I didn't set out to build a product.
A friend of mine took the CISSP and passed, and it got me wondering how much of it I actually knew already — not from studying, but from years of doing the work. The only way to find out was to test myself, so I started building something simple to do that.
That should have been the end of it.
Instead I kept going. It turned out to be more fun to build than to study, so I added something new most days. Timed exams first. Then adaptive assessments, so the difficulty moved with my answers the way real testing does. And somewhere in there the question changed from how much do I know to what would I have wanted over the last fifteen years, for myself and for the people on my team?
That question is what produced the structure Zamlom has now. I organized the learning paths around four roles — executive, architecture and engineering, GRC, and SOC — because that's how the work actually divides. Once the learning side was solid I started thinking about what else would be genuinely useful rather than just more content, and that's how I landed on the tabletop exercises.
I've built the whole thing solo, and it's still very much in progress.
Not built around an exam
I made a deliberate decision early on to keep the material generic rather than tying it to any one certification.
Cert prep optimizes for a specific thing: recognizing the pattern a question is testing and picking the answer the exam wants. That's a real skill and it gets people certified, but it isn't the same as being good at the job. I wanted the opposite — material that makes someone more capable at the work itself, whether or not there's an exam at the end of it.
So there's no timeline and nothing to cram for. You work through it at whatever pace fits your week, and the goal is that you come out knowing something useful.
Two things make it work differently than a static question bank.
The questions adapt. Instead of cycling you through a fixed pool, the difficulty moves with how you're answering. Get something right and it pushes harder in that area. Miss something and it comes back at it from a different angle. You spend your time at the edge of what you know instead of grinding through material you already have cold.
It brings things back. The platform tracks what you've covered and uses spaced repetition to resurface it later. Not because you failed anything, but because that's how material stays available six months from now instead of evaporating the week after you read it.
The role-based structure has a second benefit I didn't anticipate. Most of us go deep in one lane and stay there. Being able to read your way into how a GRC lead or a SOC analyst frames a problem is useful on its own — it makes you better at working with them, which is most of the job.
The part I didn't plan
The tabletop exercises weren't the original idea. They came later, once the learning side was already solid and I started asking what else would be genuinely useful beyond more content. But they ended up becoming one of the most critical parts of the platform — more than anything I actually planned from day one.
Security training is one of the first things deprioritized when budgets tighten — a pattern across the industry, not any particular company. The result is a lot of teams who have an incident response plan on paper and have never walked through it under pressure.
So Zamlom runs incident-response tabletops. Four people take distinct roles — CISO, SOC analyst, compliance lead, infrastructure — and work through an unfolding breach. Each role sees only what that role would realistically see, which is the part that makes it feel like the real thing: the infrastructure person knows something the CISO doesn't, and whether that information reaches the right place in time is the exercise.
At the end it generates an after-action report — executive summary, decision timeline, and where the gaps were. That report is the actual deliverable. It's the thing you can hand to someone who wasn't in the room.
The two halves feed each other now, even though I didn't design it that way from the start. Whatever the report shows you missed gets turned directly into study material on the learning side — the exercise doesn't just tell you where the gap was, it hands you the next thing to actually go learn.
I didn't intend to build any of this. It came out of realizing that the concepts are the easy half. The hard half is what happens when four people who each know their piece have to coordinate at 2 a.m.
For teams
There's team and enterprise functionality as well, so an organization can see where its people are and keep them current on incident response. It's free right now and will eventually be a paid tier.
The reasoning behind it is simple. A major incident isn't an if anymore, it's a when, and the teams that come through it well are the ones that have done it before. When a team doesn't know how to respond — or knows individually but has never done it together — something that could have been contained in an hour turns into a multi-million dollar event with reputational damage that outlasts the technical cleanup by years.
The gap is almost never knowledge. It's coordination under pressure, and that's a thing you can only get by practicing it.
Why it's built for a few minutes at a time
I have two young kids and a schedule with no room for three-hour study blocks. That constraint shaped this more than any roadmap did.
Zamlom is built for the ten minutes you'd otherwise spend scrolling. Short lessons, one question set, pick it up again tomorrow. That isn't a compromise version of real studying — for most working professionals it's the only version that actually happens.
Where it is now
Individual use is free. No ads, nothing to buy, not funded. The team tier will be the thing that eventually pays for it, but the priority right now is making the platform genuinely good.
An account is required so your progress follows you across devices. You can delete it, and everything associated with it, from the Identity tab at any time.