Self-paced course for IT and security people moving into IAM. Launching soon.
Learn identity and access management properly, and be ready for the CIDPRO exam.
Most IAM knowledge lives in the heads of people who were thrown in at the deep end. This course puts it in order: how identity systems really work, how they fail, and how to get hired to run them. It follows the CIDPRO exam objectives, so you can sit the exam when you're ready.
- Written by a working IAM governance practitioner, not a textbook author
- Plain English first, standards and specs second
- Module 0 is free: five short lessons on what IAM is and how to get in
- Free bonuses worth £646: 900+ practice questions, three mock exams, templates, cheat sheets and a career pack
Get the welcome offer
The first 20 learners get the course at a reduced price, with all the free bonuses, in exchange for an honest testimonial: £499 for the first 10 places and £999 for the next 10. From place 21 the price is £1,499. Join the list and you'll hear first.
Free to join. No card needed. One email when it opens, plus the odd useful note. No spam, and you can leave any time. See the privacy notice.
For career changers
You're in IT, security, service desk, infrastructure or audit, and identity keeps landing on your desk. You want to be the person who actually understands it.
Exam aligned
The syllabus follows the published CIDPRO objectives and topics, with original exam-style questions and mock exams to test yourself properly.
Practitioner led
Real enterprise patterns: hybrid estates, joiner-mover-leaver, access reviews, evidence for auditors. The stuff job descriptions don't explain.
IAM is a great career with no obvious way in
Job adverts ask for identity and access management experience. Nobody says how to get it. The knowledge is scattered across vendor documentation, standards written for specialists, and things people only learn by being thrown in at the deep end.
Career changers end up guessing which parts matter. This course puts it in the right order, in plain English, and ties it to what the CIDPRO exam actually tests.
By the end you'll be able to
- Explain how sign-in, SSO and access control work, without jargon
- Read an OAuth, OIDC or SAML flow and spot what's broken
- Run an access review and produce evidence an auditor will accept
- Talk through joiners, movers, leavers, privileged access and hybrid estates in an interview
- Sit the CIDPRO exam knowing what you'll be tested on
Hi, I'm Paul Gibson
I run identity governance in a large enterprise with a hybrid estate, so I deal with joiners, movers, leavers, access reviews and auditors every week. I started this course because I kept watching capable people struggle to find a clear way into IAM.
Everything here is independent of my day job, and every example is fictional. You can find me on YouTube.
See what's inside
Every lesson has a script, slides and a diagram built from primary sources. Here are three real ones: one from the free Module 0 and two from the paid modules. Click any to enlarge.
- 18modules
- 106short lessons
- 900+practice questions
- 3mock exams
What you'll learn
Eighteen modules, from "what even is IAM" to a full mock exam and your first interview. Module 0 is free for everyone, with no purchase needed.
Foundations
- What IAM is, the careers it opens, and how the exam works Free
- Identity system components and architecture patterns
- Customer, workforce and partner identity; human and non-human identity
- Privacy, ethics and bias in identity
Identity lifecycle
- Identifiers, usernames and the identity lifecycle
- Identity proofing, binding and account recovery
Authentication and access
- Authentication: factors, MFA, passkeys and usability
- Authorisation and access management: RBAC, ABAC, least privilege, tokens
- Cryptography and PKI essentials
- Attacks, best practice and threat modelling
Law, standards and operations
- Law and compliance: GDPR, HIPAA and identity law
- Core standards: OAuth 2.0, OIDC, SAML, SCIM, PKCE, FIDO, NIST 800-63
- Customer-service identity operations and privileged access
- Incident response and running identity systems
The real world
- IAM projects, business cases and workforce planning
- The hybrid estate: AD, Entra, Ping and AWS
- Governance and evidence: access reviews, CAF, ISO 27001, PCI-DSS
Getting hired
- Exam strategy, a full 150-question mock exam and gap review
- CV, interview preparation and a capstone project
See all 106 lessons
Lesson titles may change slightly as I finish recording the course.
