Course Overview

As cyber threats continue to evolve in scale and sophistication, organisations must move beyond reactive security measures and adopt intelligence-driven approaches to cyber defence. Cyber Threat Intelligence (CTI) enables organisations to identify emerging threats, understand attacker behaviours, and make informed decisions that strengthen security posture and reduce risk.

The Cyber Threat Intelligence (CTI) Programme by Transformentors Academy provides participants with the knowledge and practical skills required to collect, analyse, and apply threat intelligence in modern cybersecurity environments. The programme explores threat actors, attack methodologies, intelligence lifecycles, and leading threat intelligence frameworks used to anticipate and respond to cyber threats effectively.

Through practical exercises, real-world scenarios, and case studies, participants will examine frameworks such as MITRE ATT&CK, the Cyber Kill Chain, and the Diamond Model while developing capabilities in threat analysis, vulnerability assessment, risk evaluation, and incident response support.

By the end of the programme, participants will be equipped to integrate threat intelligence into security operations, enhance threat detection capabilities, support strategic decision-making, and strengthen organisational resilience against evolving cyber threats.

Agenda

Day — 1 Cyber Threat Intelligence Fundamentals

• Understanding the principles and importance of Cyber Threat Intelligence (CTI) in cybersecurity.
• Exploring the stages of the intelligence lifecycle, including planning, collection, analysis, and dissemination.
• Identifying different types of threat intelligence, including strategic, operational, tactical, and technical intelligence.
• Examining threat actors and their motivations, including cybercriminals, hacktivists, and nation-state actors.
• Understanding the application of intelligence frameworks such as the Cyber Kill Chain, Diamond Model, and MITRE ATT&CK.
• Applying threat intelligence frameworks to support cybersecurity planning and defence strategies.
• Developing the foundations of an effective Cyber Threat Intelligence programme.
• Understanding the process of implementing CTI capabilities within an organisation.

Day — 2 Types of Compromise Indicators

• Understanding the role of Indicators of Compromise (IOCs) in threat detection and incident response.
• Identifying common types of IOCs, including IP addresses, URLs, file hashes, and domain names.
• Examining how IOCs are used to identify malicious activities and potential security breaches.
• Applying techniques for collecting, validating, and analysing threat indicators.
• Understanding the use of manual and automated approaches for IOC management.
• Exploring threat actor profiling and its role in anticipating attacker behaviour and tactics.
• Linking IOCs to threat actor tactics, techniques, and procedures (TTPs) to strengthen cyber defences.
• Practical Exercise: Matching IOCs with known threat actors and their associated TTPs.

Day — 3 Vulnerabilities and Attack Campaigns

• Understanding common vulnerabilities and how they are exploited by cyber attackers.
• Exploring attack techniques such as privilege escalation, buffer overflows, and code injection.
• Examining the risks and implications of zero-day vulnerabilities within organisations.
• Analysing attack campaigns, threat groups, and their objectives to identify trends and attack patterns.
• Understanding the relationship between attack campaigns, tactics, techniques, procedures (TTPs), and Indicators of Compromise (IOCs).
• Applying threat intelligence techniques to strengthen defensive and detection capabilities.
• Identifying methods used by threat actors to compromise systems and evade detection.
• Practical Exercise: Analysing a real-world attack campaign and assessing its tactics and techniques.

Day — 4 Threat Intelligence Risk Assessment

• Understanding the role of threat intelligence feeds in supporting cybersecurity operations.
• Exploring different types of threat intelligence feeds and their practical applications.
• Integrating threat intelligence into Security Operations Centre (SOC) processes for enhanced detection and response.
• Conducting risk assessments by evaluating threats, vulnerabilities, and potential business impacts.
• Assessing the likelihood and severity of cyber threats using available intelligence sources.
• Examining geopolitical influences and industry trends that shape the cyber threat landscape.
• Applying threat intelligence to support risk-based decision-making and security planning.
• Practical Exercise: Using CTI data to assess the risk of an emerging cyber threat to an organisation.

Day — 5 Advanced CTI Topics and Strategic Decision-Making

• Analysing historical threat data and trends to improve threat detection and security planning.
• Understanding legal, privacy, and compliance considerations in threat intelligence collection and sharing.
• Aligning Cyber Threat Intelligence activities with organisational objectives and strategic decision-making.
• Exploring the role of CTI in incident response, investigation, and digital forensics activities.
• Applying threat intelligence to identify attack root causes and support faster recovery efforts.
• Examining emerging trends in CTI, including the use of Artificial Intelligence and Machine Learning for automation and predictive analysis.
• Strengthening long-term cyber resilience through intelligence-driven security strategies.
• Project: Developing a comprehensive Cyber Threat Intelligence strategy for a fictional organisation.

Learning Outcomes

By the end of this programme, participants will be able to:

• Understand the principles and importance of Cyber Threat Intelligence (CTI) in modern cybersecurity operations.
• Apply intelligence frameworks such as the Cyber Kill Chain, MITRE ATT&CK, and the Diamond Model to analyse and respond to cyber threats.
• Identify different threat actor groups and understand their motivations, tactics, and techniques.
• Collect, analyse, and utilise Indicators of Compromise (IOCs) to support threat detection and investigation.
• Assess vulnerabilities, attack methods, and emerging threats that impact organisational security.
• Conduct threat intelligence-based risk assessments to support informed security decision-making.
• Evaluate geopolitical, regulatory, and strategic factors that influence the cyber threat landscape.
• Explore advanced applications of CTI, including compliance, automation, and AI-driven threat intelligence.
• Develop and present a Cyber Threat Intelligence strategy aligned with organisational security objectives.

Who Should Attend

This programme is ideal for professionals involved in cybersecurity, threat intelligence, and risk management, including:

• Cybersecurity Analysts and Engineers.
• Threat Intelligence Specialists.
• Security Operations Centre (SOC) Analysts.
• IT and Network Security Professionals.
• Incident Response and Digital Forensics Specialists.
• Cybersecurity Managers and Security Leaders.
• Risk Management and Governance Professionals.
• Professionals responsible for threat detection, monitoring, and cyber defence operations.