Skip to content

Cyber Threat Intelligence Training Course

Works through the intelligence lifecycle, from setting requirements and collecting sources to analysing threat actors and turning findings into defence.

TICM · Threat Intelligence & Cyber Threat ManagementAll Levels#2534ClassroomEnglish , Arabic
Duration
5 Days
Download BrochureView Upcoming Dates

Free substitution at any time · 30+ days' notice: full refund minus 10%. Cancellation policy

Course Overview

This advanced practical course develops the capabilities required to collect, analyse, validate, and operationalize Cyber Threat Intelligence to support proactive cybersecurity decision-making. It focuses on transforming threat information from multiple sources into actionable intelligence that can improve detection, prevention, investigation, and response. The program covers the intelligence lifecycle, threat intelligence requirements, collection methods, source evaluation, threat actor analysis, indicators of compromise, tactics, techniques and procedures, threat analysis, intelligence correlation, and intelligence reporting. Participants learn how to distinguish raw security information from validated intelligence and assess its relevance to organizational risks and priorities. Through practical analysis exercises and intelligence scenarios, participants will investigate threat activity, correlate technical and contextual information, assess adversary behaviour, develop intelligence products, and communicate findings to technical teams, security operations, and decision-makers.

Learning Objectives

  • Analyse the principles, purpose, and lifecycle of Cyber Threat Intelligence.
  • Define intelligence requirements based on organizational risks and security priorities.
  • Identify and evaluate relevant internal and external intelligence sources.
  • Apply structured methods for collecting and validating threat information.
  • Analyse threat actors, campaigns, motivations, capabilities, and targeting patterns.
  • Evaluate indicators of compromise and other technical threat information.
  • Analyse adversary tactics, techniques, and procedures to understand attack behaviour.
  • Correlate information from multiple sources to identify meaningful threat patterns.
  • Assess the relevance, reliability, confidence, and potential impact of intelligence findings.
  • Develop actionable intelligence products for security operations and decision-makers.
  • Integrate threat intelligence into detection, investigation, and incident response activities.
  • Establish a practical Cyber Threat Intelligence capability and continuous improvement approach.

Who Should Attend

This course is designed for Cyber Threat Intelligence analysts, cybersecurity analysts, security operations centre professionals, threat hunters, incident responders, digital forensic specialists, security engineers, and cyber risk professionals involved in analysing or responding to cyber threats. It is also suitable for cybersecurity managers, SOC managers, security architects, threat researchers, vulnerability management professionals, intelligence analysts, IT security leaders, and decision-makers who require a stronger understanding of how threat intelligence supports enterprise security. The program is particularly relevant to organizations seeking to improve their ability to identify emerging threats, understand adversary behaviour, prioritize risks, strengthen detection capabilities, and provide intelligence-driven support to cybersecurity operations.

Learning Outcomes

  • Explain the Cyber Threat Intelligence lifecycle and its role in enterprise security.
  • Define intelligence requirements that support organizational security objectives.
  • Identify, collect, and evaluate threat information from diverse sources.
  • Assess the reliability and relevance of intelligence sources and findings.
  • Analyse threat actors, campaigns, motivations, and targeting behaviour.
  • Examine indicators of compromise and associated technical evidence.
  • Map adversary behaviour to relevant tactics, techniques, and procedures.
  • Correlate technical, contextual, and behavioural information across multiple sources.
  • Assess threat severity, confidence, relevance, and potential business impact.
  • Produce actionable intelligence reports for technical and management audiences.
  • Integrate intelligence findings into threat detection, hunting, and incident response.
  • Develop a structured framework for operating and improving a Cyber Threat Intelligence capability.

Course Outline

Day 1

Cyber Threat Intelligence Foundations & Intelligence Lifecycle

  • Cyber Threat Intelligence concepts and objectives
  • Strategic, operational, tactical, and technical intelligence
  • Intelligence lifecycle and workflow
  • Intelligence requirements and priority intelligence requirements
  • Threat information versus actionable intelligence
  • Intelligence collection planning
  • Internal and external intelligence sources
  • Source reliability and information credibility
  • Intelligence validation and confidence assessment
  • Intelligence management and documentation
  • Practical Application: Developing intelligence requirements and a collection plan for a simulated enterprise
Day 2

Threat Data Collection, Analysis & Threat Actor Profiling

  • Threat intelligence collection methods
  • Open-source and technical intelligence sources
  • Security telemetry and internal intelligence
  • Threat actor identification and profiling
  • Adversary motivations and objectives
  • Threat actor capabilities and targeting patterns
  • Campaign and infrastructure analysis
  • Indicators of compromise
  • Domains, IP addresses, hashes, malware indicators, and other technical artefacts
  • Contextualizing technical threat information
  • Practical Application: Building a threat actor profile from multiple intelligence sources and technical indicators
Day 3

