See the requests, services and data that make applications work.
Learn the normal system before its security failures.
Explore roles and build small, safe pieces of work you can explain.
Understand identity and requests before exploring security failures.