
The Anatomy of Disinformation
Disinformation is older than the printing press and sharper than ever. Learn to take it apart before it takes you in.
100% Online • Self-Paced • Start Immediately
What's Included
- 20+ hours of training content
- 3100+ practice questions
- 40 engaging exercises
- 35+ assessments
- arcX final exam and free re-test included

Trusted by leading organisations worldwide












The influence layer of the threat landscape
A plastic action figure bought in a Walmart was photographed as a captured soldier, picked up by an insurgent group and reported as fact within days.
The lie did not need a zero-day. It needed an audience with no way to check. The same mechanism put an AI-generated image of a downed US helicopter in front of thousands during the US-Israel-Iran conflict, and let a single inauthentic corporate account knock a pharmaceutical giant's share price by 4.37 per cent. Intrusions arrive with narratives attached now, and the analyst who can only read the logs is reading half the operation.
This course trains the other half. You will stop saying "fake news" and start working with misinformation, disinformation, malinformation and propaganda as separate problems with separate responses, read against the EU information disorder report, the CDC and RAND. You will classify an operation as white, grey or black psyops, place content in Facebook's actor-versus-content quadrants, run a SWOT grid over a viral claim to find where it is fragile, take a conspiracy theory apart with the cocktail model's three diagnostic questions, and tell possibility from probability before you write a word of assessment.
It gets you there through cases rather than theory: Octavian's forged will read aloud in the Senate, Orson Welles on the radio, Cambridge Analytica slicing culture into movable units, Pizzagate, the QAnon Shaman's online university, flat earth sliding into antisemitism, the Satanic Panic, the Blood Tribe and the Boogaloo movement's Hawaiian shirts. The instructor is a career intelligence practitioner who spent years watching state actors interfere in elections and three years studying violent extremism, and who treats disinformation the way an analyst treats any other adversary: find the mechanics behind the magic trick, then name them.
Product Overview
This course closes that gap. Across five modules, you learn to recognise disinformation on sight, name the specific tactic being used, and take it apart on the spot.
What you will learn:
You will retire the phrase "fake news" from your vocabulary on day one and replace it with the precise institutional definitions used by the EU, the CDC, the RAND Corporation, and Edward Bernays's 1928 book Propaganda. You will pick up a suite of analytical frameworks the course uses throughout, from SWOT and Facebook's intent-versus-truth quadrant to Cohen's four stages of moral panic and the Moghaddam staircase of radicalisation. You will pick up a six-move diagnostic toolkit (tech speak, volume, cognitive jumps, fringe over-representation, possibility versus probability, and shifting the frame of evidence) that you can run on any piece of content you meet in the wild.
Focus and scope:
This is a course in diagnostic literacy. You will leave able to look at a piece of disinformation and understand what is being done, why it works, and how to refuse it. The course is not an investigator's manual: it does not train OSINT tools, network attribution methodology, or forensic infrastructure analysis. Those are the domain of professional investigation training. This course is the conceptual grounding that sits underneath that training and that most people who need it never receive.
Your Journey
This module builds the vocabulary and the analytical kit everything else runs on: misinformation, disinformation and malinformation defined against the EU information disorder report, the CDC and RAND, with Bernays on propaganda as a separate phenomenon. You then pick up four working frameworks, SWOT, the white-grey-black psyops spectrum, Facebook's actor-versus-content quadrants and RAND's Truth Decay structure, and apply them across two thousand years of technique, from Sun Tzu and Octavian's forged will through the 1688 bedpan rumour, yellow journalism, radio, television and the hashtag. It closes on information asymmetry, McLuhan, micro-targeting and the question of what counts as real when consensus reality breaks.
- You will retire "fake news" and work instead with misinformation, disinformation, malinformation and propaganda, comparing how the EU, CDC and RAND draw their lines
- You will apply SWOT to a viral health claim, sort operations as white, grey or black psyops, and map content into Facebook's authentic-versus-inauthentic actor quadrants
- You will trace the narrowing of the target from defaced Roman coins to Cambridge Analytica's "movable units" and the audience of one
- You will work a three-phase scenario, the newsroom Slack, the long view and the audience of one, making analytical calls at each stage
- You will separate objective from subjective reality and use the Overton window to explain how altered realities drove January 6 and the Brasilia storming
Inside this module
- Definitions of disinformation
- Why we never say "fake news"
- Frameworks for taking it apart
- History and mechanics
- Two thousand years of liars
- Information asymmetry: learned the hard way
- Donald Trump as a working case study
- The medium is the message
- The audience of one
- Reality and perception
- Subjective and objective reality
- When consensus reality breaks
Here you learn the anatomy of a conspiracy theory: the alleged plot, the conspirators, the apparent evidence, and the tell that nothing happens by accident and everything is connected. The module separates a real conspiracy from a false one, introduces synthetic folklore and the cocktail and fourth wall model, then runs you through live material including a practical on how a film's fiction leaked into Iraq war reporting, a Spike Lee quotation taken apart line by line, and the journalism that follows flat earth into antisemitism by asking one question: who is doing the lying. It closes on why conspiracism is not a mental illness, how pareidolia and the pattern-finding mind feed it, and what salad-bar extremism looks like.
