Security Studies and Strategic Intelligence Training Course

Duration 5 days 10 modules · 33 contact hours
Level Advanced Certificate on completion
Who attends Senior Intelligence Analysts, Security and Risk Managers and others
Fee from USD 1,100 KSh 95,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 7 Nov 2026 Course code SD-SLE-002

Before you join: Participants should have professional experience in security, intelligence, law enforcement, defence, risk, investigations, emergency management or a related public-sector role.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Security and law-enforcement leaders face a recurring problem: converting incomplete reporting, technical data, community intelligence and partner information into defensible decisions. Threats may involve organised crime, terrorism, civil unrest, hostile state activity, cyber-enabled harm, insider risk or disruption to critical services. Poorly framed requirements, untested assumptions and weak dissemination can produce missed warning, wasted collection effort, unlawful intrusion or decisions based on confidence that evidence does not support.

This advanced course examines security studies, strategic intelligence and intelligence-led operations as connected disciplines. Participants assess security problems through national interests, threat actors, vulnerabilities and risk; set priority intelligence requirements; design collection plans; test competing explanations; and produce warning indicators. The course also addresses intelligence-led policing, network analysis, critical infrastructure protection, crisis intelligence, human rights, privacy, information handling and executive briefing. Named methods include the National Intelligence Model, Analysis of Competing Hypotheses, bow-tie analysis, PESTLE, ISO 31000 and ISO 22301.

Instruction combines short technical briefings with realistic cases drawn from public safety, border management, critical infrastructure, financial crime and emergency response. Participants work through intelligence requirements, source assessment, threat prioritisation, structured analysis and decision support under time pressure. They leave with a reusable strategic intelligence planning pack containing a requirements matrix, collection plan, threat and risk register, warning indicators, analytic confidence statement and senior-leader briefing structure.

The course is suited to experienced personnel who contribute to intelligence, security planning, risk management, investigations, protective security or crisis coordination. It is especially relevant where participants must brief senior officials, coordinate multiple agencies or convert operational information into strategic warning and policy options.

What you will be able to do

  • Assess security problems using levels-of-analysis, DIMEFIL and ISO 31000 terminology
  • Define priority intelligence requirements through decision-focused requirements matrices
  • Design collection plans using source validation, access assessment and handling controls
  • Produce threat assessments using bow-tie analysis, attack trees and criticality scoring
  • Test intelligence judgments using Analysis of Competing Hypotheses and assumptions checks
  • Develop early-warning indicators, thresholds and escalation actions for emerging threats
  • Apply legal, privacy, human-rights and evidential controls to intelligence activity
  • Brief senior decision-makers using confidence statements, BLUF writing and decision options

Benefits of attending

For you

  • Produce defensible intelligence judgments with explicit confidence and evidence limits
  • Frame senior-leader questions as priority intelligence requirements
  • Recognise analytic bias before it distorts threat and warning assessments
  • Apply proportionate privacy, human-rights and information-handling safeguards
  • Present concise intelligence estimates that support time-critical decisions

For your organisation

  • Improved prioritisation of collection effort against material security threats
  • Earlier warning of emerging risks through defined indicators and thresholds
  • More consistent threat assessments across security, intelligence and operational teams
  • Reduced legal and reputational exposure from poorly controlled intelligence activity
  • Clearer decision support for executives during incidents and strategic planning

Course modules

10 modules over 5 days

Participants can frame a security problem using strategic interests, referent objects and levels of analysis.

  • National security objectives linked to political, economic, social and environmental interests
  • Security studies traditions: realist, liberal, constructivist and human security perspectives
  • Levels-of-analysis framework distinguishes individual, state, regional and system drivers
  • Referent objects and securitisation theory identify contested security claims
  • Threat, hazard, vulnerability and risk distinguished using ISO 31000 terminology
  • National power assessed through DIMEFIL instruments and strategic constraints
  • Strategic culture explains enduring assumptions shaping intelligence requirements and decisions

Participants can convert decision needs into prioritised intelligence requirements and collection plans.

