Learning Paths

Learn Cyber Threat Intelligence (CTI) analyst tradecraft from the first intelligence requirement to a defensive handoff. You will build PIRs, grade sources, work with OSINT and human reporting, use MITRE ATT&CK, the Diamond Model and the Cyber Kill Chain, track threat actors and campaigns without forcing attribution, manage IOC context, write assessments, and turn external intelligence into questions a SOC or incident response team can test. The curriculum was reviewed against roughly 1,000 job-market observations and a detailed sample of current CTI role descriptions, then checked against real analyst workflows and documented incidents. Three sections, 76 lessons, and six case-based missions.

Learn the fundamentals every other CTI Academy path assumes you already have: what a threat, an asset and a vulnerability actually are, how the CIA triad and defense-in-depth hold together, how attackers actually get in through malware and social engineering, and how Linux becomes a daily analysis tool rather than a list of commands to memorise. You will work through core information security concepts, then spend three sections on grep, awk, sed, log analysis, process and network investigation, and bash automation using real-looking incident data. Four sections, 58 lessons, and four case-based missions.

Learn Open Source Intelligence (OSINT) as an investigation process, not a list of tools. Plan collection, search across people, domains, DNS, certificates, images, phone numbers and public records, verify sources, preserve evidence, and write findings for Cyber Threat Intelligence, fraud and digital risk work. The path also covers research OPSEC, isolated workstations and research personas so the investigation does not point back to you. Four sections, 42 lessons, and five case-based investigations.

Work human sources for cyber threat intelligence (HUMINT): what a person tells you, what their position actually lets them know, and what you are authorised to do about it. You separate a claim from an observation, grade the source and the claim as two different judgements, test whether several accounts are one route counted twice, run a research persona inside a community without leading it back to you, and write the collection note another analyst can still use after you have gone. Four sections, 53 lessons, and eight missions.

Learn Attack Surface Management (ASM) as an operational discipline, not a scanner report. You will discover an organisation's external footprint through DNS, WHOIS, certificate transparency and cloud storage, verify what a scan actually proves versus what it merely returns, enumerate subdomains passively and actively, spot subdomain takeovers and shadow IT before an attacker does, and turn a raw asset list into a prioritised, owner-assigned remediation queue. The curriculum was reviewed against a detailed sample of roughly 54 EASM and exposure-management job descriptions inside a wider 1,000 job-market scan, then checked against real reconnaissance and exposure workflows. Four sections, 63 lessons, and four case-based missions.

Take one domain or one address and turn it into a verified picture of the infrastructure behind it. This path works the public record layer in depth, which means reading a DNS answer rather than running a lookup, reading a certificate rather than checking that it is valid, and dating a change rather than describing a state.

Learn threat actor profiling and attribution: grade evidence, weigh competing hypotheses, and state confidence you can defend. You work an unnamed activity cluster through infrastructure, behaviour and underground persona analysis, decide what the evidence actually supports about the operator, and write an actor intelligence product a decision maker can act on. The path teaches the refusal as well as the claim: when the evidence will not carry a name, saying so is the finding. Four sections, 38 lessons, 190 quizzes and seven hands-on missions on live investigation surfaces.