I started in computer security on BBS networks in the 1980s. Today I teach AP Computer Science and Cybersecurity while building toward a full-time remote role in SOC analysis or penetration testing.
My TryHackMe profile sits at USA Rank #76, Top 1% globally. I hold a Physical Penetration Testing certification, am completing Security+ on the CompTIA track, and document every room I complete in this blog.
I also run MakerMindStudio, a 3D printing and laser engraving operation, and publish health and systems writing under the FACTOTUM Protocol.
TryHackMe room writeups published as completed. Each walkthrough covers the tools used, the logic behind each step, and the security concepts the room demonstrates.
Code review for security vulnerabilities with a written findings report, severity ratings, and specific fixes. Three tiers: Entry Scan ($499), Standard Audit ($1,200–$2,500), and Full Certification. Entry Scan turnaround is 72 hours.
I review your resume and LinkedIn profile against current cybersecurity and tech hiring standards. You get a marked-up document with specific rewrites, not a checklist of generic suggestions.
A structured 90-day plan built around your current certifications, experience level, and target role. Covers what to study, what to build, and what to skip.
Line-by-line feedback on AP Computer Science Free Response Questions. Written for students preparing for the exam or teachers who want a second set of eyes on student work.
Author: Mario Martinez Jr. (ku5e / Gary7) | TryHackMe USA Rank #76 | Top 1%
Difficulty: Easy
Topics: CPU Architecture, x86 Registers, Memory Layout, Stack Analysis, Malware Analysis Fundamentals
Link: x86 Architecture Overview on TryHackMe
Answers are redacted within the narrative to allow you to complete the tasks on your own, but a full table of answers is available at the end of this walkthrough.
This room gives you the mental model that makes malware analysis readable. Before you open a binary in Ghidra or step through a sample in x64dbg, you need to know what the CPU is actually doing with its registers and memory. The room covers Von Neumann architecture, x86 registers from EAX down to the segment registers, the four-section memory layout, and the stack. It takes about an hour. If you plan to do any serious reverse engineering, that hour is not optional.
...
Your DLP Policy Does Not Know What Your Employees Are Running
76% of organizations call shadow AI a definite or probable problem. That number grew 15 points in one year. The 24% who do not call it a problem are not running a cleaner operation. They have not looked.
The standard data loss prevention tools deployed to catch unauthorized AI usage have the same blind spot that plagiarism detectors have in a classroom where students already know the humanizer tools exist.
...
The Bilingual Cybersecurity Professional Is Not a Diversity Hire
The Spanish National Cybersecurity Institute documented ransomware campaigns targeting Spanish speakers using natural, regionally appropriate Spanish generated with AI assistance — delivered through Google Drive links disguised as financial documents. The social engineering worked because the language read correctly. A monolingual analyst reviewing that email in a log sees foreign-language content and flags it by pattern or script. A bilingual analyst reads it and identifies the technique.
That is not a soft skill. That is a detection capability.
...
TryHackMe Rooms Are Not as Easy as They Feel
During Advent of Cyber, a room felt manageable — not because the concepts were simple, but because the room told you which system to examine, confirmed that a threat was present, and guaranteed that completing the steps would surface an answer. That structure is useful for learning. It is also the exact thing that disappears in a real investigation.
The gap between TryHackMe and real incident response is not difficulty. It is the absence of a defined answer.
...
The First 90 Days in a Security Role Are Not on Any Cert Exam
In a live security environment, alerts fire without labels. No task question. No confirmation that something is there. No rubric for how long to spend on a given signal before surfacing it. The volume on day one is unlike anything a certification exam simulates, and the volume is not the problem. Calibration is.
The credential gets you past the filter. What you do with alerts in the first 90 days determines whether you clear probation.
...
Security+ Is Not the Cert the SOC Job Requires
CompTIA Security+ has a domain called “Security Operations.” It is the largest domain on the exam at 28%. CompTIA CySA+ has a domain called the same thing, at 33%. The Security+ version covers asset management, vulnerability management, identity controls, and incident response. The CySA+ version names specific tools in its exam objectives: Wireshark for traffic analysis, SIEM platforms for detection and correlation, VirusTotal for threat investigation. Security+ covers enough to recognize those concepts in a multiple-choice question. CySA+ covers enough to use them in an investigation.
...
TryHackMe - Threat Modelling Walkthrough
Author: Mario Martinez Jr. (ku5e / Gary7) | TryHackMe USA Rank #76 | Top 1%
Difficulty: Easy
Topics: Threat Modelling, MITRE ATT&CK, DREAD, STRIDE, PASTA
Link: Threat Modelling on TryHackMe
Answers are redacted within the narrative to allow you to complete the tasks on your own, but a full table of answers is available at the end of this walkthrough.
This room walks through four threat modeling frameworks used by security teams to identify, categorize, and prioritize risks. You apply each framework to realistic organizational scenarios, including a financial services company and an e-commerce payment processor.
...
TryHackMe: Threat Intel & Containment
Author: Mario Martinez Jr. (ku5e / Gary7) | TryHackMe USA Top 1% Difficulty: Easy Topics: Threat Intelligence, Containment Strategies, Incident Response, Wireshark
Answers are redacted within the narrative to allow you to complete the tasks on your own, but a full table of answers is available at the end of this walkthrough.
This room is a lecture-heavy introduction to threat intelligence creation and containment strategies within the incident response cycle. Most tasks pair reading with a single comprehension question. The practical at the end drops a packet capture on the desktop and asks you to pull three specific values from the traffic. Wireshark filtering gets you there fast.
...
TryHackMe: Tardigrade
Author: Mario Martinez Jr. (ku5e / Gary7) | TryHackMe USA Top 1% Difficulty: Easy Topics: Persistence Mechanisms, Backdoors, Incident Response, Linux Forensics
Answers are redacted within the narrative to allow you to complete the tasks on your own, but a full table of answers is available at the end of this walkthrough.
A server is already compromised. The attacker believes they cleared out. Your job is finding what they left behind before the machine goes back to production. The IR team has isolated the machine and handed you credentials for an account with root privileges. Five backdoors are planted somewhere on the system. Finding them requires knowing what a clean Linux install looks like. Anything that doesn’t match is a lead.
...
TryHackMe: Preparation
Author: Mario Martinez Jr. (ku5e / Gary7) | TryHackMe USA Rank #76 | Top 1%
Difficulty: Easy
Topics: Incident Response, CSIRT, Digital Forensics, Log Management, Windows Event Logs
Answers are redacted within the narrative to allow you to complete the tasks on your own, but a full table of answers is available at the end of this walkthrough.
This room covers the Preparation phase of the incident response lifecycle, the foundation that determines whether a team can respond to a breach effectively or scramble in the dark. You take the role of an incident responder building out the people, processes, and technology required to detect and contain adversarial activity before the next room moves into identification and scoping.
...
