Hamish Dean

People learning offensive or defensive cyber security can work through practical, hands-on paths. When Hamish went looking for the same thing for GRC, there wasn't one. So he built Do GRC, for the benefit of the GRC community, not to make money.

Do GRC started out free. To cover what it costs to run, Hamish then introduced paid memberships, but that didn't work: there were very few paying members, and the memberships never fully covered the costs. So he decided to make it free again, so that more people can benefit from it. Every account now gets every learning path, case study, scenario and lab.

Do GRC teaches GRC through practice. Its learning paths are made of hands-on rooms; its labs are set inside invented organisations, each with its own policies, registers and records to work through; and its scenarios and case studies ask you to make the call. There's practice for 52 certification exams, and for job interviews, too.

Job paths

18

Learning paths

366

Hands-on rooms

2,132

Labs

818

AI scenarios

330

Case studies

148

Hamish built Do GRC with AI. AI wrote the learning paths, labs, case studies and scenarios, answer keys included, and all of the site's code, and AI audits both. What each audit checked, found and fixed is published, and the site says plainly where it uses AI and how far to rely on it.

• How accurate it isWhat each audit of the content checked, found, fixed and left open, area by area, and what the audits can't tell you.
• How current it isWhat the last check changed, which edition of each framework, law and exam outline the site teaches, the changes on the way, and the proposals it is watching.
• How secure it isWhat each security audit of the code checked, what it found at each severity, and what was fixed.
• Where it uses AIHow Do GRC uses AI, and how AI-generated content is labelled and logged.