- You will apply the cocktail model's three diagnostic questions to decide which part of a claim is the factual kernel and which is the false framing
- You will identify the features of conspiratorial thinking and distinguish healthy scepticism from conspiracism
- You will trace how individual theories lock into self-reinforcing belief systems, using David Icke and Michael Barkun's A Culture of Conspiracy
- You will take a specific celebrity conspiracy claim apart as a worked mini case study
- You will explain why treating conspiracy belief as mental illness is both wrong and analytically useless
Inside this module
- What a conspiracy theory actually is
- Welcome to the building blocks
- What is a conspiracy theory
- Conspiracism versus a conspiracy theory
- Synthetic folklore
- The cocktail and the fourth wall
- How a film leaked into the Iraq war
- Belief systems
- Why no one believes only one
- Taking Spike Lee apart
- When flat earth slides into antisemitism
- The psychology of conspiracism
This module gives you criteria for separating science from pseudoscience and then stress-tests them on real material: the suggestion of injecting bleach, Jacob Chansley's online university and its neurolinguistic programming claims, and Samuel Rowbotham's role in manufacturing modern flat earth belief. You then assemble the disinformer's toolkit as a diagnostic checklist, covering "do your research", tech speak, appeals to volume, cognitive jumps, fringe over-representation and frame-shifting, before working through possibility versus probability, correlation versus causation, and the alternative platform infrastructure that carries this material when mainstream sites will not.
- You will apply the criteria for scientific legitimacy in order, and explain why a lab-leak question is not automatically pseudoscience
- You will spot tech speak used to shut down scrutiny and name exactly what is missing from the claim
- You will separate possibility from probability and break correlation-as-causation arguments of the ice cream and shark attack type
- You will follow the fringe voice amplification cycle from obscure claim to mainstream repetition
- You will map the platforms and infrastructure that host pseudoscientific content off the mainstream internet
Inside this module
- What separates science from pseudoscience
- When the President suggested injecting bleach
- What separates the science from pseudoscience
- The QAnon Shaman
- The QAnon Shaman: up close
- Inside the Shaman's online university
- Flat earth
- The man who flattened the earth
- The disinformer's toolkit
- "Do your research"
- Tech speak as a weapon
- Volume, cognitive jumps, and fringe voices
Using Stanley Cohen's four-stage model, this module teaches you to recognise a moral panic while it is still forming and to see how community anxiety is converted into folk devils. The worked case is the Satanic Panic: the McMartin preschool trial, the Michelle Remembers phenomenon, Patricia Pulling's campaign against Dungeons and Dragons, and the role of the questionable "expert", read alongside Laycock's Dangerous Games. It closes by bridging to extremism, showing how the blur between fantasy and reality turns synthetic folklore into real-world harm.
- You will apply Cohen's four-stage model to identify a panic in its early stages
- You will analyse how folk devils are manufactured and who benefits from naming them
- You will examine the McMartin case, Michelle Remembers and the Dungeons and Dragons scare as a single structural pattern
- You will assess how self-appointed experts lend authority to claims with no evidence behind them
- You will connect the fantasy-reality blur to the political violence examined in the next module
Inside this module
- The anatomy of a panic
- Anatomy of a panic
- The satanic panic
- McMartin, Michelle, and the satanic panic
- Patricia Pulling and the Dungeons and Dragons scare
- Trouble in the toy box
- Bridge to extremism
- Synthetic folklore and the violence to come
- End of Module Assessment
This module draws the lines between protest, direct action, violent protest, violent extremism and terrorism, then uses Moghaddam's staircase to explain how people climb towards violence and where disinformation does its work on the lower steps. Case material includes Christopher Pohlhaus and the Blood Tribe, the chilling effect of legal-but-threatening displays and the matchsticks model of escalation, the Boogaloo movement's Hawaiian shirts and igloo memes as loose-network signalling, and stochastic terrorism amplified through parasocial relationships with online figures. It ends on what happens when the fantasy collapses and the identity cost that follows.
- You will distinguish protest, direct action, violent protest, violent extremism and terrorism using clear criteria
- You will place behaviour on Moghaddam's staircase and identify where disinformation is seeded
- You will explain stochastic terrorism and how rhetoric incites violence while shielding the speaker
- You will analyse why extremist movements abandoned hierarchy for loose networks, and what memetic branding does for them
- You will assess the chilling effect of legal-but-threatening displays on communities and institutions
Inside this module
- Definitions and the Staircase
- Definitions and the Moghaddam Staircase
- The Blood Tribe and chilling effects
- Christopher Pohlhaus and the Blood Tribe
- Chilling effects, escalation, and the matchsticks model
- Organisational form
- Why hierarchies died and Hawaiian shirts won
- Stochastic terrorism
- Stochastic terrorism and parasocial relationships
- When the fantasy collapses
- End of Module Assessment
What You'll Learn
Skills You'll Gain
How This Course Is Delivered
This course is delivered through a combination of interactive content and practical exercises.