  • Intelligence cycle: direction, collection, processing, analysis, dissemination and feedback
  • Requirements matrix converts decision questions into priority intelligence requirements
  • Key intelligence questions framed with decision, indicator, threshold and deadline
  • Collection plans match HUMINT, OSINT, SIGINT, GEOINT and MASINT sources
  • Source validation records access, placement, motivation, reliability and corroboration
  • Intelligence gaps ranked by consequence, uncertainty, collection feasibility and urgency
  • Dissemination protocols assign classification, recipients, handling caveats and release authority

Participants can build a prioritised threat assessment that connects adversary pathways with protective controls.

  • Threat assessment separates intent, capability, opportunity, targeting and attack indicators
  • All-hazards risk register records likelihood, consequence, controls and ownership
  • Risk matrices tested against uncertainty, aggregation errors and decision tolerance
  • Bow-tie analysis maps preventive barriers, escalation factors and recovery controls
  • Attack trees model adversary pathways against people, assets and systems
  • Criticality scoring prioritises infrastructure dependencies, single points and service consequences
  • Scenario-based planning tests low-probability, high-impact security disruption consequences

Participants can test intelligence judgments systematically and communicate justified confidence levels.

  • Structured analytic techniques counter anchoring, mirror imaging and confirmation bias
  • Analysis of Competing Hypotheses tests evidence against alternative explanations
  • Key Assumptions Check exposes fragile judgments and missing evidence
  • Indicators and warnings matrices track observable change against baseline conditions
  • Red teaming challenges friendly assumptions, adversary incentives and operational blind spots
  • Devil's advocacy separates evidential disagreement from policy preference
  • Confidence statements distinguish source quality, analytic agreement and remaining uncertainty

Participants can apply intelligence-led policing methods to priority crime and harm problems.

  • Intelligence-led policing aligns priorities, tasking, coordination and assessment under NIM
  • Problem profiles combine crime patterns, harm, offenders, victims and locations
  • Network analysis identifies brokers, clusters, centrality and communication vulnerabilities
  • Crime scripting maps preparation, execution, escape and monetisation stages
  • Link charts distinguish associations, transactions, communications and evidential status
  • Repeat victimisation analysis directs prevention toward recurring targets and patterns
  • Interagency deconfliction prevents duplicate collection, compromised operations and unsafe contact

Participants can apply lawful, proportionate and accountable controls to intelligence activity.

  • Legal authorities define collection powers, retention limits, oversight and remedies
  • Necessity, proportionality and legality tests govern intrusive intelligence activity
  • Human rights impact assessments document interference, safeguards and residual risk
  • Privacy-by-design controls minimise personal data access, sharing and retention
  • Handling codes protect classified material, personal data and operational sources
  • Chain-of-custody records preserve evidential integrity from seizure through disclosure
  • Ethical decision model weighs public interest, harm, alternatives and accountability

Participants can design strategic warning systems that connect emerging signals to protective action.

  • Horizon scanning identifies weak signals, drivers, uncertainties and emerging threats
  • PESTLE analysis structures political, economic, social, technological, legal and environmental drivers
  • Scenario axes create plausible futures from critical uncertainties and predetermined trends
  • Early-warning indicators specify baselines, trigger thresholds, owners and reporting cadence
  • Signpost monitoring updates assumptions as adversary behaviour and context change
  • Strategic warning products state probability, impact, timing and confidence
  • Escalation thresholds connect warning indicators to pre-agreed protective actions

Participants can assess critical-service threats, dependencies and protective security priorities.

  • Critical infrastructure interdependency mapping identifies cascading failures across essential services
  • Protective security surveys assess physical, personnel, information and cyber exposures
  • Converged threat assessments connect cyber incidents, insider risk and physical access
  • Insider threat indicators balance behavioural concern, privacy safeguards and reporting routes
  • ISO 22301 continuity priorities link critical functions, recovery objectives and dependencies
  • Resilience measures distinguish prevention, absorption, recovery and adaptation capacities
  • Public-private information sharing addresses trust, classification and legal constraints

Participants can organise intelligence support for crisis decisions and multi-agency coordination.

