Run, not mocked
Terminal output on screen is captured from a real run. Error strings are the real ones, so you'll recognise them when they hit your own systems.
A zero-trust studio · by Girish Reddy
CAWACHLABS
Zero-trust engineering, taught by a practitioner.
An advanced OpenZiti 2.0 course, now on Udemy, and free weekly lessons on YouTube on zero trust, networking and AI agent security.
New · the OpenZiti 2.0 course is live on UdemyThe course
Enterprise Zero Trust Architecture with OpenZiti 2.0
Thirteen modules, from a three-region HA controller cluster on Raft to a multi-region capstone, with tunnelers on Ubuntu, Docker and Kubernetes along the way.
Took the instructor's OpenZiti 1.0 course on Udemy? It's a head start, not a requirement.
Free lessons
Nothing gets trusted by default
Not a device, a container, a network, or an AI agent. Each lesson shows how it breaks and how you lock it down, with its sources named. About ten minutes each, one a week.
The hidden prompt injection inside your AI agent
An MCP server gives your AI agent new abilities, and a local one runs with your access. Here's how that turns dangerous.
Secure your API keys from AI agent in 10 minutes
Your AI agent can read the API keys in your project's .env file without asking you. Two settings close most of that gap.
How an AI agent emptied a production S3 bucket in 5 minutes
An AI agent doesn't need to be hacked to empty a production S3 bucket. A poisoned support ticket and the agent's own role will do it.
Earlier lessons
How we teach
Every command on screen was actually run
No mockups, and no diagrams of what would happen. When a command is on screen, the output beside it is that command's real output — and labs are built on live infrastructure, not described.
Verified, or flagged
Every technical claim is checked against primary sources — RFCs, specs, release notes — before it ships. Anything unverifiable is flagged, not guessed.
Field-built labs
Labs are built end to end against live controllers, pinned to exact versions, and close with cleanup and troubleshooting. Real environments deserve both.
The studio
The studio carries the catalog, the human carries the trust
Cawach is a phonetic respelling of kavach (कवच) — the shield. CawachLabs is an independent studio for protective engineering. Every course credits its author — written, engineered, and recorded by Girish Reddy.
Training a team on zero trust or OpenZiti? Write to us.