Cyber threat intelligence courses: Guided paths from your first concept to your first case

Learn Cyber Threat Intelligence (CTI) analyst tradecraft from the first intelligence requirement to a defensive handoff. You will build PIRs, grade sources, work with OSINT and human reporting, use MITRE ATT&CK, the Diamond Model and the Cyber Kill Chain, track threat actors and campaigns without forcing attribution, manage IOC context, write assessments, and turn external intelligence into questions a SOC or incident response team can test. The curriculum was reviewed against roughly 1,000 job-market observations and a detailed sample of current CTI role descriptions, then checked against real analyst workflows and documented incidents. Three sections, 76 lessons, and six case-based missions.

Learn the fundamentals every other CTI Academy path assumes you already have: what a threat, an asset and a vulnerability actually are, how the CIA triad and defense-in-depth hold together, how attackers actually get in through malware and social engineering, and how Linux becomes a daily analysis tool rather than a list of commands to memorise. You will work through core information security concepts, then spend three sections on grep, awk, sed, log analysis, process and network investigation, and bash automation using real-looking incident data. Four sections, 58 lessons, and four case-based missions.

Learn Open Source Intelligence (OSINT) as an investigation process, not a list of tools. Plan collection, search across people, domains, DNS, certificates, images, phone numbers and public records, verify sources, preserve evidence, and write findings for Cyber Threat Intelligence, fraud and digital risk work. The path also covers research OPSEC, isolated workstations and research personas so the investigation does not point back to you. Four sections, 42 lessons, and five case-based investigations.

Work human sources for cyber threat intelligence (HUMINT): what a person tells you, what their position actually lets them know, and what you are authorised to do about it. You separate a claim from an observation, grade the source and the claim as two different judgements, test whether several accounts are one route counted twice, run a research persona inside a community without leading it back to you, and write the collection note another analyst can still use after you have gone. Four sections, 53 lessons, and eight missions.

Learn Attack Surface Management (ASM) as an operational discipline, not a scanner report. You will discover an organisation's external footprint through DNS, WHOIS, certificate transparency and cloud storage, verify what a scan actually proves versus what it merely returns, enumerate subdomains passively and actively, spot subdomain takeovers and shadow IT before an attacker does, and turn a raw asset list into a prioritised, owner-assigned remediation queue. The curriculum was reviewed against a detailed sample of roughly 54 EASM and exposure-management job descriptions inside a wider 1,000 job-market scan, then checked against real reconnaissance and exposure workflows. Four sections, 63 lessons, and four case-based missions.

Take one domain or one address and turn it into a verified picture of the infrastructure behind it. This path works the public record layer in depth, which means reading a DNS answer rather than running a lookup, reading a certificate rather than checking that it is valid, and dating a change rather than describing a state.

Learn phishing investigation and email analysis: triage reported mail, read headers, SPF, DKIM and DMARC as evidence, scope the campaign, take the site down. Throughout the path you work a reported-phishing queue the way a SOC does, including the messages that turn out not to be attacks, take a lookalike domain and its credential capture page apart, and run the response on both sides of it: the people who received the message and the brand whose name it used. Four sections, ten modules, five hands-on missions, two of them on a live lab range and investigation surfaces, and the Phishing Triage simulator.

Learn threat actor profiling and attribution: grade evidence, weigh competing hypotheses, and state confidence you can defend. You work an unnamed activity cluster through infrastructure, behaviour and underground persona analysis, decide what the evidence actually supports about the operator, and write an actor intelligence product a decision maker can act on. The path teaches the refusal as well as the claim: when the evidence will not carry a name, saying so is the finding. Four sections, 38 lessons, 190 quizzes and seven hands-on missions on live investigation surfaces.

Dark web and cybercrime intelligence for defenders: read stealer logs, access broker listings and ransomware leak sites, and turn them into early warning. Following the criminal supply chain from one infected laptop to a leak site post, you grade what each listing, log and post actually proves and write alerts and briefs that stay inside the law and keep your sources safe. You never visit a criminal site: every listing, log and leak site post comes to you as evidence. Four sections, 50 lessons and five hands-on missions built on a single case, with a verifiable certificate at the end.

Fraud investigation and crypto tracing: follow scam money from pig butchering sites and money mules to stablecoin freezes, then stop the next payment. Everything rests on real cases in court filings and government releases, and five missions put you on a fictional UK bank's fraud intelligence desk. Business email compromise, APP fraud, card and identity fraud and professional laundering are covered too, across 40 lessons with a verifiable certificate at the end.

Learn threat intelligence report writing: key judgments, estimative language, advisories, executive briefs and board pages that people act on. You work on real documents, from the declassified President's Daily Brief of 6 August 2001 to CISA and NCSC advisories, and four missions put you on the CTI desk of a fictional Dublin insurer. TLP 2.0 and PAP marking, tearlines, report templates (LaTeX included), drafting with AI and CTI metrics are covered too, across 33 lessons with a verifiable certificate at the end.

Learn malware analysis for threat intelligence: triage a sample safely, recover its configuration and C2, and turn what you find into intelligence. Read sandbox reports and script loaders, handle Linux ELF files and malicious Office documents, write YARA rules that survive a rebuild, and pivot from a configuration to the operator's infrastructure. It is built for CTI analysts, not reverse engineers, and the first section is free.