Mandiant Academy™

Course Catalog

Mandiant Academy courses address essential cyber security skills that use free, open-source or existing customer technologies. 

Course listings

The Mandiant Academy courses in this catalog address essential cyber security skills that use free, open-source or existing customer technologies.

Instructor-led training

Instructor-led training is presented by a live instructor, either in-person or via a virtual classroom. Instructor-led training includes hands-on labs designed to accelerate learner acquisition of practical skills.

All of our instructors are security professionals with years of security experience working on the frontlines of major cyber incidents around the world.

The duration of a single instructor-led training course can range from a half-day to five days.

Web-based training

Web-based training (WBT) are self-paced, on-demand online courses that can be accessed at any time, from any location. Learners may pause and resume training as their schedule allows.

Our web-based training is designed to work in modern desktop browsers (Chrome, Firefox, Safari, and Microsoft Edge) and tablets (such as iPad) without the use of browser plugins. Technology needs and exceptions are noted in course descriptions when applicable.

The duration of a web-based training course can range from a half-day to four days of content.

Experiential learning

Experiential learning uses a hands-on approach that recreates
a network compromise situation and provides a holistic incident response experience. A cyber simulation range provides
a consequence-free environment where participants are challenged to respond as a team to the latest advanced persistent threat (APT) attack methodologies.

The ability to expose teams to nation-state level attacks within a cyber range allows them to learn, practice, and innovate without experiencing an actual compromise. Experiential learning connects the training environment to the operating environment, which allows leadership to assess team performance and get an honest assessment of team readiness against relevant threats.

Advanced Acquisition and Testing Techniques Courses

Delivery Methods by Course


Onsite ILT: An onsite instructor-led course delivered at your organization’s office.

Offsite ILT: An offsite instructor-led course delivered at a third-party location.

Virtual ILT: A virtual (online) instructor-led course delivered exclusively to your organization.

Web-based training: A web-based (also on-demand or self-paced) training course accessible to your organization anytime, anywhere.

Public ILT: A public instructor-led course delivered at a Mandiant office or third-party classroom. It may include attendees from many different organizations.

Public VILT: A public virtual (online) instructor-led course which may include attendees from many different organizations.

CourseOnsite ILTOffsite ILTVirtual ILTWeb-Based TrainingPublic ILT (per seat)Public VILT (per seat)
Advanced Red Teaming Techniques: Malware Authoring and Repurposingxx    
Advanced Topics in Malware Analysisxx    
Advanced Windows Enterprise Incident Responsexx    
Business Email Compromisexxx   
Combined Windows-Linux Enterprise Incident Responsexx    
Creative Red Teamingxxx xx
Cyber Intelligence Foundationsxxxxxx
Cyber Intelligence Production   x  
Cyber Security Program Fundamentalsxxx   
Essentials of Malware Analysis   x  
Fundamentals of Cyber Securityxxx   
Fundamentals of Industrial Control Systems (ICS) Securityxxx xx
Incident Response for Everyonexxx xx
Inside the Mind of an APT   x  
Intelligence Research I—Scoping   x  
Intelligence Research II—Open Source Intelligence (OSINT)   x  
Introduction to Cyber Crime for Executivesxxx   
Introduction to the Mandiant Security Instrumentation Platformxxx   
Introduction to Threat Intelligence and Attributionxxx xx
Linux Enterprise Incident Responsexxx xx
Malicious Documents Analysisxxx xx
Malware Analysis Crash Coursexxx xx
Malware Analysis Fundamentalsxxx   
Network Traffic Analysisxxx xx
Practical Mobile Application Securityxx    
Practical Threat Huntingxxx xx
ThreatSpace: Real-World Attack Scenariosxxx   
Windows Enterprise Incident Responsexxx xx

Private Training Courses

Instructor-led courses delivered on-premise or remotely to one dedicated organization (supports up to 20 students). Choose from 30+ courses from our Course Catalog.

On-Demand Training Courses

Interactive, self-paced cyber threat intelligence training for individual security practitioners from the comfort of your home.

ThreatSpace™ Cyber Range

Experiment with real-world attack scenarios to rehearse and refine incident response in a consequence-free environment.

Public Training Courses

Instructor-led courses delivered remotely to individual security practitioners or small groups from various organizations.


Know that your security team can handle whatever comes their way – keeping your business safe and secure in today’s evolving threat landscape.

Learning Pass

Stay ahead of threats through a culture of continuous learning with a Learning Pass for your security team. Provides access to all scheduled Public and On-Demand Training.