MODULE 1
Module 1: Start With the Decision
Learn what intelligence is, who uses it, and how to frame a useful requirement before collecting information.
FREE COURSE / SELF-PACED LEARNING
Cyber Intelligence Foundations
Build a foundation in intelligence questions, evidence and analysis with this free cyber intelligence course.
Read freely. Create an account to save your completed lessons.
- Experience level
- Beginner
- Curriculum
- 6 modules · 16 lessons
- Estimated reading
- 51 min
- Language
- English
Reading estimates use lesson text and an allowance for diagrams. Reflection, exercises and optional linked resources take additional time. These are estimates, not measured completion times.
KNOW WHAT YOU’RE WORKING TOWARD
What you’ll learn
- Explain how data, information, intelligence, and decisions differ in a defensive security workflow.
- Turn a stakeholder concern into a specific intelligence requirement with a decision, audience, and timeframe.
- Collect and evaluate public evidence while recording provenance, limitations, and confidence.
- Analyze adversary behavior, infrastructure, and indicators without overstating attribution or certainty.
- Produce a concise intelligence assessment that separates observations, judgments, implications, and recommended actions.
Is this the right course for you?
Who it’s for
Learners beginning intelligence-led security work.
Scope and boundaries
Foundational intelligence concepts. More specialized CTI courses develop evidence evaluation, operational investigations and strategic decisions.
How you’ll learn
Self-paced reading with explanatory diagrams and linked resources. Reflection and optional resource study take additional time.
Before you begin
- Basic security vocabulary — You should be comfortable with terms such as asset, vulnerability, authentication, malware, log, and incident. No programming or prior intelligence experience is required.
About this course
Cyber Intelligence Foundations is a step-by-step course for learners who want to understand how useful security intelligence is made. You will move from vague threat awareness to clearly framed intelligence questions, lawful evidence collection, source evaluation, structured analysis, and concise reporting for real decision-makers.
The course uses a fictional organization and realistic defensive scenarios so you can practice without needing privileged systems or sensitive data. Each lesson adds one capability to the previous lesson. By the end, you will produce a short intelligence assessment that states what is known, what is uncertain, why it matters, and what a defender should do next.
FOLLOW THE LEARNING PATH
Course curriculum
MODULE 2
Module 2: Build an Evidence Base
Learn how to collect lawful public information, evaluate sources, and organize evidence so another analyst can reproduce your reasoning.
MODULE 3
Module 3: Analyze, Report, and Improve
Apply structured reasoning to adversary behavior and indicators, then communicate a concise assessment with actionable next steps.
- Describe Adversary Behavior Without OverclaimingUse behavior, capability, and context to explain threats without treating attribution as certainty.3 min reading
- Indicators of Compromise and Their TypesLearn what an IoC is, how common IoC types differ, and why context determines whether an indicator is useful.4 min reading
- Use Indicators With ContextUnderstand what domains, IPs, hashes, and patterns can tell you, and what they cannot prove alone.3 min reading
- Write and Review a Decision-Ready AssessmentAssemble evidence into a concise report that states the judgment, confidence, implications, and next actions.3 min reading
MODULE 4
Module 4: Turn Intelligence Into Better Defense
Move from a finished assessment to a bounded defensive workflow, measurable outcomes, and a maintenance plan that keeps intelligence useful after publication.
- Build a Bounded Defensive HuntTurn an intelligence judgment into a testable hunt hypothesis with known telemetry, limits, and an escalation path.4 min reading
- Keep Intelligence Useful Over TimeAdd freshness, ownership, feedback, and review triggers so intelligence does not become stale background noise.3 min reading
MODULE 5
Module 5: Apply Intelligence to Common Security Problems
Apply the foundation workflow to vulnerability exposure, identity-driven social engineering, and malware or ransomware activity without losing evidence discipline.
- Build Vulnerability Intelligence That Prioritizes ActionCombine vulnerability facts, exposure, exploitation evidence, and business impact to support a defensible remediation priority.4 min reading
- Analyze Identity and Social-Engineering ThreatsInvestigate phishing and account abuse as behavior chains rather than isolated messages or login events.3 min reading
- Analyze Malware and Ransomware ActivityDescribe malware behavior, delivery, impact, and defensive relevance without treating a family label as the whole assessment.3 min reading
MODULE 6
Module 6: Operate Intelligence as a Capability
Build the habits that make an intelligence function dependable: stakeholder alignment, information governance, structured sharing, and safe automation.
- Work With Stakeholders and Decision-MakersBuild trust by translating stakeholder concerns into useful requirements and communicating intelligence at the right level of detail.3 min reading
- Govern Intelligence and Handle Information ResponsiblyApply classification, access, retention, provenance, and privacy principles to intelligence work.3 min reading
- Share Structured Intelligence and Automate SafelyUse structured formats and automation to scale intelligence while preserving context, validation, and human accountability.3 min reading
BUILD ON THE RIGHT FOUNDATION
Related learning paths
These courses address different scopes. Choose the foundation or follow-on that fits your next question.
Sources and editorial review
Reviewed by Threat Intelligence Lab
Sources linked in the lessons provide context and further reading. Check the original documentation for current platform behavior and requirements.
- NIST Cybersecurity Framework 2.0
- CISA Cybersecurity Advisories
- NIST SP 800-150 Guide to Cyber Threat Information Sharing
- CISA Known Exploited Vulnerabilities Catalog
- MITRE ATT&CK
- MITRE ATT&CK Groups
Selected references are shown here; the lessons contain the full reading lists.
About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.