Cyber Threat Intelligence Training Platform: For those who want to learn this field from the beginning.
We started CTI Academy because we kept seeing the same gap. Brilliant people who wanted to break into threat intelligence, blocked by courses that skipped fundamentals and certifications that tested memorization instead of skill.
Every course at CTI Academy starts at the actual beginning. No prerequisites, no jargon walls, no shame in asking basic questions. You will touch real data, follow real workflows, and learn the craft the way it is practiced.
Learn to collect, analyze, and act on threat data the way real SOC and intel teams do.
Go beyond alerts. Proactively hunt for adversaries hiding in networks using techniques pros rely on.
Open-source intelligence is more than Google dorking. Dive into social media analysis and infrastructure mapping.
Static analysis, dynamic analysis, reverse engineering. We walk you through real samples step by step.
CTI Academy is designed for learners with no prior experience. Follow a structured path from foundational concepts to real-world threat hunting workflows.
Start at Hunter I for free. Progress through Hunter IV as your skills grow.
Structured lessons, quizzes, and CTF-style challenges built around real threat scenarios.
Test your skills in duels and arena matches. Share intelligence on NullBase community.
Earn course completion certificates as you progress from Hunter I through Hunter IV.
From structured lessons for beginners to competitions and real-world research tools, every element works together seamlessly.
Follow a path end to end: modules that pair theory with hands-on CTF-style challenges, in the order they make sense. Each one builds on the last, so you always know what comes next.
Tutorials, threat breakdowns, and lessons learned from analysts working in the field.
Real threat intelligence analyst interview questions with short model answers, from the intelligence lifecycle and the Pyramid of Pain to live pivots and competing hypotheses. Includes an annotated take-home sample, a five-beat structure for current-threat questions built on October 2026 events, and a two-week prep plan.
Microsoft says the median time from discovery in the wild to weaponization is well under 24 hours, while VulnCheck puts the median time from CVE publication to KEV listing at 80 days. We read the six big 2026 threat reports side by side to show where they agree, where they split, and why their numbers clash.
ShinyHunters is less a fixed gang than an extortion brand that vendors track under half a dozen names. This profile maps its aliases, walks the 2020 to 2026 timeline, separates what police and the FBI have confirmed about the September and October 2026 arrests from what the group claims, and maps its help desk vishing playbook to MITRE ATT&CK and to the controls that break it.
Answers to what most beginners ask before joining.
Create a free account, no credit card needed, and begin Hunter I today.
