For security teams: Threat intelligence training for the whole team

Team Workspace puts every analyst on the same learning paths, simulators, investigation platforms and lab range, and gives you one place to see who has done what and where each person stands.

Priced by team size. Every seat includes everything in Premium. SSO, SCIM and the audit log are included.

Every seat gets the full platform

Team members work on the same surfaces as every other CTI Academy analyst, with nothing held back.

Learning paths

Structured paths that start from zero: fourteen are live today and more are in production. Lessons close on a quiz and sections include investigation exercises, so reading always turns into work.

  • Cyber Threat Intelligence
  • Cybersecurity Foundations
  • Open Source Intelligence (OSINT)
  • Human Source Collection for CTI
  • Attack Surface Management
  • Advanced OSINT Investigations
  • Phishing Investigation & Email Threat Analysis
  • Threat Actor Profiling & Attribution
  • Cybercrime Underground Intelligence
  • Fraud & Financial Crime Intelligence
  • CTI Reporting & Briefing
  • Malware Triage & Intelligence
  • Networking Fundamentals & Traffic Analysis
  • Windows Forensics Fundamentals
  • More paths on the way
Simulators

SOC, Phishing and Attack Investigation. A fresh set of decisions every day, scored against the right call rather than a guess that happened to land.

LeakLens

An investigation graph for leak data. Members expand entities, control depth, filter by relationship strength and keep their work in cases.

NullBase

A simulated underground forum for reading sellers, weighing claims and practising research OPSEC without touching a real one.

Lab range

A contained network reached over VPN, with scenario sites, captures and artifacts to investigate. Team seats have no daily time cap.

Missions and Arena

Investigation missions graded on exact answers, a daily mission with a first-blood bonus, and Arena sessions where the whole team plays the same mission, solo or split into teams.

Certificates

Members earn certificates as they complete their work and can share them on a CV or profile.

Team insight

See who did what, and where each person stands

Everything a member does on the platform feeds one team view, so you can follow the team's progress without chasing status updates.

01

Path progress

Where every member sits in each path, down to the section, and who has already earned a certificate.

  • Each member placed on the section they are working through
  • Members who stop moving are marked as stalled
  • Certificates earned, path by path
02

Activity

Daily activity per person across lessons, missions, simulator runs and lab time, so you notice when someone goes quiet.

  • Team hours, active days and streaks over the last 28 days
  • A flag when someone has had no activity for several days
03

Skill coverage

Scores by area for every member and for the team as a whole, which shows the areas nobody has covered yet.

  • A 0 to 100 score per area for every member
  • Team averages across Foundations, CTI, OSINT, HUMINT and ASM
  • The weakest area called out as the team's gap
04

Member detail

Open any analyst to see their own record: lessons finished, missions solved, simulator results and certificates.

  • Lessons, missions, simulator accuracy and lab time in one place
  • A feed of recent work, from solved missions to new certificates

Ready for your security review

The controls your IT and security teams ask for are part of Team Workspace, not an add-on. The details are on our trust page.

Single sign-on

SAML 2.0 or OpenID Connect with Okta, Microsoft Entra ID, Google Workspace and other identity providers. Your owner sets it up in the console, runs a test sign-in and turns it on. Managers and members then use their company account.

Provisioning

SCIM 2.0 creates and deactivates accounts from your identity provider and turns groups into teams. When IT removes a leaver, the seat is free again the same minute.

Console security

Two-factor for every console user, passkeys on top, a fresh code before role changes, exports and privacy changes, and session limits you choose.

Audit and retention

An append-only log of every console action that exports with event IDs and UTC timestamps, and training records deleted on the schedule you set.

Privacy mode

Team averages instead of individual figures, for works councils and stricter privacy rules. Admins never see IP addresses, devices or locations in any mode.

Reports and alerts

PDF and CSV reports emailed on a schedule, and overdue work, completions and certificates posted to Slack, Microsoft Teams or your own signed webhook.

Built for distributed teams

Each workspace runs on its own time zone and week, so due dates and reminders land on your team’s morning. Hosted in Germany, in the EU.

How a team gets started

Pricing is based on team size. Onboarding, live training and reporting come with the plan.

  1. 01

    Talk to us

    Tell us how many analysts you want to bring in and what they work on, and we send a proposal based on team size.

  2. 02

    Onboarding

    We set up the workspace with you and get every member signed in, including VPN access to the lab range.

  3. 03

    Live training

    A live session with the team on how the platform works and where each person should start.

  4. 04

    Reporting

    From then on you follow progress, activity and skill coverage in Team Workspace.

Team demo

See Team Workspace with your team in mind

Thirty minutes with someone who builds the platform. We show the console on a demo workspace, answer your security questions and put a proposal together for your team size.

  • A walk through paths, simulators, missions and the lab range
  • The console: assignments, reports, SSO, SCIM and the audit log
  • Our data processing agreement and security answers on request

We reply within one business day. Prefer email? Write to info@ctiacademy.io.

Book a team demo

Most interested in

Questions from team leads

Anything else, ask us and a person will reply.

It is the team plan of CTI Academy. Every member gets full Premium access to the platform, and the team lead gets one view of progress, activity and skills across the group.

Security teams that want their analysts trained on threat intelligence casework. It suits SOC teams taking on CTI work and CTI teams bringing in new hires, and it works for any group that trains together.

Each member's progress in every path down to the section, their daily activity across lessons, missions, simulators and the lab range, their scores by area, and the certificates they have earned. The same data rolls up into a view of the whole team.

Pricing is based on team size and includes onboarding, live training and reporting for the whole group. Contact us and we will put a proposal together.

With your company single sign-on (SAML 2.0 or OpenID Connect), or with email and password. Accounts can be created by your identity provider over SCIM, imported from a CSV file or added one by one.

On servers in Nuremberg, Germany. Admins see training data only, never IP addresses, devices or locations, and privacy mode can show team averages instead of individual figures. Hosting, sub-processors and our data processing agreement are on the trust page.

The platform runs in the browser. The lab range is reached over VPN with the free WireGuard client, and the lab access page walks each member through the setup.

Yes. Explore the live demo from the top of this page: a sample company in Team Workspace, read-only, with no sign-up. Anyone on the team can also create a free account and try the paths, the simulators and a daily slot on the lab range before you talk to us.

Professor, the CTI Academy owl

Train the team on real casework.

Book a demo and we will walk you through Team Workspace with your team size in mind.

Book a team demo