Advanced Cybersecurity Technologies Training Course

Duration 5 days 10 modules · 33 contact hours
Level Advanced Certificate on completion
Who attends Cybersecurity Managers, Security Architects and others
Fee from USD 1,100 KSh 95,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 7 Nov 2026 Course code SD-CS-095

Before you join: Participants should have practical experience in IT, cloud, infrastructure, software delivery, security operations or technology risk.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Advanced cybersecurity work requires decisions that hold up during a real intrusion, not a list of products. A bank must stop account-takeover activity without blocking legitimate customers; a government agency must contain compromised identities while preserving essential services; a multinational must identify how a cloud misconfiguration, exposed API and privileged credential form one attack path. Teams must also turn technical evidence into actions that risk owners, operations teams and senior leaders can approve. This course addresses these connected problems through architecture, detection, response and control validation.

Participants examine threat-informed defence using MITRE ATT&CK, risk analysis with FAIR, Zero Trust Architecture, identity protection, network segmentation, cloud and Kubernetes security, secure software delivery, detection engineering, threat intelligence, incident response and vulnerability prioritisation. They learn to assess control gaps against realistic attack paths, specify useful telemetry, write detection use cases, investigate indicators, prioritise exploitable weaknesses and direct incident containment. The course also addresses ransomware, supplier access, security metrics and board-level reporting.

Instruction combines focused technical briefings with sector-based cases, analyst-style investigations, architecture reviews, group decision work and incident simulations. Participants apply methods to scenarios such as compromised administrator accounts, cloud storage exposure, malicious API activity and ransomware with data extortion. They leave with a tailored 90-day cybersecurity application plan and reusable working artefacts for threat-informed control improvement. The course is delivered over five days in a classroom in 50+ cities or live online, with approximately 6.5 contact hours each day. Participants receive a certificate of completion.

The course suits experienced security, infrastructure, cloud, risk and technology professionals who influence security design or operations. It is particularly relevant where services are regulated, distributed across cloud platforms, dependent on third parties or exposed to high-value fraud, espionage or disruption threats.

What you will be able to do

  • Design Zero Trust controls for identities, devices, applications and data flows
  • Map adversary attack paths using MITRE ATT&CK and threat modelling methods
  • Engineer SIEM detection use cases from telemetry, hypotheses and attacker behaviours
  • Assess cloud, Kubernetes and CI/CD controls against configuration and supply-chain threats
  • Secure privileged access through conditional access, PAM and phishing-resistant authentication
  • Prioritise vulnerabilities using CVSS v4.0, EPSS, CISA KEV and business criticality
  • Direct incident containment using severity criteria, forensic preservation and ransomware procedures
  • Produce a 90-day control validation and security improvement plan

Benefits of attending

For you

  • Assess multi-stage attack paths rather than reviewing controls in isolation
  • Write detection requirements that security operations teams can implement
  • Make defensible vulnerability decisions using exploit evidence and business impact
  • Lead clearer containment discussions during identity compromise and ransomware incidents
  • Present security investment priorities using risk, coverage and control-effectiveness evidence

For your organisation

  • Reduced exposure from excessive privileges, cloud misconfigurations and unmanaged internet-facing assets
  • Higher-value SIEM detections aligned to observed adversary techniques
  • Faster remediation sequencing for vulnerabilities with credible exploitation risk
  • More consistent incident decisions supported by severity and containment criteria
  • Clearer security reporting for executives, auditors, regulators and risk committees

Course modules

10 modules over 5 days

Participants can assess security architecture decisions against adversary behaviours, attack paths and measurable risk.

  • Threat-informed defence mapped to MITRE ATT&CK tactics, techniques and sub-techniques
  • NIST Cybersecurity Framework 2.0 profiles linked to measurable control outcomes
  • Attack-path analysis identifies identity, network and cloud privilege dependencies
  • Risk quantification using FAIR loss event frequency and magnitude factors
  • Security architecture decisions recorded through threat assumptions and control rationale
  • Purple-team findings converted into prioritised detection and prevention requirements

Participants can design identity controls that limit credential abuse and privileged access.