  • Crisis intelligence cells establish roles, tasking rhythms, logs and decision support
  • Common operating pictures integrate validated incidents, resources, impacts and forecasts
  • Incident Command System principles clarify command, coordination and information functions
  • Situation reports separate confirmed facts, assessment, gaps, actions and forecasts
  • Collection retasking responds to changing priorities, access constraints and misinformation
  • Risk communication messages state protective action, uncertainty and authoritative sources
  • After-action reviews capture decisions, outcomes, lessons and corrective actions

Participants can produce concise strategic intelligence products for senior decision-makers.

  • Executive intelligence estimates open with judgments, confidence and decision implications
  • BLUF writing presents the bottom line before supporting evidence
  • Argument maps connect claims, evidence, assumptions, alternatives and confidence
  • Visualisation choices match trend, network, geospatial and temporal intelligence questions
  • Briefing structures anticipate challenge, explain uncertainty and specify decision options
  • Intelligence requirements review aligns products with senior decision calendars
  • Personal application plan assigns first actions, sponsors, measures and review dates

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Priority intelligence requirements matrix
  2. Strategic collection planning template
  3. Threat and vulnerability risk register
  4. Structured analytic techniques checklist
  5. Early-warning indicators and escalation plan
  6. Executive intelligence estimate template

Who should attend

  • Senior Intelligence Analysts — need defensible strategic judgments and warning products
  • Security and Risk Managers — need to prioritise threats, vulnerabilities and protective controls
  • Law Enforcement Commanders — need intelligence-led priorities and coordinated tasking
  • National Security Officials — need decision-ready assessments for policy and resource choices
  • Critical Infrastructure Security Leaders — need to assess dependencies, disruption and resilience
  • Crisis Management Coordinators — need timely situation reporting and intelligence support

Skills and tools covered

Strategic intelligence planningThreat assessmentStructured analytic techniquesIntelligence-led policingEarly warning designExecutive intelligence briefing

Tools and standards

National Intelligence Model, Analysis of Competing Hypotheses, ISO 31000, ISO 22301

How the course runs

Training methodology

The course uses short instructor briefings to establish doctrine, methods and terminology, followed by case-based analysis in small groups. Participants assess intelligence reporting, set requirements, compare hypotheses, develop warning indicators and prepare executive products. Simulations introduce competing demands, uncertain evidence, partner coordination and time pressure. Facilitated reviews focus on the quality of judgments, legal safeguards and communication choices. Each participant completes an application plan linking course methods to a current security or intelligence responsibility.

Requirements and prerequisites

Participants should have professional experience in security, intelligence, law enforcement, defence, risk, investigations, emergency management or a related public-sector role. They should be comfortable reading incident reports, assessing evidence and contributing to operational or management discussions. Familiarity with their own organisation's reporting, classification and legal arrangements is helpful. The course does not require prior study of intelligence theory, statistics, cyber forensics, military service or access to classified material. It is not an entry-level introduction to security work.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

This is an advanced course for personnel with experience in security, intelligence, law enforcement, risk, investigations or crisis management. Participants should understand basic reporting and evidence assessment, but do not need prior formal intelligence training.

Bring a non-sensitive example of a current security, intelligence or risk problem that you are permitted to discuss. A laptop is useful for building templates and notes, but it is not mandatory.

It is designed for analysts, security managers, law-enforcement commanders, national security staff, critical infrastructure leaders and crisis coordinators. It is most useful for people who brief decision-makers or set intelligence priorities.

Operational intelligence courses commonly focus on case development, surveillance, source handling or investigative procedures. This course concentrates on strategic assessment, warning, risk prioritisation, governance and executive decision support.

Participants can use the requirements matrix, collection plan, threat register and warning indicators on an active planning issue. The executive estimate structure can also improve existing briefing papers and situation reports.

The course provides about 32.5 contact hours from 08:30 to 16:30 each day. Time is organised around ten modules, with briefings, case analysis, group work, simulations, review and individual application planning.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

Related courses in Security & Law Enforcement