Today I’m launching SM Academy — a cybersecurity training platform where every course is taught from primary sources. Real traffic, real tools, real protocols. The first course, Payment Systems, is live now.
For years I’ve taught payment security in conference rooms — at Black Hat, at DEF CON, at Troopers and many othher conferences. Sixteen hours, a projector, and a group of people who came to understand how card payments actually work. And every single time, the same thing happened: the moment it clicked for the room was never a slide. It was when we put a real transaction on screen and read it together, byte by byte.
That observation is the whole reason this platform exists.
Most payment training explains the diagram. This one hands you the trace.
You can read a hundred descriptions of an EMV transaction and still not recognize one when it scrolls past your terminal. The gap isn’t conceptual, the diagrams in most training material are perfectly accurate. The gap is that almost nobody has ever actually seen the bytes.
So in this course, every lesson is anchored to real captured traffic: contact EMV, contactless, magnetic stripe, tokenised wallet transactions. Taken from live terminals, then sanitized. You read the command, you read the response, and the field-by-field explanation sits right beside it. A lesson looks like this:
>> 00 A4 04 00 07 A0000000031010<< 6F 2A 84 07 A0000000031010 … 90 009F02 00 00 00 00 15 00 Amount, authorised — $15.009F1A 08 40 Terminal country — United States95 80 00 00 00 00 TVR — offline authentication not performed9F26 A1 B2 C3 D4 E5 F6 07 18 Application cryptogram
The result is a course that teaches recognition rather than recall. By the end of Level 2 you’re reading a TLV structure without a reference sheet. By Level 4 you’re reading an authorization message and noticing that the amount appears twice, in two different encodings, calculated by two different parties, and thinking hard about what happens when those two copies are allowed to disagree.
A platform, not a PDF
The written material is the spine of the course — 130,000 words of it, with 187 diagrams. But reading about a protocol and operating one are different skills, so the platform is built around a set of tools that let you do the second thing.
Transaction Lab
A simulated card, terminal, acquirer and issuer. You send a transaction through all four parties, then change any field on the way and watch what each one does about it. Alter the amount after the cryptogram is generated. Strip a field the issuer requires. Force a fallback. The engine reports what every party contributed and — more importantly — where the decision actually turned.
APDU Workbench
Step through a real captured exchange, command by command, with every TLV tag expanded and interpreted. Amounts rendered as money, country codes as countries, terminal verification results as the specific checks that passed or failed.
Decoder
Bring a trace from your own bench and decode it in the browser. Nothing is uploaded — it runs entirely client-side. That’s a deliberate architectural choice for a tool that people will inevitably paste real data into.
Exercises, search and progress
54 graded exercises built on the captures — some placed mid-lesson so you can practise before you finish the reading, the rest closing out each module. Answers are checked on the server and never reach the browser, so the exercise stays an exercise. There’s full-text search across every lesson, capture and reference, and a certificate once every written module is complete.
Free, with no account: the APDU Workbench, the Decoder and the capture corpus. Free with an account: the whole of Module 1. The tools are what most researchers arrive for, and they stay open.
Four levels, twenty-two modules
The levels are a real progression rather than a difficulty label, each one assumes the one before it. The 16-hour conference course has been extended to 27 hours of material, and the modules marked below as delivered live are the ones that have been taught in person at a conference.
| Level | Covers | Modules | Time |
|---|---|---|---|
| 01 — Foundations | Payment systems and security, toolset environments, magnetic stripe data | 3 | 4h 15m |
| 02 — Practitioner | EMV communication and technology, cardholder verification, terminal risk management, NFC, tokenization, instant payments and QR, PCI DSS 4.0 | 9 | 11h 10m |
| 03 — Operator | Cloning, replay and downgrade attacks, the unpredictable number and pre-play, contactless limit bypass, relay attacks and distance bounding, SoftPOS and Tap to Phone, offline terminals | 8 | 9h 15m |
| 04 — Researcher | The authorisation leg from cryptogram to decision, research in progress | 2 | 2h 30m |
The amount travels twice in every authorisation, in two different encodings, calculated by two different parties. Almost every interesting failure in this system lives in the gap between those two copies.Module 21 — The authorisation leg
Who it’s for
This course is built for people who will be asked to find something real.
- Penetration testers handed a payment terminal, a build or an acquirer integration, and expected to say something more useful than “TLS is configured correctly.”
- Payment engineers building or integrating against EMV, tokenisation or ISO 8583, who want to understand the security properties of the thing they’re already shipping.
- Security researchers working toward original work in payments, who need protocol fluency and a corpus of real traffic to test ideas against.
No prior payments knowledge is assumed. Comfort with hex, a terminal and reading a protocol specification is.
On the material itself
Every capture in the platform was cleaned before it was ever stored. No primary account number, expiry, cardholder name or discretionary data appears in any lesson, image, log or export, and the originals live outside the project entirely. That isn’t a disclaimer bolted on afterwards; it’s checked automatically on every change.
The material cites 29 primary sources, EMV Books 1–4, ISO 8583, PCI DSS 4.0, and the published research it builds on — with the most recent dated 2026. Where a claim comes from a specification, the book and section are named, so you can go and read it yourself.
And everything is written in English and Spanish, in full. Not a translated interface sitting over English lessons — both languages carry the complete material.
One payment, permanent access
No subscription, no seat renewal, no annual re-up. The Payment Systems course is $350 USD by card, handled by Stripe, no card details touch the site with immediate access on payment and promotion codes accepted at checkout. If you’d rather not pay by card, Bitcoin works at $400 USD equivalent, settled manually once the payment confirms.
Buy it once and it stays yours, including everything added to it later. And a lot does get added later, the material is kept current as the standards move.
Where this goes next
Payment Systems is the first course on SM Academy. It won’t be the last.
The platform was built on one rule: every course is taught from primary sources. For payments, that meant sanitised captures from live terminals and a lab where you drive the transaction yourself. The next course applies the same rule to a different problem — AI for Security Automation, on building and attacking LLM systems, from someone who runs them in production. Eight modules across four levels. The syllabus is published on the platform already; the lessons are being written now.
If there’s a security topic you’d want taught this way — from the bytes, the traffic, the actual systems — tell me. I’m listening.
Salvador Mendoza 