  • Zero Trust Architecture principles: explicit verification, least privilege, assumed breach
  • Identity attack paths covering phishing, token theft, Kerberoasting and AD CS
  • Conditional access policies assessed against device posture and session risk
  • Privileged access management workflows for just-in-time elevation and approval
  • FIDO2 phishing-resistant authentication compared with password and push MFA
  • Service account governance covers secrets rotation, ownership and entitlement review

Participants can specify network controls and telemetry that reduce lateral movement opportunities.

  • Network segmentation designed with zones, conduits and deny-by-default policy
  • Microsegmentation enforcement points compared across host, network and cloud layers
  • TLS inspection trade-offs assessed against privacy, performance and certificate management
  • DNS security controls detect tunnelling, domain generation and sinkhole opportunities
  • Network detection and response telemetry built from flow, packet and metadata sources
  • Secure Access Service Edge controls mapped to remote-access traffic flows

Participants can evaluate cloud and container controls for configuration, identity and workload risks.

  • Shared-responsibility boundaries analysed for IaaS, PaaS, SaaS and managed Kubernetes
  • CIS Benchmarks used to assess cloud configuration drift and exposure
  • Cloud security posture management findings triaged by exploitability and business impact
  • Workload identities, IAM roles and resource policies reviewed for excessive permissions
  • Container image assurance covers SBOMs, signing, provenance and vulnerability remediation
  • Kubernetes admission controls enforce restricted workloads, namespaces and network policies

Participants can build security requirements and assurance points into application delivery pipelines.

  • Threat modelling with STRIDE identifies abuse cases and security requirements
  • OWASP ASVS requirements mapped to authentication, authorisation and session controls
  • SAST, DAST and software composition analysis findings prioritised by exploit path
  • Secure CI/CD pipelines protect build agents, artefacts, secrets and deployment approvals
  • API security tests cover BOLA, rate limits, schema validation and tokens
  • SBOM consumption supports component inventory, vulnerability matching and supplier response

Participants can develop detections from attacker behaviours, telemetry sources and analytic logic.

  • Detection engineering begins with adversary behaviours, data sources and hypotheses
  • SIEM use cases specify log fields, correlation logic and response thresholds
  • Sigma rules translated into platform-specific queries while preserving detection intent
  • Endpoint telemetry identifies process injection, credential dumping and lateral movement
  • Detection coverage measured against ATT&CK techniques and analytic confidence
  • False-positive reduction uses baselining, enrichment, suppression and tuning criteria

Participants can convert threat intelligence into targeted hunt hypotheses and control improvements.

  • Intelligence requirements framed with priority intelligence questions and decision owners
  • STIX and TAXII support structured indicator and report exchange
  • Indicator lifecycle management distinguishes atomic, computed and behavioural indicators
  • Diamond Model analysis connects adversary, capability, infrastructure and victim
  • Threat hunting hypotheses combine intelligence, ATT&CK behaviours and local telemetry
  • Hunt results documented with evidence, coverage gaps and engineering actions

Participants can direct structured incident response while protecting evidence and business services.

  • NIST SP 800-61r3 guides incident response governance and improvement
  • Incident severity matrices combine service criticality, data impact and adversary access
  • Containment decisions balance evidence preservation, business continuity and attacker evasion
  • Digital forensic triage preserves volatile evidence, timelines and chain of custody
  • Ransomware response addresses encryption, exfiltration, extortion and recovery validation
  • SOAR playbooks automate enrichment, ticketing, containment approvals and audit trails

Participants can prioritise remediation using exploit likelihood, asset criticality and exposure evidence.

