Mandiant On-Demand Cyber Intelligence Courses

Get the training needed to proactively track and mitigate the threats that matter.

If you have any additional questions, send us an email

Female and Male in Office at Computer

Turn Intelligence Into Action to Respond to Threats Effectively and Efficiently

Mandiant On-Demand Cyber Intelligence Training is a cost-effective way to empower cyber security teams to effectively use intelligence across various job roles and skill levels. Courses include videos led by Mandiant subject matter experts and practitioners, written text, and interactive assessments.

Course Offerings

The Mandiant On-Demand Cyber Intelligence Training courses are designed to help producers and consumers of intelligence better craft and interpret intelligence reporting, to make sure intelligence leads to action. Each course incorporates real-world intelligence reporting and scenarios drawn from our frontline expertise. Content can be accessed 24x7 from a standard web browser, with no downloads required.

Each course has between 8 and 24 hours of content and aligns to a different phase of the Intelligence Lifecycle. Currently-available courses include Cyber Intelligence Foundations (CIF), Intelligence Research I (Scoping) and Intelligence Research II: Open Source Intelligence (OSINT) Techniques and Tools. New courses will be added quarterly.

Cyber Intelligence Foundations

Description: A foundational survey course that introduces the field of cyber intelligence.  All subsequent courses reinforce concepts introduced here. This course explains how to apply the discipline of intelligence analysis to the cyber domain. The course covers strategic subjects such as the organizational role of cyber threat intelligence (CTI) and stakeholder analysis, as well as analytic practitioner skills development topics, such as understanding the intelligence lifecycle, developing raw data into minimally viable intelligence, and an introduction to cyber intelligence attribution.

Duration: 24 hours

Cost: $3,000 or 3 EOD Units

Intelligence Research I: Scoping

Description: Aligns to Planning and Direction Phase of Intelligence Lifecycle.  Learn how to ask the right questions and identify relevant context to properly scope an RFI, assess sources and utilize a Research Management System. 

This foundational course teaches students to analyze, prioritize, and fully understand requests for information (RFIs), and create a research plan that keeps their efforts on track. Students will learn to uncover stakeholder intent so that their intelligence analysis can be actioned. They will gain the ability to fully interpret implicit and explicit RFIs by identifying relevant context from intelligence requirements, organizational threat profiles, and key stakeholder analysis. They will also learn how to use a research management system to organize research and avoid information overload, and assess source relevance and trust to ensure efficient and focused collections efforts.

Duration: 8 hours

Cost: $2,000 or 2 EOD Units

Intelligence Research II: Open Source Intelligence (OSINT) Tools and Techniques

Description: Aligns to Collection & Processing Phase of Intelligence Lifecycle. Learn how to leverage open source tools to identify and think critically about pivot points to drive investigations across multiple use cases. 

This foundational course teaches students to identify and develop pivot points or leads in investigations across multiple use cases. Students will review the basic functions of open source tools and learn when and why to use them in their research. They will apply their skills to several scenarios drawn from frontline experience, including executive-level RFIs, incident response investigations, and information operation campaigns. As they work through these scenarios in a lab environment, students will apply their knowledge of tools such as VirusTotal, Alienvault, PassiveTotal, and Facebook, and use advanced search engine techniques.

Duration: 16 hours

Cost: $2,000 or 2 EOD Units

Cyber Intelligence Production

Description: Aligns to Production & Dissemination Phase of Intelligence Lifecycle. Learn how to convey analytic assessments and findings in your intelligence reports and briefings.


This foundational course teaches students to convey analytic assessments and findings in their intelligence reports and briefings. Students will be asked to deconstruct intelligence reporting of varying qualities and designed for different stakeholders to identify author intent, methods, and findings. During these exercises, students will be exposed to various examples of strategic, operational, and technical intelligence products. Intelligence writing and briefing principles, including bottom line up front (BLUF), words of estimative probability (WEPs), and analytic judgments will all be introduced along with potential pitfalls. The course will also review best practices tied to citations, grammar, style, and peer review. It concludes with an opportunity for students to take provided data and generate an original intelligence product and corresponding briefing.

Duration: 8 hours

Cost: $2,000 or 2 EOD Units

Have Questions? Contact Us.

Mandiant experts are ready to answer your questions.