FREE COURSE / SELF-PACED LEARNING

Cyberwarfare: From Statecraft to Operations

Explore cyber power, campaign analysis, authority, resilience and evidence-led decisions in this free cyberwarfare course.

Read the first lesson Explore the curriculum

Read freely. Create an account to save your completed lessons.

Experience level
Advanced
Curriculum
12 modules · 28 lessons
Estimated reading
1 hr 48 min
Language
English

Reading estimates use lesson text and an allowance for diagrams. Reflection, exercises and optional linked resources take additional time. These are estimates, not measured completion times.

KNOW WHAT YOU’RE WORKING TOWARD

What you’ll learn

  • Distinguish cybercrime, espionage, influence, offensive cyber operations, and cyber warfare by objective, authority, context, and effect.
  • Analyze a state or state-aligned cyber campaign as a system of ends, ways, means, dependencies, partners, risks, and observable outcomes.
  • Produce a defensible multi-source attribution assessment that separates technical linkage, actor identity, sponsorship, and state responsibility.
  • Design a notional cyber campaign and target-development process with explicit legal, civilian-harm, intelligence-gain-or-loss, escalation, and operational-security controls.
  • Evaluate intended, unintended, direct, indirect, and cross-border effects across enterprise, cloud, telecommunications, space, and operational-technology systems.
  • Build a daily defensive operating rhythm that converts strategic warning and adversary behavior into hunting, hardening, response, continuity, and partner action.
  • Assess campaign performance with measures that distinguish task completion, technical effect, operational effect, and strategic outcome.
  • Brief senior decision-makers on cyber options, uncertainty, proportionality, reversibility, escalation, resilience, and viable alternatives.

Is this the right course for you?

Who it’s for

Security and intelligence learners examining the relationship between cyber activity, strategy and operational decisions.

Scope and boundaries

An analytical learning path covering historical cases and decision frameworks. It does not authorize operations or replace legal advice.

How you’ll learn

Self-paced reading with explanatory diagrams and linked resources. Reflection and optional resource study take additional time.

About this course

Cyberwarfare is not hacking with a flag attached. It is the use of digital access, information, people, infrastructure, authorities, and timing to create strategic or military advantage. This course teaches students to connect those parts. It begins with the nature of cyber power, follows the evolution of operations from Estonia and Stuxnet to Ukraine, and then develops the judgment needed to plan, support, defend against, and assess operations in daily practice.

The course is written for cyber threat intelligence analysts, military and government cyber personnel, incident responders, security leaders, red and purple team members, and defenders preparing for advanced work. It is self-contained: the opening lessons establish the networking, identity, cloud, logging, intelligence, incident-response, authorization, and ethical foundations used throughout the later modules. Offensive operations are then treated seriously: students study target systems, access stewardship, operational infrastructure, effects, coordination, operational security, and assessment. The course does not provide malware, exploit code, credentials, or a turnkey intrusion recipe. Its purpose is professional decision-making under lawful authority.

Real cases remain the spine of the journey. Estonia, Georgia, Stuxnet, the Ukrainian power-grid attacks, NotPetya, Olympic Destroyer, the SolarWinds compromise, Operation Glowing Symphony, Viasat KA-SAT, the wartime campaign in Ukraine, Volt Typhoon, and the Salt Typhoon telecommunications campaign are examined for what they reveal—and for what the public record cannot establish. Sources are dated and linked. A final capstone asks the learner to build and challenge an integrated cyber campaign while protecting civilians, intelligence equities, partners, and the mission.

FOLLOW THE LEARNING PATH

Course curriculum

MODULE 1

Entering the Cyber Battlespace

This self-contained entry module first builds the technical, analytic, incident-response, authorization, and ethical foundations required for professional practice. It then replaces the image of cyberwar as isolated hacking with a disciplined model of cyber power, connecting technical action to missions, institutions, people, and national purpose.

  1. Digital Systems as Mission TerrainLearn how packets, names, identities, hosts, cloud services, telemetry, and controls combine to produce a mission service.6 min reading
  2. Evidence, Threat Intelligence, and Incident ResponseLearn to read advisories critically, distinguish observables from behavior, express uncertainty, and connect intelligence to response decisions.6 min reading
  3. Authorization, Ethics, and Safe PracticeEstablish authority, scope, rules of engagement, civilian and mission safeguards, data handling, and stop conditions before practical work.6 min reading
  4. What Cyberwarfare Is—and Is NotBuild a precise vocabulary for conflict, competition, espionage, crime, influence, and operations in cyberspace.7 min reading
  5. Cyberspace as an Operational EnvironmentMap physical infrastructure, logical relationships, identities, missions, ownership, geography, and time as one battlespace.6 min reading

MODULE 2

The Road to Persistent Cyber Conflict

Case history becomes useful when it reveals recurring mechanisms. This module follows cyber operations from politically charged disruption through industrial sabotage and into sustained wartime campaigning. Students compare what was observed, what was attributed, what changed afterward, and which popular lessons outrun the evidence.

  1. Estonia, Georgia, Stuxnet, and the First ShockStudy three early cases that changed thinking about disruption, combined operations, attribution, and cyber-physical effect.4 min reading
  2. Ukraine, 2015–2026: Campaigning Under FireFollow a decade of power disruption, destructive malware, satellite effects, espionage, influence, adaptation, and resilience.4 min reading

MODULE 3

Actors, Proxies, and Strategic Behavior

State cyber power is produced by institutions, contractors, vendors, criminals, volunteers, and infrastructure—not by a single monolithic “APT.” This module teaches learners to model control relationships, compare strategic behavior, and avoid treating nationality or tool overlap as doctrine.