  • Asset attack-surface management reconciles discovery, ownership, exposure and criticality
  • CVSS v4.0 scores interpreted alongside exploit maturity and compensating controls
  • EPSS and CISA KEV inform vulnerability remediation sequencing
  • Patch exceptions require risk acceptance, expiry dates and alternative safeguards
  • External attack-surface findings validate internet exposure, DNS records and certificates
  • Metrics track remediation SLA adherence, exploitable exposure and recurring root causes

Participants can communicate security priorities and build an actionable control validation plan.

  • Security metrics distinguish control effectiveness, operational performance and business risk
  • Board reporting connects threat scenarios, treatment decisions and residual risk
  • Third-party assurance examines access paths, data handling, incident obligations and exit
  • Control validation plans schedule continuous testing, red teams and purple teams
  • Security investment cases compare risk reduction, implementation effort and operating cost
  • Personal 90-day application plans define priorities, stakeholders and success measures

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Threat-informed security architecture decision record
  2. Zero Trust identity control assessment checklist
  3. SIEM detection use-case specification template
  4. Cloud and Kubernetes security review model
  5. Risk-based vulnerability prioritisation matrix
  6. 90-day cybersecurity control improvement plan

Who should attend

  • Cybersecurity Managers — need to turn threats and control gaps into funded priorities
  • Security Architects — need to design identity, network, cloud and application controls
  • SOC Managers and Senior Analysts — need to improve detection coverage and response decisions
  • Cloud Security Engineers — need to assess cloud, container and workload identity exposure
  • IT Infrastructure Managers — need to reduce attack paths across enterprise services
  • Technology Risk and Audit Professionals — need evidence-based control assurance and reporting

Skills and tools covered

Threat-informed defenceDetection engineeringCloud security assuranceIdentity securityIncident commandVulnerability prioritisation

Tools and standards

MITRE ATT&CK, NIST Cybersecurity Framework 2.0, NIST SP 800-61r3, OWASP ASVS

How the course runs

Training methodology

The course uses short instructor briefings to establish methods, followed by cases drawn from financial services, public services, multinational operations and cloud-based products. Participants analyse attack paths, review architecture decisions, prioritise vulnerabilities, interpret security telemetry and make containment choices during incident simulations. Group work tests alternative control designs and reporting approaches. Individual application planning connects the methods to each participant's current responsibilities, security backlog and stakeholder environment.

Requirements and prerequisites

Participants should have practical experience in IT, cloud, infrastructure, software delivery, security operations or technology risk. They should understand common security concepts including authentication, firewalls, vulnerability management, logging, encryption and incident response. Familiarity with Windows or Linux administration, cloud services, SIEM platforms or security governance is useful. This is not an entry-level cybersecurity course. Programming, malware reverse engineering, penetration-testing certification and prior experience with every named framework are not required.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants should already understand core security and IT concepts and have professional exposure to infrastructure, cloud, security operations, software delivery or technology risk. The course builds on that foundation and focuses on advanced decision methods rather than introductory terminology.

Bring a laptop for online materials and group analysis, plus examples of security challenges you can discuss without sharing sensitive information. No specialist security software, coding environment or lab equipment is required.

The course is intended for experienced security managers, architects, senior analysts, cloud security engineers, infrastructure managers and technology risk professionals. It is suitable for professionals who influence security design, detection, remediation or incident decisions.

This course focuses on building and governing defences: architecture, identity, cloud controls, detection engineering, response and prioritisation. It examines attacker techniques to improve controls, but it does not teach exploit development, tool-led penetration testing or malware reverse engineering.

Participants can use the templates and methods to review an attack path, improve a SIEM use case, rank vulnerability remediation, assess privileged access or update an incident procedure. The 90-day application plan identifies priorities, owners and measures for the participant's own environment.

Each day runs from 08:30 to 16:30 and provides about 6.5 contact hours, excluding breaks. The five days progress from threat-informed architecture and identity through cloud, application security, detection, intelligence, incident response, exposure management and governance.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

Related courses in Cyber Security