Advanced Cyber Threat Intelligence Analyst

This is the largest part of the course, and it turns 'who is this?' into 'do they threaten us, and what do we do first?'. You work through attribution at technical, operational and strategic levels, the motivation-capability-intent trinity and the role of opportunity, then apply it all to real cases: classifying Phineas Fisher, reconstructing the Conti ransomware attack on a health service, running a LockBit threat assessment, and mapping an APT41 intrusion across the Cyber Kill Chain and Diamond Model. You also learn to rank indicators of compromise on the Pyramid of Pain and manage their freshness so a stale IP block never poisons your detections.

• You will distinguish technical, operational and strategic attribution and attach calibrated confidence bands to each claim
• You will apply the capability, intent and opportunity trinity to decide which actor and which exposure to prioritise first
• You will read motivation by intensity, not category, using observed persistence, investment and adaptation as proxies
• You will lay a real intrusion across both the Kill Chain and the Diamond Model to build a single correlatable activity thread
• You will rank IOCs as atomic, computed or behavioural, and assign first-seen dates and confidence decay so indicators age out before they harm legitimate traffic

This module covers the direction and review stage of the intelligence cycle, with the focus squarely on taking requirements from the customer. You learn to gather and shape intelligence requirements, prioritise them, and distinguish Priority Intelligence Requirements from ordinary IRs using weighted scoring models. It closes with project planning and review so a CTI engagement stays on brief, on time and genuinely useful to the person who commissioned it.

• You will develop and document intelligence requirements from a customer brief
• You will prioritise competing requirements using weighted scoring models
• You will explain how PIRs differ from standard intelligence requirements and when each applies
• You will plan and review a CTI project so it answers the question it was set

This module builds on foundational collection and pushes into the technical craft of gathering data. You practise advanced search techniques, site scraping and bulk collection, and dig into web infrastructure through registration records, DNS and document metadata, learning the power of the pivot to move from one artefact to the next. It also covers CTI sharing communities, judging data reliability, handling human sources, and the legal, ethical and operational-security constraints that keep collection defensible.

• You will use advanced search and site-scraping techniques to collect at scale
• You will pivot across registration records, DNS and document metadata to expand on a single lead
• You will assess the reliability of collected data and the risks of handling human sources
• You will apply legal, ethical and operational-security guardrails to your collection activity

This module deepens core analytic tradecraft and aligns to the CREST syllabus. You work through idea and hypothesis generation and testing, scenarios and indicators, and the disciplined assessment of cause and effect, then learn to spot misinformation, run challenge analysis and support decisions. It finishes with decomposition and visualisation so complex findings become something a stakeholder can read and act on.

• You will generate and test competing hypotheses against the evidence
• You will assess and deconstruct cause and effect rather than assuming it
• You will run structured and unstructured challenge analysis to stress-test your own conclusions
• You will decompose and visualise findings to support a decision-maker

This module explains the dissemination phase of the intelligence cycle and how finished products actually reach their consumers. You examine forms of delivery, get an introduction to threat intelligence platforms, and study intelligence-sharing initiatives, including standards such as STIX and TAXII for exchanging threat data between organisations.

• You will match forms of delivery to different consumer audiences
• You will describe how a threat intelligence platform supports dissemination
• You will explain how STIX and TAXII enable structured sharing between organisations
• You will position dissemination correctly within the intelligence cycle

This module covers the managerial considerations behind a CTI programme and the aspects that need oversight. You learn to understand, manage and explain risk, including the use of structured risk scales, and study regulator-mandated threat intelligence schemes in depth. It closes with reporting, connecting managerial oversight to the products the programme delivers.

• You will understand and communicate risk using a structured risk scale
• You will explain regulator-mandated threat intelligence schemes and their purpose
• You will identify which parts of a CTI programme require management oversight
• You will link reporting to programme-level decision-making

This module grounds your analysis in the technical layer. You cover IP protocols, cryptography and vulnerabilities and intrusion vectors, with a MITRE ATT&CK demonstration, then move into command and control and exfiltration techniques. Hands-on exercises include a geofencing task and a Hammertoss command-and-control analysis, so you can read technical tradecraft and describe it precisely to a stakeholder.

• You will interpret IP protocols and apply cryptography concepts to your analysis
• You will map adversary behaviour with MITRE ATT&CK
• You will work through the Hammertoss exercise to analyse command-and-control tradecraft
• You will identify vulnerabilities, intrusion vectors and exfiltration techniques in an intrusion