Module 0: Start here (free)
- Your tickets are identity work
- Who does IAM all day
- Getting in and moving up
- The CIDPRO exam, plainly
- How to use this course
Module 1: Identity system components and architecture
- One login, six moving parts
- Where identity data lives
- Where access decisions are made
- Central, federated and brokered
- Choosing a pattern: wallets and real estates
Module 2: Workforce, customer, partner and non-human identity
- One login page, four populations
- Workforce: the employer holds the pen
- Customers: strangers who can leave
- Partners: someone else's employees
- Machines have no manager
- How machines prove who they are
Module 3: Privacy, ethics and bias
- Why identity is a privacy problem
- Collect less, keep less
- Consent, and when it is the wrong tool
- Profiling, tracking and correlation
- Bias in identity proofing
- Exclusion, accessibility and redress
Module 4: Identifiers and the identity lifecycle
- What an identifier is actually for
- Usernames and how they go wrong
- The account lifecycle, birth to deletion
- Recovery: letting the right person back in
- Joiner, mover, leaver
- Reconciliation: accounts nobody owns
Module 5: Identity proofing, binding and recovery
- Proving someone is who they claim
- Evidence, and how much to trust it
- Remote, in person, and the three IALs
- Binding: from proven person to account
- How proofing gets fooled
- Recovery: the door attackers prefer
Module 6: Authentication
- Factors, authenticators and real MFA
- Passwords and how they fail
- MFA that still gets phished
- Phishing resistance and passkeys
- Choosing an authentication level
- Living with it: friction and sessions
Module 7: Authorisation and access management
- After the login: who may do what
- Owners and labels: DAC and MAC
- Roles, and how they multiply
- Attributes and policy: ABAC and PBAC
- Least privilege and separation of duties
- Tokens: permission that travels
Module 8: Cryptography and PKI essentials
- Hashes: fingerprints, not locks
- Shared secrets and key pairs
- Digital signatures: who said this?
- Certificates, PKI and TLS
- Keys have lifecycles too
- JWTs and signed assertions
Module 9: Attacks, threats and threat modelling
- Attackers log in, they don't break in
- Stuffing, spraying and phishing at scale
- Stealing the session, not the password
- From user to admin: privilege escalation
- Threat modelling in four questions
- Threat modelling SSO, federation and APIs
Module 10: Law and compliance
- Statute, contract, standard, policy
- GDPR from the identity team's desk
- HIPAA: the Security Rule for IAM
- Laws written about identity itself
- Compliance: controls, evidence, audit
- The UK lens: CAF and the Commission
Module 11: Core standards and bodies
- Who writes the identity rulebook
- OAuth 2.0: delegation, not login
- PKCE and how long tokens should live
- OpenID Connect: login built on OAuth
- SAML 2.0: assertions and bindings
- SCIM, FIDO and the framework standards
Module 12: Service operations and privilege
- The service desk is a login page
- Social engineering the helpful
- Good service without opening the door
- What makes access privileged
- Vaults, just-in-time and session records
- Break-glass, and admins with no human
Module 13: Running identity operations
- Event, alert or incident?
- Containing a stolen identity
- Logs that answer the question
- Privacy when you run the system
- Changes, certificates and Monday mornings
- When the identity provider goes dark
Module 14: IAM projects and the business case
- It is not a software install
- A business case finance will sign
- From wish list to roadmap
- Proving it was worth the money
- Who runs identity on Monday
- How IAM programmes fail
Module 15: The hybrid estate
- Four layers and the wires between them
- Sync: who writes, who reads, who wins
- Where truth lives during the move
- Follow the trust: directory to cloud admin
- What moves first, and what never moves
- Living in the messy middle
Module 16: Governance and evidence
- Governance asks "who decided?"
- Access reviews that aren't rubber stamps
- Separation of duties with a tiny team
- Evidence an auditor will accept
- One control, three rulebooks
- Governance a team of three can run
Module 17: Exam readiness and career
- Read the stem like its author
- 150 questions, three hours, no way back
- Mock exam, error log, gap list
- A CV and portfolio that show the work
- Interviews: think out loud
- Capstone: an IAM plan for Fernhill
How this compares
Most people preparing for CIDPRO choose between free reference material, question banks and live courses. Here is how each type stacks up, based on what I found in October 2026.
| Free study material | Practice-question banks | Live instructor-led course | IAM Explained | |
|---|---|---|---|---|
| Guided lessons | Reference articles, no guided path | No | Yes, live | Yes, short video lessons |
| Practice questions | One paid practice exam from IDPro ($50) | Yes | Varies | 900+, every answer explained |
| Full mock exams | Not included | Some | Varies | 3 mocks of 150 questions |
| Templates and career pack | Not included | Not included | Varies | Included as free bonuses |
| Your pace | Yes | Yes | Fixed dates | Yes, self-paced |
| Price | Free | Low cost | Around €2,500 for three days at one provider | £499 for the first 10, £999 for the next 10, then £1,499 |
This compares types of study material, not specific providers, and prices change. The CIDPRO exam fee ($750 at the time of writing) is paid to IDPro separately in every case.