  1. The State Cyber EcosystemMap services, military units, contractors, criminals, hacktivists, vendors, and access brokers as distinct relationships.4 min reading
  2. Strategic Cultures Without StereotypesCompare Russian, Chinese, Iranian, North Korean, US, UK, and allied behavior through observed missions and constraints.4 min reading

MODULE 4

Law, Authority, and Civilian Protection

Cyber operations do not occur in a legal vacuum. This module gives non-lawyers an operational issue-spotting method for peacetime international law, domestic authority, state responsibility, use of force, armed conflict, and international humanitarian law. It emphasizes early legal integration and the protection of civilians, civilian data, and shared infrastructure.

  1. Below Armed Conflict: Sovereignty, Intervention, Force, and ResponsibilityNavigate the legal questions that shape access and effects before international humanitarian law applies.4 min reading
  2. Armed Conflict: IHL and Cyber EffectsApply distinction, proportionality, precautions, necessity, and humanity to interconnected digital systems.4 min reading

MODULE 5

Intelligence, Indications, and Attribution

Operations depend on intelligence before, during, and after action. This module turns policy questions into collection, develops layered attribution, and treats deception, source protection, and uncertainty as operational constraints.

  1. Intelligence Support to Cyber OperationsConvert commander questions into collection that supports access, effects, protection, assessment, and warning.3 min reading
  2. Attribution Under DeceptionReason from artifacts to operators and sponsors while resisting false flags and pressure for certainty.3 min reading

MODULE 6

Campaign Design and Command

This module turns strategy into executable, governed action. Learners build a theory of success, integrate cyber with other instruments, and design command, approval, deconfliction, partner, and operational-security processes that can function at real tempo.

  1. From Policy Aim to Cyber CampaignTranslate strategy into objectives, effects, actions, sequencing, alternatives, and a testable theory of success.3 min reading
  2. Command, Authorities, and DeconflictionDesign decision rights and coordination that survive global infrastructure, partner equities, and operational tempo.3 min reading

MODULE 7

Target Systems, Access, and Operational Security

Offensive competence begins with understanding the system that produces an adversary function, then stewarding access as a finite operational asset. This module covers target-system analysis, access lifecycle, capability fit, infrastructure, exposure, and safe exercise practice without deployable intrusion procedures.

  1. Target-System Analysis and Cyber Key TerrainFind the function, dependencies, control points, observability, and recovery paths behind a target label.3 min reading
  2. Access Stewardship, Capability Fit, and OPSECManage access and capabilities as finite assets subject to discovery, decay, interference, and policy.3 min reading

MODULE 8

Effects Engineering and Campaign Assessment

Effects must be bounded, observed, and connected to objectives. This module compares collection, denial, degradation, manipulation, destruction, and cognitive effects, then builds assessment from measures of performance through strategic outcomes.

  1. Designing and Bounding Cyber EffectsMatch effect type, scope, duration, reversibility, observability, and risk to the mission objective.3 min reading
  2. Measuring What the Campaign ChangedSeparate activity, technical effect, operational effect, strategic outcome, and unintended consequence.3 min reading

MODULE 9

Critical Infrastructure and Cross-Domain Operations

Digital action can affect power, water, transport, communications, space services, logistics, and weapons. This module teaches IT/OT and satellite-system reasoning, safety, manual operations, and the integration of cyber effects with physical maneuver and the electromagnetic spectrum.

  1. Operational Technology, Safety, and RestorationUnderstand how industrial processes, control, safety, engineering, and human operators determine physical consequence.3 min reading
  2. Space, Telecommunications, and Multi-Domain IntegrationConnect satellite, carrier, cloud, spectrum, physical, and cyber dependencies to maneuver and command.3 min reading

MODULE 10

Influence, Perception, and Public Truth

Cyber operations can acquire, alter, deny, and release information to shape behavior. This module examines hack-and-leak operations, false flags, DDoS theater, narrative laundering, synthetic media, and the defensive combination of forensics, communication, and public trust.

  1. Cyber-Enabled Influence OperationsFollow stolen or fabricated material from acquisition through framing, laundering, amplification, and audience response.3 min reading
  2. Defending Truth, Trust, and Decision SpaceIntegrate incident response, verification, audience analysis, leadership, legal review, and communication.3 min reading

MODULE 11

Daily Defence in Competition and War

Wartime cyber defence is a sustained operating rhythm, not an emergency checklist. This module integrates mission assurance, threat intelligence, attack-surface reduction, hunting, incident command, evidence, continuity, recovery, partners, and learning.

  1. Mission Assurance and the Wartime Operations FloorOrganize intelligence, defence, engineering, command, communications, and partners around mission risk.3 min reading
  2. Continuity, Recovery, and Collective DefenceKeep essential missions operating through degraded modes, clean recovery, external support, and repeated attack.3 min reading

MODULE 12

Deterrence, Emerging Change, and the Final Campaign

The final module moves from national and alliance strategy into the 2026 operating environment and then requires full synthesis. Learners assess deterrence and norms, examine AI and supply-chain change without hype, and complete a governed campaign capstone from requirement through lessons learned.

  1. Deterrence, Norms, and Collective ResponseBuild credible response portfolios when attribution, thresholds, signaling, and adversary values vary.3 min reading
  2. The 2026 Horizon: AI, Supply Chains, Edge, and IdentityIntegrate the newest evidence into operations without mistaking novelty for strategic change.3 min reading
  3. Capstone: Build, Challenge, and Defend a Cyber CampaignSynthesize strategy, intelligence, law, targeting, access, effects, command, defence, assessment, and communication.5 min reading

Sources and editorial review

Reviewed by Threat Intelligence Lab

Sources linked in the lessons provide context and further reading. Check the original documentation for current platform behavior and requirements.

Selected references are shown here; the lessons contain the full reading lists.

About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.