLSA compliance with version-controlled source and authenticated controls over build triggers and artifact publication.
12 chapters in this module
- Source control gating
- Authenticated triggers
- Build service identity
- Artifact naming
- Provenance generation
- Initial signing
- Verification script
- Pipeline logging
- Access controls
- Deployment guardrails
- Review automation
- Compliance dashboard
Module 5. SLSA Level 2 implementation
Upgrade to intermediate integrity with build platform isolation and signed provenance, reducing risks from shared build environments.
12 chapters in this module
- Dedicated build platform
- Isolated workspace
- VM vs container isolation
- Build worker identity
- Signed provenance
- Provenance schema compliance
- Provenance signing
- Verification pipeline
- Audit trail completeness
- Dependency verification
- Artifact immutability
- Retention policy
Module 6. SLSA Level 3 implementation
Achieve high assurance through reproducible builds and two-person review requirements, enabling audit-grade confidence in production artifacts.
12 chapters in this module
- Reproducible build design
- Two person review rule
- Source diff verification
- Build config locking
- Binary diff analysis
- Rebuild on demand
- Provenance completeness
- Provenance signing policy
- Verification automation
- Attestation bundling
- Artifact indexing
- Trust domain mapping
Module 7. SLSA Level 4 implementation
Design fault-tolerant, fully reproducible build systems with adversarial resistance, suitable for critical infrastructure and regulated environments.
12 chapters in this module
- High availability builds
- Distributed rebuilds
- Threshold signing
- Build redundancy
- Adversarial testing
- Tamper proof logging
- Zero trust build pipeline
- Independent rebuild verification
- Cross org validation
- Signed release tags
- Threshold attestation
- Incident readiness
Module 8. SBOM integration with SLSA attestations
Combine software bills of materials with SLSA provenance to create rich, verifiable dependency disclosures for internal and external stakeholders.
12 chapters in this module
- SBOM formats
- SPDX generation
- CycloneDX export
- Dependency graph capture
- Transitive risk tracking
- Vulnerability mapping
- Attestation bundling
- Provenance inclusion
- SBOM signing
- SBOM verification
- Third party validation
- Regulator readiness
Module 9. CI/CD pipeline integration patterns
Adapt existing pipelines to meet SLSA requirements without disrupting developer velocity or requiring proprietary tooling.
12 chapters in this module
- Pipeline architecture
- Trigger security
- Build isolation
- Provenance injection
- Signing steps
- Verification gates
- Failure handling
- Developer feedback
- Pipeline hardening
- Identity binding
- Access audit
- Pipeline compliance
Module 10. Internal governance and framework adoption
Lead adoption across engineering teams by building internal standards, playbooks, and audit processes that scale with organizational maturity.
12 chapters in this module
- Adoption roadmap
- Tiered rollout
- Team enablement
- Training materials
- Internal benchmarks
- Audit preparation
- Compliance reporting
- Framework updates
- Policy enforcement
- Tooling standards
- Feedback loops
- Maturity tracking
Module 11. Third-party verification and vendor assessment
Evaluate external vendors and open-source projects using SLSA criteria to reduce supply chain risk and inform procurement decisions.
12 chapters in this module
- Vendor attestation review
- Tier compliance check
- Provenance validation
- Attestation verification
- SBOM completeness
- Build transparency
- Source availability
- Security posture
- Risk scoring
- Due diligence
- Escalation path
- Remediation guidance
Module 12. Audit readiness and external validation
Prepare for regulatory scrutiny and third-party audits with comprehensive documentation, verification tooling, and clear attestation trails.
12 chapters in this module
- Audit package composition
- Attestation bundles
- Provenance archives
- Verification tooling
- Log completeness
- Policy documentation
- Control mapping
- Evidence collection
- Response preparation
- Regulator engagement
- Findings resolution
- Improvement roadmap
How this maps to your situation
- When starting SLSA implementation
- Upgrading from Tier 1 to Tier 2
- Preparing for external audit
- Evaluating third-party software
Before vs. after
Before
SLSA guidance feels fragmented, with unclear paths from documentation to implementation.
After
You own a structured, repeatable approach to SLSA adoption across teams and pipelines.
What's included with your purchase
- 12 modules with 12 chapters each (144 chapters)
- Downloadable templates and worked examples for every module
- Hand-built implementation playbook delivered alongside course access
- 30-day money-back guarantee
Delivery and format
- Course and learning environment access provisioned within 24 hours of purchase
- Hand-built implementation playbook delivered alongside course access
Format: Text-based modules and chapters in the Art of Service learning environment, plus downloadable templates and worked examples for every chapter, plus the hand-built implementation playbook delivered alongside course access.
Time investment: 6-8 hours total, self-paced with downloadable references.
If nothing changes
Without clear command of SLSA, teams risk incomplete implementations, audit findings, and increased scrutiny during security reviews.
How this compares to the alternatives
Unlike vendor-specific certifications or general security courses, this program focuses exclusively on practical, implementation-grade SLSA mastery with no fluff or abstract theory.
Frequently asked
Who is this course for?
Senior software engineers, platform engineers, and security specialists implementing supply chain integrity in product-first engineering environments.
How is the course structured?
12 modules, each containing 12 chapters (144 chapters total).
Does this course cover Atlassian tools?
No. The course focuses on SLSA framework implementation using open standards and cloud-agnostic tooling, avoiding any reference to Atlassian products.
$199 one-time. 6-8 hours total, self-paced with downloadable references..
Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.
30-day money-back guarantee·
144 chapters·
Hand-built playbook included·
Account access within 24 hours