Train your teams to build security in — not bolt it on.
CyberMentee is a hands-on application-security practice for engineering teams, CTOs, CISOs and security leads — working on your actual pipeline and codebase, real findings, real fixes.
A bug found in development costs a fraction of what it costs in production. Industry data puts that ratio at 100× or more.
The pentest came back. Forty pages of findings the team has seen before. Patching them one by one isn't the fix — the goal is developers who stop writing them in the first place.
- The same vulnerability classes show up in every report — injection, broken auth, leaked secrets, vulnerable dependencies.
- Generic e-learning gets clicked through and forgotten. It never touches your actual codebase or pipeline.
- Security feels like something done to the team after the fact, instead of part of how they build.
Security woven into every stage of how your team already builds.
No separate “security phase.” We work inside your existing workflow — from the first commit to what's running in production — so good practice becomes the default, not an extra step.
Write it safe
Secure coding patterns, secret scanning, threat modeling a real feature.
AI-generated code goes through the same gatesCatch it early
SAST and dependency scanning wired into the pipeline, tuned to cut the noise.
Prove it
DAST, IaC scanning, and review gates that fail loud on what actually matters.
Keep it safe
Supply-chain integrity and runtime checks, owned by the team that ships.
Application security, taught as engineering.
Pick the topics your team needs most — every one is delivered hands-on, on your stack.
Secure coding
The OWASP Top 10 in your languages — injection, auth, secrets, and the patterns that prevent them.
Threat modeling
Find risk at design time on a real feature — trust boundaries, attack surface, blast radius.
Pipeline security
SAST, DAST and SCA wired into CI/CD as enforced quality gates — tuned, not noisy.
Dependencies & supply chain
Software composition analysis, SBOM and artifact integrity — so what you ship is what you built.
Secure SDLC & governance
Roles, approval gates and traceable evidence — an operating model, not a checklist.
NIS2-aligned training
Maps to the secure-development controls and produces documented, audit-ready completion records.
AI-assisted development
Copilot and LLM-generated code ships fast — and confidently reproduces vulnerability patterns it learned from decades of insecure public code. We cover review patterns for AI output, guardrails wired into the pipeline, and the failure modes AI gets confidently wrong.
Start small or go deep. Every format works on your code.
Three ways in, designed to fit how far your team wants to go. Pick a starting point — we scope the rest on a call.
Dev Security Taster
A live session where the team finds and fixes real vulnerabilities in a sample app — and sees how it maps to their own code.
- Hands-on from minute one
- No prep required from your side
- A clear read on where the gaps are
For: teams testing the waters before committing.
Book the tasterHands-on Workshop
The core program. Secure coding and DevSecOps built around your real pipeline — scanning wired in, a feature threat-modeled, live findings fixed together.
- Built on your languages and pipeline
- SAST / DAST / SCA, tuned not noisy
- Team leaves with habits, not handouts
For: teams ready to change how they build.
Scope a workshopMentee Retainer
Security stays in the room after the workshop ends. Recurring pipeline review and open office hours for the dev team, on a monthly rhythm.
- Regular review of new code and config
- Office hours when the team hits a wall
- A standing security voice, no headcount
For: teams who want it to last.
Talk retainerNeed a full programme? We build it — in your brand.
Alongside live training, we design and produce complete, branded security learning for your organisation: curriculum, slides, hands-on labs and ready-to-run e-learning — mapped to roles and to NIS2, delivered in your look and your tone, in English and Hungarian.
Discuss a custom programmeMost security trainers can teach or they can ship. CyberMentee does both.
CyberMentee is led by someone who has spent a career on both sides of the screen — securing real systems under real pressure, and teaching engineers how it's done, at university and in their own courses. That's why the training lands as engineering, not theatre — and why it actually sticks.
Barnabás Sándor, Ph.D.
I build security into engineering — not on top of it. Over 15+ years I've worked hands-on with DevSecOps, security architecture and automation at MOL Group, 4iG Group, GE Digital and Morgan Stanley — leading security teams and rolling out DevSecOps across several organisations. I hold a PhD in cybersecurity and teach developers at university and in my own courses, so the training doesn't just deploy frameworks — it teaches why they work, from someone who's shipped under real pressure and taught it for years.
Connect on LinkedInThe things teams ask first.
Who is the training for?
Do you train on our actual code and pipeline?
Does this help with NIS2 compliance?
Which languages and tech stacks do you cover?
Do you cover AI-generated code and Copilot security?
How long is it, and what's the format?
Is it remote or on-site, and in which languages?
What does it cost?
How is this different from generic security e-learning?
How do we get started?
Tell us about your team and your stack.
Tell us about your team and stack, and what triggered this. We'll reply with where we'd start and which format fits — no pitch deck.