Prowler Academy: Full Syllabus
Estimated total time to complete: ~28 hours: ~2 hours of pre-work, Track 1 (~3 hours, self-paced) and five instructor-led days of ~5 hours (Modules 04–27 plus the final exam). Start with Module 00; see Delivery format for the day-by-day plan. Self-paced learners can follow the same order at their own rhythm.
Editions
The academy covers Prowler Open Source (CLI, SDK, Prowler Local Server), Prowler Cloud (hosted; 15-day free trial, then per cloud account, see prowler.com/pricing at time of writing), and Prowler Private Cloud (deployed in your own environment). A comparison table is in the README. Free resources: Prowler Hub and the Prowler Registry.
Pre-work (before Day 1)
| # | Module | Key topics | Time |
|---|---|---|---|
| 00 | Pre-work: Set Up Your Lab Environment | Prowler CLI and Docker image, sandbox account with read-only credentials, GitHub repository, Prowler Cloud account and API key, Claude Code + a second agent on Prowler MCP | 2h |
Delivery format (five days)
Module 00 (pre-work) and Track 1 are self-paced and must be finished before Day 1. Modules carry their budget in the header and every lab shows its minutes; a module can be left half-way at the end of a day and resumed the next morning.
| Day | Modules | Time |
|---|---|---|
| Before | 00 pre-work (~2h) · 01, 02, 03 (self-paced) | ~5h |
| 1 | 04 · 05 · 06 · 07 · 08 | ~5h |
| 2 | 09 · 10 · 11 · 12 · 13 | ~5h |
| 3 | 14 · 15 · 16 · 17 · 18 · 19 (first half) | ~5h |
| 4 | 19 (second half) · 20 · 21 · 22 · 23 (first half) | ~5h |
| 5 | 23 (second half) · 24 · 25 · 26 · 27 capstone · final exam | ~5h |
Track 1: Cloud Security Foundations
Before you can scan, you have to think like a cloud defender.
| # | Module | Key topics | Time |
|---|---|---|---|
| 01 | Cloud Security Foundations | Confidentiality/Integrity/Availability, threat modeling, CSPM, CIEM, CNAPP | 1h |
| 02 | Shared Responsibility & CSP Security Models | AWS/Azure/GCP/Kubernetes/M365/SaaS responsibility splits | 1h |
| 03 | Compliance Frameworks Landscape | CIS, NIST, ISO 27001, PCI-DSS, HIPAA, SOC 2, ENS, GDPR, FedRAMP | 1h |
Track 2: Prowler Open Source CLI
Everything you can do without an account, and that's a lot.
| # | Module | Key topics | Time |
|---|---|---|---|
| 04 | Introduction to Prowler | History, architecture, providers, checks, services, compliances | 45 min |
| 05 | Installing Prowler CLI | pip, pipx, Docker, CloudShell, dev install | 45 min |
| 06 | Your First Prowler Scan | AWS quick scan, severities, output files, HTML report | 1h 15 min |
| 07 | Multi-Cloud Providers Deep Dive | Azure, GCP, Kubernetes, M365, GitHub, IaC, Okta, MongoDB Atlas and more | 1h |
| 08 | Mutelist Mastery | YAML mutelist, wildcards, exceptions, tag-based muting | 1h 15 min |
| 09 | Custom Checks & Configurations | Build a check, override metadata, audit_config, Prowler Registry | 1h 20 min |
| 10 | Prowler in CI/CD | GitHub Actions, GitLab CI, Jenkins, exit codes, SARIF, --push-to-cloud | 55 min |
Track 3: Prowler Cloud
Operate Prowler as a platform, alone or across teams.
| # | Module | Key topics | Time |
|---|---|---|---|
| 11 | Prowler Cloud Platform Overview | Components, architecture, Prowler Local Server vs Prowler Cloud vs Prowler Private Cloud | 40 min |
| 12 | Onboarding Providers in Prowler Cloud | AWS Organizations, Azure tenants, GCP projects, K8s, M365 | 1h 15 min |
| 13 | Scans & Scheduling | Manual scans, daily schedules, cron, scan history | 50 min |
| 14 | Findings Investigation | Findings overview, resource view, status workflow, triage | 1h |
| 15 | Compliance Dashboards | CIS, ISO, PCI, HIPAA, ENS dashboards, evidence exports | 1h |
| 16 | Mute Rules in Prowler Cloud | Simple vs Advanced mutelist (YAML), reviewing muted findings | 45 min |
| 17 | Integrations | Slack, Jira, S3, AWS Security Hub, email and Slack alerts | 1h |
| 18 | RBAC, Teams & Organizations | Roles, permissions, SSO (Google, Okta), audit logs | 45 min |
Track 4: Advanced Features
Where Prowler goes from finding misconfigurations to mapping real attack risk. Some features here (for example Lighthouse AI) require a Prowler Cloud or Prowler Private Cloud subscription.