Video Content
Immerse yourself in arcX's The Anatomy of Disinformation training course through its core delivery method: video. You'll have access to a comprehensive series of videos, collectively spanning over 12 hours of content.
Practical Exercises
Our bespoke testing engine will ensure you experience a combination of free-form and adaptive tests. These are thoughtfully integrated to reinforce your learning and consistently evaluate your skills.
Quizzes
You'll engage in numerous micro-scenarios, designed to put you in the driving seat and requiring just a few minutes to complete. You'll also have access to an enormous question bank of over 3,100 questions.
Reading Material
Reading material has been strategically created and provided to enhance your understanding of the taught concepts and expand upon them.
Who This Course Is For
Built for people who cannot afford to be wrong about what they are looking at, and above all for analysts who now find an influence layer sitting on top of every incident they work.
- Cyber threat intelligence analysts, junior to lead, who need to cover the narrative and influence activity that travels with intrusions
- Aspiring CTI and SOC analysts looking for an analytical specialism that sets their reporting apart
- Incident responders and security teams who deal with fabricated imagery, inauthentic accounts and hostile narratives around an event
- Journalists and communicators who need vocabulary and frameworks that hold up under pressure
- Educators, policy advisors and researchers working on information integrity, extremism or public health messaging
- Anyone who wants to know exactly what is being done to them, daily, and by what mechanism
Course Details
Instructor
Stewart K Bertram
Stewart has worked within the field of Intelligence and Security for the past 20 years with experience across both the private and public sector. Starting his career in 2004 in the Intelligence Corps of the British Army, Stewart entered the private sector in 2009 and has held a number of roles in Cyber Threat Intelligence (CTI) since then. These have included product development, service delivery and consulting, with his most recent roles involving the management of specialist teams involved in research into the cyber criminal underground and nation state threat actors. Holding both a Masters in Computing and a Master of Letters in Terrorism Studies from St. Andrews University. Stewart was also among the first in the world to pass the CREST Certified Threat Intelligence Manager (CCTIM) examination. Stewart’s research interests and work have always sat at the intersection of technology, security and people focused issues. These unique areas of focus are bought to bare within his role at arcX, where he is responsible for the design and delivery of the core CREST related CTI courses and oversight of the wider Cyber Threat Intelligence stream.
Difficulty Level
Language
en
The course carries The Anatomy of Disinformation (CDA) certification, earned by working through the end-of-module assessments across Foundations, Conspiracy Theories, Pseudoscience and COVID, Moral Panic and Violent Extremism.
Trusted by Security Professionals
Join 70,000+ professionals who have advanced their careers with arcX training
"The courses provided by arcX are the best in terms of content and structure I have come across, that are aligned to CREST's CPTIA and CRTIA exams. An absolute must for anyone wanting to pursue these certifications but also anyone wanting to gain a solid baseline knowledge set for a career in CTI."
Chris
Cyber Threat and Risk Manager
"Great content and fantastic customer service. Put me in a great position to gain my qualification. 10/10 recommend."
Dan
Cyber Security Project Manager
"I have done courses in offensive security, networking, forensics and malware. All from prestigious training vendors. None compare to arcX. I secured a straight transition into a senior CTI role. The platform provided me with insights into my strengths and weaknesses and allowed me to track changes. Very grateful to the guys for this!"
Pat
Senior Threat Intelligence Analyst
Frequently Asked Questions
About This Course
General Course FAQs
Click your avatar in the top right corner and select Contact Support, or email us directly at [email protected]. We typically respond within 24-hours.
You will have 12 months access after activating your course in accordance with our Terms & Conditions. You can work through your course at a pace that suits you. Once you have completed your course you will retain access and be able to refresh your knowledge anytime within the access period.
Our courses are delivered on-demand. This means you can start and stop learning whenever you like. There is no time limit and no restriction on how many times you can access course content.
No. CREST exam vouchers need to be purchased separately through CREST or Pearson VUE. You can find further information on our CREST Accreditation page.
Absolutely! Demonstrating your dedication to professional development in cyber security is always valuable. Our certifications are recognised by partner organisations who value our training.
Yes! You can create individual accounts and purchase courses through our portal for instant access. For multiple employees, please contact us for volume pricing.
Yes! We're always happy to speak with industry experts interested in producing high-quality training courses. Become an instructor and help make a positive impact on someone's career.
Can't find what you're looking for? Get in touch
The Anatomy of Disinformation