Traditional cybersecurity approaches have focused on protecting digital assets by building higher walls and installing stronger locks. This reactive model relies on alarms and incident response plans that are triggered once an attack occurs. However, in today’s threat landscape, this approach is destined to remain perpetually one step behind. Because modern cyber adversaries are intelligent and motivated actors who exploit not only technical vulnerabilities but also the human, procedural, and strategic gaps in their targets. Therefore, the fundamental question is not how high the defensive wall is, but who the adversary is that’s trying to climb it.
It is precisely here that Cyber Threat Intelligence (CTI) offers a paradigm shift; it shifts the focus from the security products in use to the “threat actor” attempting to bypass them. This discipline systematically analyzes who the attackers are, their motivations, the tools and tactics they employ, and what their next move might be. Consequently, CTI moves beyond simply asking, “Did an attack happen?” to providing evidence-based answers for, “Who will attack us, why, and how?” It thereby lays the groundwork for building a proactive defense and strategic resilience against unforeseen attacks.
Responding to cyber attacks only after they happen is a losing strategy. In a world of sophisticated and persistent threats, this reactive approach is not just inefficient—it’s dangerously inadequate. The true value of this training is the fundamental shift in perspective it provides: from a reactive “What do we do now?” to a proactive “What do we know in advance?”
By mastering the principles of Cyber Threat Intelligence, your organization will learn to allocate security resources with precision, focus defenses on the most probable threats, and alleviate the burden on your security operations teams. This is how you move beyond mere resilience to become predictive, gaining a decisive edge that keeps you one step ahead of competitors and adversaries alike.
This comprehensive foundational course is ideal for a wide range of IT and cybersecurity professionals, including:
In this 10-hour program, you will master the core competencies of a threat intelligence analyst, including:
Upon completion of the program, participants will receive a digitally verifiable Certificate of Completion.
Post-Training Q&A Session: One month after the training concludes, we will host a special, live Q&A session with the instructors. This is your opportunity to discuss any challenges you’ve encountered and ask any questions that may have come up.
Module 1: Introduction to CTI and the Proactive Defense Mindset This opening module explains why traditional cybersecurity approaches fall short and why Cyber Threat Intelligence (CTI) has become a necessity. The fundamental differences between reactive and proactive defense are established. The objective is to instill in participants that CTI is not just a technical field but a mindset, setting a strategic foundation for the rest of the training.
Module 2: The CTI Lifecycle and Processes This module covers the systematic process that forms the basis of CTI activities: the Intelligence Cycle. Each step—Planning, Collection, Processing, Analysis, Dissemination, and Feedback—is examined within the context of cybersecurity. The objective is to ensure participants understand that threat intelligence production is not random, but a manageable and repeatable professional process with defined steps.
Module 3: Knowing the Adversary: Threat Actors and Motivations Effective defense begins with knowing the adversary. In this section, the primary threat actors in cyberspace are profiled: Nation-State Sponsored Groups (APTs), Cybercriminal Organizations, Hacktivists, and Insider Threats. The typical motivations (political, financial, ideological), targets, and capabilities of each actor group are explained with examples. The objective is to solidify the concept of an ‘attacker’ and demonstrate that different threats require different approaches.
Module 4: Anatomy of an Attack 1: The Cyber Kill Chain Model This module introduces the Cyber Kill Chain, a fundamental framework for understanding how a cyber attack unfolds from start to finish. Each of the 7 steps, from Reconnaissance to Actions on Objectives, is explained in detail. The objective is to provide participants with the ability to see an attack as a holistic narrative and to understand how they can position defensive strategies to break the different links in this chain.
Module 5: Anatomy of an Attack 2: Introduction to the MITRE ATT&CK Framework This section introduces the MITRE ATT&CK framework, which has become the industry standard for modern CTI analysis. The structure of this matrix, which catalogs the Tactics, Techniques, and Procedures (TTPs) used by threat actors in detail, is explained, along with how to use it. The objective is to equip participants with a core competency that enables them to describe and analyze adversary behavior in a more granular and standardized language.
Module 6: Technical Foundations: Indicators of Compromise (IoCs) and TTPs This module focuses on the foundational building blocks of threat hunting and analysis: Indicators of Compromise (IoCs) and Tactics, Techniques, and Procedures (TTPs). What IoCs—such as an IP address, file hash, or domain name—are and how they are used is explained. The objective is to enable participants to recognize the digital traces left by an attack and to understand how to make inferences about the attacker’s identity and intentions based on these traces.
Module 7: Information Collection: Open-Source Intelligence (OSINT) for CTI A significant portion of cyber threat intelligence is based on the analysis of publicly available data. This practical module demonstrates how to use fundamental CTI platforms like VirusTotal, Shodan, and Abuse.ch, as well as open sources such as security blogs, forums, and social media, to collect threat data. The objective is to introduce participants to free and accessible tools they can begin using immediately to obtain valuable intelligence.
Module 8: Workshop 1: Investigating an Indicator of Compromise (IoC) In this hands-on workshop, participants are given a realistic IoC, such as a suspicious IP address or file hash. Using the online OSINT tools learned in the previous module, participants are guided to investigate what this indicator is, what threat it is associated with, and its potential danger. The objective is to turn theoretical knowledge into a practical investigative skill.
Module 9: Workshop 2: Analysis of a Simple Threat Report In this second workshop, a short and simple CTI report written about a fictional threat group is presented to participants. Participants are asked to find the Tactics, Techniques, and Procedures (TTPs) from the attack described in the report and map them to the corresponding categories in the MITRE ATT&CK framework. The objective is to develop the participants’ ability to read and comprehend a standard CTI report.
Module 10: Reporting and the Role of CTI in an Organization The value of intelligence depends on it being delivered to the right person, at the right time, and in the right format. This final module covers how to write a basic CTI briefing note and how to present findings to non-technical managers. The program concludes by explaining how a CTI team integrates and works with other units within an organization, such as the Security Operations Center (SOC) and Incident Response (IR).
This is a foundational course, but it is designed for participants with a basic understanding of IT and networking concepts. The ideal candidate should meet the following criteria:
To ensure a smooth and effective learning experience, participants will need the following:
Would you prefer to shape your training experience entirely around your own schedule and objectives, rather than waiting for the general term? Elevate your learning experience with our training programs designed for individuals or your own private group.
Key Benefits of Private Training
We believe in transparency. Below you will find the standard packages for our individual and private group training sessions, designed to elevate your learning experience.
One-on-One Private Training A one-on-one training experience, planned exclusively for you and focused on your objectives.
Private Group Training An interactive and dynamic learning environment for your company, department, or private group, focused on shared goals.