| # | Module | Key topics | Time |
|---|---|---|---|
| 19 | IaC Security Scanning | Terraform, CloudFormation, Kubernetes manifests, Helm, Azure ARM templates, Dockerfiles | 1h |
| 20 | Attack Paths | Cartography schema, graph queries, lateral movement | 1h |
| 21 | Lighthouse AI & Custom Compliance | Lighthouse setup, multi-LLM, building custom compliance | 1h 15 min |
Track 5: Prowler + Claude Code
Build an Agentic Cloud Defender: the Prowler MCP Server lets any MCP-capable AI agent find, prioritize, explain, plan, execute and verify fixes, with Prowler as the deterministic source of truth. Labs use Claude Code; modules cover Claude app, GitHub Copilot, Codex/ChatGPT, Cursor, Gemini CLI and custom MCP clients.
| # | Module | Key topics | Time |
|---|---|---|---|
| 22 | Prowler MCP + Claude Code Setup | Agentic Cloud Defender loop, claude mcp add, per-agent setup (Claude, Copilot, Codex, Cursor, any MCP client), API keys and guardrails, STDIO vs HTTP, tool catalog | 1h 45 min |
| 23 | Detect with Claude Code | Loop: Find, Prioritize, Explain. Findings triage, attack-path queries, scoping by service | 1h |
| 24 | Remediate with Claude Code | Loop: Plan, Execute, Verify. Auto-generated fix scripts, IaC PRs, ticket creation | 55 min |
| 25 | Dashboards & Reporting with Claude Code | Building artifacts, exec dashboards, KPI rollups | 40 min |
| 26 | Continuous Security Automation | Closed-loop automation: scheduled agents, drift detection, autonomous workflows | 40 min |
Capstone
| # | Module | Description | Time |
|---|---|---|---|
| 27 | Capstone Project: Cloudsmiths Inc. | Build a complete posture + compliance + remediation program. | 1h 15 min |
| - | Final Certification Exam | 50 questions across all tracks. 40/50 to pass. | 1h |
| - | Final Exam Answer Key | Detailed explanations and references. | - |
Where each premium feature is taught
| Feature (edition) | Module |
|---|---|
| Whole-organization onboarding: AWS Organizations, Azure Management Groups, GCP Organizations (Cloud) | 12 |
| Custom schedules, scan configuration, partial scans and single-finding rescans (Cloud) | 13 |
| Import findings from the CLI / API (Cloud) | 12–13 |
| Triage lifecycle, finding notes, manual findings with evidence (Cloud) | 14 |
| ThreatScore (all editions), custom compliance watchlists, NATO D32 (Cloud) | 15 |
| Simple and Advanced Mutelist, mute rules | 08, 16 |
| Jira, Slack/email alerts, Power BI, AWS Security Hub (Cloud) | 17 |
| SAML SSO, Google/GitHub login, RBAC (Cloud) | 18 |
| Attack Paths: basic (open source) and full graph (Cloud) | 20 |
| Lighthouse AI, contextual skills, Censys external validation (Cloud) | 21 |
| Prowler MCP Server for AI agents (Cloud; works with any MCP client) | 11, 22–26 |
| Autonomous Fixer (Cloud) | 24 |
| Private Registry (Cloud), Prowler Registry | 09 |
| Private Cloud only: Local Registry, VMware VCF controls, AWS Security Lake / SIEM integration, data residency | 11 |
Edition labels follow prowler.com/pricing at time of writing and may change.
Earning the badge
To earn the PCSC badge:
- Pass every module knowledge check (8/10 or higher).
- Complete the capstone deliverables (Module 27).
- Pass the final certification exam (40/50 or higher).
See BADGE.md for full requirements and how to claim your badge.