Adversary Behaviour, Tactics & Threat Correlation

  • Adversary tactics, techniques, and procedures
  • Attack lifecycle and behavioural analysis
  • Threat modelling and adversary analysis
  • Correlating indicators and related threat information
  • Identifying relationships between actors, infrastructure, tools, and campaigns
  • Malware and attack technique intelligence
  • Network and endpoint threat indicators
  • Behavioural patterns and anomaly identification
  • Threat intelligence enrichment
  • Confidence assessment and analytical judgment
  • Practical Application: Correlating multiple threat indicators to reconstruct an adversary campaign and identify likely attack behaviours
Day 4

Intelligence Production, Reporting & Operational Integration

  • Intelligence analysis methodologies
  • Converting analysis into actionable intelligence
  • Tactical intelligence for security operations
  • Intelligence support for threat hunting
  • Integrating intelligence with detection and monitoring
  • Supporting incident investigation and response
  • Intelligence reporting structures
  • Technical versus executive intelligence products
  • Visualization and presentation of intelligence findings
  • Communicating confidence, uncertainty, and risk
  • Practical Application: Developing a complete intelligence report and translating findings into security detection and response actions
Day 5

Intelligence Operations, Strategic Analysis & Continuous Improvement

  • Strategic threat intelligence and business risk
  • Emerging threat identification and trend analysis
  • Intelligence-driven risk prioritization
  • Threat intelligence platforms and operational workflows
  • Intelligence sharing and collaboration
  • Measuring intelligence effectiveness
  • Intelligence gaps and collection improvement
  • Governance and analytical quality control
  • Building a Cyber Threat Intelligence operating model
  • Continuous intelligence improvement
  • Final Workshop: Developing an integrated Cyber Threat Intelligence capability covering requirements, collection, analysis, threat actor profiling, correlation, intelligence production, operational integration, reporting, and continuous improvement

Upcoming Dates

Selected date

Istanbul · 13 – 17 Sept 2027 · Classroom

Need more details?Chat with us on WhatsApp

CityDatesPrice per ParticipantEarly Bird
MilanScheduled
2 – 6 Nov 2026€7,000—
MunichScheduled
9 – 13 Nov 2026€6,000—
MuscatScheduled
16 – 20 Nov 2026€6,300—
OnlineScheduled
22 – 26 Nov 2026€2,700€2,430until 2 Nov
ParisScheduled
23 – 27 Nov 2026€6,700€6,030until 2 Nov
RiyadhScheduled
30 Nov – 4 Dec 2026€4,800€4,320until 9 Nov
RomeScheduled
7 – 11 Dec 2026€7,000€6,300until 16 Nov
SalalahScheduled
14 – 18 Dec 2026€6,300€5,670until 23 Nov
SingaporeScheduled
21 – 25 Dec 2026€8,000€7,200until 30 Nov
TrabzonScheduled
28 Dec 2026 – 1 Jan 2027€5,300€4,770until 7 Dec
TunisiaScheduled
4 – 8 Jan 2027€4,300€3,870until 14 Dec
ViennaScheduled
4 – 8 Jan 2027€6,400€5,760until 14 Dec
AmmanScheduled
10 – 14 Jan 2027€4,000€3,600until 21 Dec
AmsterdamScheduled
18 – 22 Jan 2027€6,000€5,400until 28 Dec
BakuScheduled
25 – 29 Jan 2027€5,300€4,770until 4 Jan
BarcelonaScheduled
1 – 5 Feb 2027€6,000€5,400until 11 Jan
CairoScheduled
8 – 12 Feb 2027€3,800€3,420until 18 Jan
CasablancaScheduled
15 – 19 Feb 2027€4,700€4,230until 25 Jan
DammamScheduled
22 – 26 Feb 2027€4,800€4,320until 1 Feb
DohaScheduled
22 – 26 Feb 2027€4,700€4,230until 1 Feb
DubaiScheduled
28 Feb – 4 Mar 2027€4,700€4,230until 8 Feb
GenevaScheduled
8 – 12 Mar 2027€7,300€6,570until 15 Feb
IstanbulScheduled
15 – 19 Mar 2027€5,300€4,770until 22 Feb
Kuala LumpurScheduled
22 – 26 Mar 2027€4,700€4,230until 1 Mar
LisbonScheduled
29 Mar – 2 Apr 2027€6,000€5,400until 8 Mar
LondonScheduled
5 – 9 Apr 2027€5,800€5,220until 15 Mar
MadridScheduled
12 – 16 Apr 2027€6,000€5,400until 22 Mar
MakkahScheduled
12 – 16 Apr 2027€4,800€4,320until 22 Mar
ManamaScheduled
19 – 23 Apr 2027€5,300€4,770until 29 Mar
MarrakeshScheduled
26 – 30 Apr 2027€4,700€4,230until 5 Apr
IstanbulScheduled
13 – 17 Sept 2027€5,300€4,770until 23 Aug

Available in: Istanbul · Dubai · London · Riyadh · Doha · Amsterdam

Related Courses

Ready to Elevate Your Team's Capabilities?

Speak with our advisors about upcoming programmes or a bespoke corporate training plan.