# Cybersecurity Skills Test and Verified Score > A cybersecurity skills assessment built on realistic threat scenarios, live threat-modelling sessions with practitioners and repos of your security work. Source: https://getlemma.io/skills/cybersecurity Security skill shows in how you think about an attacker. Lemma records that thinking in live threat-modelling sessions and adaptive scenario questions, alongside security work you connect from GitHub. How cybersecurity is assessed ## What cybersecurity competence looks like A capable security practitioner looks at a system and sees the paths an attacker would take. They map trust boundaries, spot where untrusted input meets something powerful, and rank risks by likelihood and impact rather than headline drama. Their fixes are proportionate, so teams actually adopt them. They also work well with developers. They explain a vulnerability in terms of what could happen, suggest a concrete fix and help build guardrails that prevent the next one. During an incident they stay calm, preserve evidence and communicate clearly. They keep learning, because attack techniques do not stand still. ### Threat modelling Mapping assets, trust boundaries and attack paths to decide which risks deserve attention first. ### Web application security Injection, broken access control, cross-site scripting and the rest of the OWASP Top 10 in real code. ### Identity and access Authentication flows, session handling, least privilege and the common ways each one fails. ### Network security Segmentation, firewalls, TLS and monitoring that limit how far an attacker can move. ### Incident response Detection, containment, evidence preservation and clear communication when something has gone wrong. ### Secure development Code review, dependency scanning and secrets management built into how teams ship software. ## What counts as evidence of cybersecurity skills? Certificates in cybersecurity show an exam was passed. Lemma records how you work: sessions where you talked through a design or an incident, an adaptive test, and configuration in repositories you link. Every entry says where it came from. See the [evidence methodology](https://getlemma.io/methodology#evidence-types) for how each source is weighed. [Live session](https://getlemma.io/product/sessions) ### A live threat-modelling session In a session, a practitioner describes a system and you map how it could be attacked and what to fix first. The clarity of your risk ranking and fixes is what gets rated. [Adaptive assessment](https://getlemma.io/product/assessments) ### Scenario questions on real threats The adaptive assessment uses realistic security situations, such as a suspicious login pattern or a leaked key, and asks for the best response. Difficulty follows your answers. [GitHub connector](https://getlemma.io/product/passport) ### Security tooling or fixes on GitHub Attach a repository or commit with security work you did: a vulnerability fix, a hardening script or a scanning setup. Lemma confirms access and re-checks it over time. [Live session](https://getlemma.io/product/sessions) ### Teaching a secure coding topic Teaching a session on access control or input validation counts more than learning one. Explaining a vulnerability so a developer can prevent it is a core security skill. ## How is a cybersecurity skills test run on Lemma? The cybersecurity test is adaptive, 15 to 25 questions on failure modes, permissions and cost rather than service names, and it stops once your level holds steady. With sessions and linked work it sets your cybersecurity SCI, where recent evidence carries more weight. [How the SCI score is calculated](https://getlemma.io/product/sci)[How adaptive skills assessments work](https://getlemma.io/product/assessments)[Practise cybersecurity in live skill swap sessions](https://getlemma.io/product/sessions)[Which evidence types count](https://getlemma.io/methodology#evidence-types)[What your Skills Passport shows](https://getlemma.io/product/passport) 1. ### Model threats with a practitioner Book a live session and threat-model a system together, from login flow to data storage. The practitioner rates how you identify attack paths and how sensible your prioritised fixes are. 2. ### Answer adaptive threat scenarios The assessment presents realistic security situations with one best response. Difficulty moves with each answer, and per-question time limits mean you rely on judgement you already have. 3. ### Link the security work you shipped Connect GitHub and attach repositories or commits with security fixes, hardening or tooling. It shows your skill reached real code, and the link stays checked over time. ## Cybersecurity skills: common questions ### How do I prove cybersecurity skills without industry experience? Build visible work: harden a personal project, fix a vulnerability in an open-source repository or set up dependency scanning, then attach it through GitHub. Add a live threat-modelling session with a practitioner and the scenario assessment. Together they show how you think about risk, not only what you studied. ### What does a cybersecurity skills assessment test on Lemma? It uses realistic scenarios across threat modelling, web security, identity, network defence and incident response. Each question describes a situation and asks for the best action. The difficulty adapts to your answers, and timed questions with no going back keep the result a fair picture of your judgement. ### Are security certifications or hands-on evidence more useful for hiring? Both have a place. Certifications show structured knowledge and are sometimes required for specific roles. Hands-on evidence shows how you apply it: threats you modelled, fixes you shipped, incidents you reasoned through. Lemma focuses on that applied side, which you can present next to any certification. ### Can I share security evidence without exposing sensitive details? Yes. Your Skills Passport shows your cybersecurity skill, its evidence summary and score, and you choose which skills to share. In live sessions you can discuss a past incident at the level of reasoning without naming systems or employers. Only connect repositories you are comfortable linking. ## Skills related to cybersecurity [Browse the skills directory](https://getlemma.io/skills) [### Cloud architecture Show how you design cloud systems that scale, fail gracefully and stay affordable. Evidence for cloud architecture](https://getlemma.io/skills/cloud-architecture)[### DevOps Evidence of how you build pipelines, ship safely and keep systems observable. Evidence for DevOps](https://getlemma.io/skills/devops)[### AWS Evidence that you can design, secure and run workloads on AWS, not just name services. Evidence for AWS](https://getlemma.io/skills/aws)[### System design Show how you reason about scale, failure and trade-offs, in live design sessions reviewed by practitioners. Evidence for system design](https://getlemma.io/skills/system-design) ![Painting of an olive grove in soft sunlight with hills beyond](https://cdn.sanity.io/images/islu4peo/production/613eb3f93566423c9adf45246f2cf1a61437c04c-1680x1120.jpg?w=1080&fm=webp&q=68&fit=max) ## Start your cybersecurity evidence record. Lemma is in early access. Request an invite and we will email you when your place is ready.