Cyber Threat Intelligence Practitioner

This module separates Cyber Threat Intelligence from conventional 'bomb and bullet' intelligence and builds the vocabulary the field runs on. You will classify threat actors from white, grey and black hat hackers through to nation-states, hacktivists and cybercriminals, study the Mandiant APT1 report, and map real intrusions using the four-step intelligence cycle, the Diamond Model and the Lockheed Martin Cyber Kill Chain. Hands-on exercises put you inside the Avaddon ransomware and Carbanak cases, and you finish clear on the difference between threat, vulnerability and risk.

• You will distinguish CTI from conventional intelligence and describe what it delivers to an organisation
• You will categorise threat actors by motive, affiliation and common TTPs, from nation-state APTs to cybercriminals
• You will map an intrusion across the four core features of the Diamond Model: adversary, capability, infrastructure and victim
• You will break a real campaign down against the Cyber Kill Chain using the Avaddon and Carbanak cases
• You will separate threat, vulnerability and risk and explain how they interact

This module shows why intelligence answers to the customer who sets its direction, and how that direction flows through the strategic, operational and tactical levels of an organisation. You will learn the structure of Intelligence Requirements, Priority Intelligence Requirements and Requests For Information, and pull real requirements from a conversational email exchange with a fictional CISO. It also covers Terms of Reference, the CROSSCAT principles of intelligence, project review and how to handle intelligence gaps honestly.

• You will identify the intelligence customer and how their questions set investigative priority
• You will distinguish IRs, PIRs and RFIs and decide what is in and out of scope
• You will extract Priority Intelligence Requirements from a realistic CISO email exercise
• You will apply the CROSSCAT principles to judge whether an intelligence product is fit for purpose
• You will recognise intelligence gaps and choose how to address them

This module maps where CTI data comes from, technical sources like logs and feeds alongside human sources like forums and reports, and how to record it all on a collection worksheet. You will grade reliability using the 5x5x5 National Intelligence Model and the Admiralty (NATO) system, practise pivoting through investigations, and get hands-on with Maltego Community Edition against the APT1 report. It also covers Boolean and advanced Google search operators, spotting deliberate misdirection, and maintaining operational security.

• You will classify technical and non-technical sources and log them on a collection worksheet
• You will grade source reliability and information credibility using the 5x5x5 and Admiralty systems
• You will use Maltego Community Edition to pivot through an investigation using the APT1 report
• You will build precise Boolean search strings with operators like AND, OR, NOT, quotation marks and wildcards
• You will recognise deliberate misdirection and apply OPSEC to protect a collection effort

This is the module where intelligence most often breaks, and where you learn to catch your own mind before it reaches a confident, wrong conclusion. You will apply Analysis of Competing Hypotheses to weigh explanations for an event, separate facts from assumptions, premises and inferences, and use Words of Estimative Probability so your confidence is never overstated. It also tackles circular reporting, cognitive bias, information reliability and structured analytical techniques such as SWOT and PESTAL, with the WannaCry ACH analysis as a worked example.

• You will run Analysis of Competing Hypotheses to evaluate multiple explanations against the evidence
• You will separate facts, assumptions, premises and inferences before drawing conclusions
• You will apply Words of Estimative Probability to communicate confidence honestly
• You will identify circular reporting and cognitive bias in your own analysis
• You will apply structured techniques including SWOT and PESTAL to reduce bias

This module covers the last mile of intelligence: getting a finished product to the right person in a form they will read and act on. You will contrast structured machine-readable intelligence with unstructured human-readable reporting, apply security markings and analytical language so a judgement is never mistaken for a fact, and tailor delivery format to the customer. It also works through the 'need to know versus need to share' tension that shapes how intelligence is distributed.

• You will produce structured machine-readable and unstructured human-readable intelligence
• You will apply security markings and handling codes to control who can see a product
• You will use analytical language that signals confidence and uncertainty accurately
• You will balance 'need to know' against 'need to share' when distributing intelligence

This module maps the legal and ethical boundaries that turn instinctive defensive work into defensible practice under British common law. You will work through the legislation that shapes a CTI analyst's decisions, including the Data Protection Act, the Computer Misuse Act, the Police and Justice Act, the Bribery Act, RIPA, the Proceeds of Crime Act, the Official Secrets Act, the Telecommunications Act and the Human Rights Act. It also covers handling classified information, resolving legal and ethical uncertainty, and the CREST Code of Conduct.

• You will identify the UK legislation that constrains how intelligence is collected, handled and shared
• You will judge where authorisation, purpose and jurisdiction place an action either side of the Computer Misuse Act
• You will handle classified information in line with British standards and the CREST syllabus
• You will apply the CREST Code of Conduct and your own ethical guidelines to grey-zone decisions