Training Programs

Can your team make the most of the critical first hours after a cyber incident, or will valuable time be lost?

A First Responder is the digital equivalent of a workplace emergency responder. During this one-day training course, you will learn how to act quickly, carefully, and effectively when a potential cyber incident occurs. You will minimise damage, preserve valuable evidence, and prepare the ground for professional incident response if required. 

Topics covered
•    Threat landscape
•    Incident response
•    Digital forensics
•    Triage and initial analysis
•    Containment measures
•    Forensic data collection
•    Evidence handling and chain of custody
•    Investigation follow-up activities

After this training
You will be able to take the essential first steps after an incident, avoid common mistakes, and know when and how to engage professional support. 

Who should attend?
•    System administrators
•    Service desk professionals
•    SOC analysts
•    IT and security professionals involved in incident response

Prerequisites
•    Basic knowledge of IT and operating systems
•    Basic hardware knowledge
•    Familiarity with working from the command line

Request information

We also offer this training through open enrolment with our partner Security Academy, a DNV company, in Woerden. 

Open enrolment

By selecting this option, you will be redirected to the Security Academy website. Security Academy manages registration and administration, while Fox-IT experts deliver the training.

How effective is your defence if you don't understand how attackers think?

In the Attack & Defend training, you'll experience how cyber attacks unfold in practice and explore the techniques attackers use to gain access to systems and networks. By directly linking offensive techniques to defensive measures, you'll learn to identify risks more quickly and mitigate them more effectively. 

Topics covered
•    OSINT and reconnaissance
•    Vulnerability scanning
•    Penetration testing and web applications
•    Network attacks and lateral movement
•    Active Directory security
•    Detection and logging
•    Defensive and preventative measures

After this training
You'll understand how attackers operate, be able to identify vulnerabilities, and be better equipped to implement appropriate detection, response, and preventative measures. 

Who should attend?
•    Security specialists
•    System and network administrators
•    SOC analysts
•    Security engineers

Prerequisites
•    Basic cybersecurity knowledge
•    Understanding of Windows, Linux, and networking
•    Experience working with the command line

Request information

Will your crisis team make clear decisions when pressure is at its highest?

A cyber incident requires more than technical expertise alone. During this training, participants learn how to make effective decisions under pressure, communicate during periods of uncertainty, and manage a cyber crisis at a strategic level. 

Topics covered
•    The cyber threat landscape
•    Cybersecurity terminology for executives
•    The BOB model (Situation Assessment, Judgement Formation and Decision-Making)
•    Crisis communications
•    Roles and responsibilities within crisis teams
•    Practical exercises based on realistic scenarios

After this training
You'll be better prepared to manage a cyber crisis and steer your organisation through challenges related to business continuity, reputation, and recovery. 

Who should attend?
•    Crisis management teams
•    Management teams
•    Communications professionals
•    Business leaders

Prerequisites
No specific technical knowledge is required.

Request information

Do you turn threat intelligence into action, or does it remain just information?

Cyber Threat Intelligence helps organisations better understand threats and take proactive measures. In this training, you'll learn how to analyse, enrich, and translate intelligence into practical detection, threat hunting, and defence activities. 

Topics covered
•    Cyber Kill Chain
•    MITRE ATT&CK
•    OSINT techniques
•    Shodan and Censys
•    VirusTotal Enterprise
•    Threat hunting
•    YARA rules

After this training
You'll be able to transform threat intelligence into actionable insights and targeted defensive measures for your organisation. 

Who should attend?
•    SOC analysts
•    Threat intelligence analysts
•    Security engineers
•    Incident responders

Prerequisites
•    Basic cybersecurity knowledge
•    Experience with security monitoring and analysis

Request information

Does your awareness programme change behaviour, or simply measure participation?

Effective awareness goes beyond knowledge alone. During this training, you'll learn how to develop a risk-driven awareness programme that aligns with your organisation's specific threats, employees, and business processes. 

Topics covered
•    Human factors in cybersecurity
•    Risk-driven awareness
•    Behavioural change
•    Audience-focused interventions
•    Simulations and practical examples
•    Measuring and improving effectiveness

After this training
You'll understand how to use cybersecurity awareness as a structured and sustainable way to encourage secure behaviour and strengthen cyber resilience. 

Who should attend?
•    Security officers
•    Awareness professionals
•    HR professionals
•    Managers and team leaders

Prerequisites
No specific prior knowledge is required.

Request information

Do you know how much advantage attackers gain from information that is already publicly available?

Open Source Intelligence (OSINT) uses publicly available sources to investigate individuals, organisations, and digital infrastructures. During this training, you'll learn how to collect, analyse, and validate information in a structured and effective way. 

Topics covered
•    Introduction to OSINT
•    Research techniques and sources
•    Domain and infrastructure analysis
•    Social media intelligence
•    Source validation
•    Investigation methodology

After this training
You'll be able to use OSINT techniques to gather, analyse, and translate publicly available information into valuable security insights. 

Who should attend?
•    Security specialists
•    Threat intelligence analysts
•    Fraud and investigation professionals
•    Incident responders

Prerequisites
Basic knowledge of the internet, networking, and cybersecurity.

Request information

Does your organisation have sufficient visibility into technical evidence to reliably reconstruct an attack?

A cyber incident can generate large volumes of technical data in a short period of time, including logs, disk images, system artefacts, and other digital evidence. DISSECT helps security professionals collect, process, and analyse this information in a structured way. This enables them to better understand what happened, identify affected systems, and trace how an attacker moved through the environment. 

The DISSECT Curriculum consists of several specialist training courses that can be followed independently. Depending on learning objectives, participants can explore the DISSECT framework, learn which logs and evidence are relevant during investigations, practise evidence collection under pressure, or discover how to extend the framework using custom loaders and plugins. 

Topics covered
•    Introduction to DISSECT and technical incident analysis
•    Identifying relevant logs, artefacts, and evidence
•    Forensic readiness and investigation preparation
•    Evidence collection under operational pressure
•    Analysis of disk images, logs, and system artefacts
•    Reconstructing attacker activity and attack paths
•    Extending DISSECT with custom loaders and plugins

After these training courses
Participants will be able to make more effective use of technical evidence when investigating incidents, reconstruct attack paths, and draw evidence-based conclusions. They will also learn which logs, artefacts, and evidence are required to improve readiness for the most likely attack scenarios. 

Who should attend?
•    Security specialists
•    Incident responders
•    SOC analysts
•    Digital forensic investigators
•    Security engineers
•    Software developers looking to extend DISSECT

Prerequisites
Prerequisites vary by course. For the introductory and readiness-focused modules, a basic understanding of cybersecurity, incident response, or security monitoring is sufficient. For DISSECT for Developers, programming experience is required. 

As the DISSECT Curriculum consists of multiple specialist courses, we work together with you to determine which modules best fit your team's needs, technical environment, and learning objectives. Speak with one of our experts to discuss the most suitable training path for your organisation. 

Request information