About Spud Buds

A walk-through of how a company's technology works, and how it's kept safe, for people who don't work in IT.

Most people who make decisions about technology and security have never seen how the pieces fit together. They hear "pen test", "external app" or "AI agent" in a meeting and nod along. Spud Buds is meant to fix that in under an hour, by letting you walk around a company instead of reading about one.

Who it's for

• Executives and board members who approve security budgets and read the reports.
• Clients scoping a security assessment who want to know what they're buying.
• New staff in non-technical roles who want the big picture.

What you'll learn

Part 1 · How a company's technology works

• The main pieces of a company's technology: the website, email, sign-in, back-office systems, the data, backups and the cloud.
• Which parts the public can reach and which are staff only.
• What it means to build, buy or rent software, and why most companies do all three.
• Where AI fits in: an assistant everyone uses, a bot that answers from company documents, and an agent that takes actions on its own.
• Why apps have to be understood one at a time and as a connected system.

Part 2 · How it's protected and tested

• Why security is a guard at every door, not one wall around the building.
• The difference between external and internal.
• Who the blue team is: the defenders who prevent, spot and respond to attacks, and how red, blue and purple teams fit together.
• What a vulnerability scan, a pen test, an app test, AI red teaming, a phishing simulation and a red team each do, and what each one doesn't cover.
• How small weaknesses in separate places line up into a real attack.

Part 3 · The Spud Buds Job

• The specialists on a security testing crew, the red team, and what each one is for. Testing a network and testing a single app are very different jobs.
• The defenders on the other side, the blue team, and their roles.
• How a test runs from the signed agreement to the final report.

How it works

Spud Buds is a made-up outdoor-gear company drawn as a building. Each room is a place where work happens: the website out front, the back offices, the AI on the top floor, the data in the basement, and the services rented from other companies in the cloud above.

The same building has three views. Rooms shows what each part is. Apps shows the software that runs through the rooms, alone and all together. Security shows the guards, the weak spots, where the blue team is watching, and how testers work through it. Guided tours follow work, and attacks, from room to room.

The building is the point. Once you can picture where something lives, words like "internal", "in scope" and "lateral movement" stop being jargon.

What inspired it

Before building this, we looked for something like it. Plenty of good pieces exist, but nothing lets a non-technical person explore a company and then see how it's secured. These are the ones worth a look.

Games where you run or defend a company

• NOVA Cybersecurity Lab (PBS)Defend a growing start-up from attacks, with a glossary and short videos. Aimed at students.
• Targeted Attack: The Game (Trend Micro)A choose-your-own-adventure as the CIO of a company under attack.
• Kaspersky Interactive Protection SimulationA run-by-a-trainer simulation that ties security decisions to company revenue.

Places you can walk around

• SANS NetWars CyberCityA model city on real equipment, used to train defenders. The original "map you can attack".
• RansomLeakFree 3D office exercises for security awareness, with objects you can click.

Explainers with a good touch

• How HTTPS Works and How DNS WorksComics with recurring characters that make network plumbing friendly.
• The DMZ as a building lobbyThe analogy that suggested drawing the whole company as a building.
• How websites workDomain as the address, hosting as the land and building.

AI, explained at different depths

• LLMs, RAG and AI agentsA short guide to the three layers of company AI: models respond, retrieval informs, agents act.
• Transformer Explainer and AnimatedLLMInteractive looks inside an AI model, for anyone who wants to go deeper.

Courses and references for going further

• TryHackMe Pre SecurityA hands-on beginner path for people who want to go technical.
• Understanding Corporate IT Systems in One GoA course built on following one request from the screen to the database and back.
• Understanding and Managing Enterprise ITA two-day course on corporate IT for non-IT managers.
• Microsoft Cybersecurity Reference ArchitecturesThe practitioner's map of a full security program. Detailed and vendor-specific.
• NCSC Exercise in a BoxFree practice exercises for responding to an attack, from the UK government.

Spud Buds, its people and its incidents are made up. The products named in the lesson are real, used only as typical examples of what companies run. Links go to other sites and open in a new tab.