This is for you if
- You work in IT support, infrastructure, security, audit or development and identity keeps landing on your desk
- You want a structured route into an IAM role, not a pile of links
- You're preparing for the CIDPRO exam and want to know what you'll be tested on
- You're already in IAM and want the foundations in the right order
This isn't for you if
- You want training on one vendor's product, such as an Okta, SailPoint or Entra admin console. This course is vendor-neutral
- You want live classes with a cohort. This is self-paced
- You want a guaranteed pass or a guaranteed job. I can't promise either
- You only want to sit the exam and already know the field. The practice bundle may be all you need
What you get
- Short video lessons, around 8 to 12 minutes each
- Slides and speaker notes you can keep
- Original exam-style questions after every module
- Free bonuses worth £646, led by the exam practice bundle (see below)
- A glossary in plain English
- Labs and worksheets you can show an employer
How it's taught
Every lesson is written from working experience and primary sources: NIST, the RFCs, the SAML and OIDC specs, GDPR and the NCSC Cyber Assessment Framework. Nothing is copied from exam material, and the course doesn't ask you to memorise anything it can't explain.
You go at your own pace. No cohorts, no deadlines, no being left behind.
Free bonuses worth £646
Every bonus is included with the course at no extra cost. Each value is what I expect to charge for it on its own.
The main event
The exam practice bundle
Everything you need to practise for the CIDPRO exam, written from scratch for this course. Every question is original, and every answer comes with an explanation and a pointer back to the lesson.
Practise in the real exam format, find your weak spots, then fix them before the day.
Included free with the course
Value £299
Templates
Working documents you can adapt for your own job: an access-review evidence pack, a joiner-mover-leaver process and an IAM business case.
Value £199
Cheat sheets
One-page references for the things everyone forgets: OAuth and OIDC flows, SAML, the NIST 800-63 assurance levels, and RBAC against ABAC.
Value £99
Career pack
An IAM-ready CV template, a bank of likely interview questions with model answers, and a UK salary guide, so you know what to ask for.
Value £49
Total bonus value: £646, yours free with the course.
Templates, cheat sheets and the career pack are being finished alongside the lessons and will be ready for the first group.
The welcome offer
I'm opening the course to a small first group of 20 at a much lower price. In return, I'm asking for one thing: an honest testimonial once you've been through it. Good, bad and in between all help me make the course better.
- Full course access at the welcome price
- Free bonuses worth £646, including the exam practice bundle
- Your feedback shapes the later modules
- Free updates for 12 months from the date you buy
- Places 1 to 10 are £499 and places 11 to 20 are £999. From place 21 the price is £1,499
- Reviews from welcome-offer members are labelled as such on this site
£499
one-off price for places 1 to 10, in exchange for a testimonial. Places 11 to 20 are £999 and from place 21 the price is £1,499.
Get early access30-day money-back guarantee
If it's not for you, email me within 30 days of buying and I'll refund you in full. No reasons, no forms, no quibbles. Refund policy
Cybersecurity bootcamps are commonly priced in the thousands. This is self-paced, so you study around your job and keep the materials.
Honest note on the exam
This course prepares you for the CIDPRO exam. It is independent, and it is not affiliated with or endorsed by IDPro. Passing depends on you, so I won't promise a result, but I will make sure you know exactly what you're being tested on.
Questions
Is any of it free?
Yes. Module 0 is free: five short lessons covering what IAM is, who does it, how people get in and how the CIDPRO exam works. I'll release it on YouTube and send it to everyone on the list, with no purchase needed.
Do I need an IAM background?
No. If you work in IT or security and understand the basics of users, passwords and permissions, you can start here.
When does it open?
The course is in production now. I'll email the list as soon as the first modules are ready, and early-access people are the first to know.
What if it isn't for me?
Email [email protected] within 30 days of buying and I'll refund you in full. No reasons needed and no questions asked. Full details are on the refund policy page.
Will the course be kept up to date?
Yes. I review the course against the published CIDPRO exam objectives and the standards it cites at least twice a year, and every update I make in the 12 months after you buy is free. The exam objectives are set by IDPro, not by me, so I can't promise to match a change the day it happens, but I will review when I see one.
How long do I keep access?
You keep access to everything you bought for as long as the course is hosted. If I ever close it, you will get notice and a downloadable copy of the bonuses.
How many places are there at the reduced prices?
Twenty: the first 10 at £499 and the next 10 at £999. Once those 20 places are taken, the price becomes £1,499. If someone takes a refund, that place re-opens at the price it was sold at.
What does the testimonial involve?
A short written or video review in your own words, once you've worked through the course. No scripts, and no obligation to say anything you don't mean. Because you paid a reduced price, reviews from welcome-offer members will be labelled as such.
Is it self-paced?
Yes. There are no live sessions or cohorts, so you can fit it around work.
Is the exam fee included?
No. The CIDPRO exam fee ($750 at the time of writing) is paid to IDPro separately, and the same is true of any course. This course gets you ready for it.
Is this the official CIDPRO course?
No. It's independent and aligned to the published exam objectives. IDPro and CIDPRO belong to their respective owners.
How do I leave the list?
Reply to any email and I'll remove you, or write to [email protected].
Still have a question? Email me at [email protected] and I'll reply personally.
Be first through the door
Join the list for the early-access offer (from £499), or email [email protected] if you have a question first.