Learn how to create cyber intelligence, fight back the adversaries and win

MCSI Certification

MTIA - Certified Threat Intelligence Analyst

Cyber threat intelligence (CTI) is the process of identifying, detecting, analyzing, and responding to information security threats. CTI can help organizations protect themselves from cyberattacks by providing them with information about the latest threats and vulnerabilities.

Advanced cybersecurity teams prefer producing their own cyber threat intelligence rather than solely relying on industry products. It can be difficult to find a product that meets all their needs. It must integrate with their existing tools and processes, and provides the right level of detail and context.

This course is designed to help these advanced teams learn how to produce their own threat intelligence. In it, we teach sophisticated techniques that they can use to identify, investigate, and respond to APTs. By giving these teams the ability to produce their own threat intelligence, they will be able to better protect their organization from harm.

A Threat Intelligence Analyst who is MCSI qualified can conduct situational awareness assessments, gather intelligence, produce intelligence, and take offensive countermeasures. This individual is also capable of conducting hacking back operations.

This certification training is particularly designed for senior cyber operators who need to develop Defend Forward capabilities.

Intermediate Level MCSI Certification Intermediate
ic-certificate Certification
ic-clock 600+ hours
cpe-points 259
ic-money $450
No Expiry, No Renewals

Course Overview

This course will teach you how to produce threat intelligence. Identifying and tracking attack campaigns, as well as infiltrating and monitoring adversary infrastructure, are all part of this.

"You can't protect against what you can't see and understand."

Cyber threat intelligence (CTI) is the practice of understanding and combating cyber threats. It can involve gathering information about current and potential attacks, analyzing that information to identify patterns and trends, and sharing that information with other organizations in order to improve their security posture.

CTI is critical to the successful planning and implementation of national defense operations. The massive influx of data and the ever-changing nature of cyber threats requires timely and accurate intelligence to protect our nation's networks and critical infrastructure.

The goal of CTI is to identify the perpetrator of a cyberattack and to prevent them from attacking again. In order to achieve this goal, CTI relies on the use of sophisticated tools and techniques. These tools and techniques allow CTI experts to infiltrate the infrastructure of cyber attackers and to monitor their activities. This information can then be used to identify the victims of a cyberattack and to help protect them from future attacks.

MCSI's MTIA cyber intelligence course is designed to teach the most advanced methods of safeguarding nations against cybercrime and nation-state adversaries. The course was designed by seasoned professionals with deep experience in the field of cyber intelligence.

The MCSI Threat Intelligence certification will equip you with the skillset necessary to carry out the following tasks:

  • Understand an organization's exposure to cyber attacks and which threat actors may target it
  • Baseline enterprise assets and extract tactical and technical intelligence at scale
  • Identify malware infrastructure and track attack campaigns
  • Discover new threat actors and malware samples that could target organizations you defend
  • Safely probe, infiltrate and monitor adversary campaigns
  • Use Structured Analytics Techniques to attribute cyber attacks
  • Produce threat intelligence products such as reports, briefings and IOCs

Cyber threat intelligence analysts are some of the most in-demand professionals in the world of cybersecurity. They are essential for identifying, understanding, and mitigating cyber threats. Because of the high level of expertise and experience required for this role, cyber threat intelligence analysts can expect to earn a competitive salary.

Knowledge, Skills and Abilities You Will Acquire

MCSI is one of the most respected and trusted names in cyber security education and training. Our certifications teach critical skills, knowledge and abilities needed to advance a career in cyber security. Our courses are comprehensive and up-to-date, and our instructors are experienced professionals who are dedicated to helping students learn. MCSI provides the real-world skills and knowledge you need to protect any organization from cyber threats.

  • How to produce your own threat intelligence to support defensive cyber operations

    This course teaches you technical skills to produce your own threat intelligence. There are a few benefits to producing your own threat intelligence:

    • You can tailor the intelligence to your specific environment and needs.
    • You can develop a better understanding of how various threats work, and how to defend against them.
    • You can build relationships with other organizations who are also producing their own intelligence, so that you can share information and collaborate on defense.
    • You can develop "custom signatures" for your security devices which will help you more accurately identify targeted cyber attacks against the organizations you defend.

    Binary classification

    Binary classification is a technique used in malware analysis to determine whether a given sample is likely to be malware or not. It works by comparing the features of a sample against a database of known malware samples, and classifying the sample as either malware or not malware based on how similar it is to the known malware samples. Binary classification can be used to quickly and accurately determine whether a new sample is likely to be malware, which can help analysts to focus their efforts on more serious threats.

    Writing YARA rules

    One of the most important aspects of conducting cyber threat intelligence is being able to identify and track malicious files and activity. This is where YARA rules come in.

    YARA is a tool that allows you to create rules for identifying malware. These rules can be used to scan files and folders for evidence of malicious activity. YARA can also be used to create signatures for malware that can be used in detection and prevention systems.

    By writing YARA rules, you can improve your ability to detect and track malicious software.

    Data Science with Python Pandas

    Threat intelligence systems use data science techniques to analyze information from a variety of sources in order to identify malicious actors and prevent attacks. Python Pandas is a powerful data analysis toolkit that can be used for data science in threat intelligence. Pandas can be used to read and write data in a variety of formats, including csv, json, and excel. Pandas also provides a wide range of methods that you can use to get the information you need from your data.

    Memory forensics

    Memory forensics is the process of extracting forensic information from memory images. This information can then be used to create threat intelligence. This can include identifying malware infections, tracking users' activities, and identifying compromised systems.

    Malware Analysis

    Malware analysis is the process of examining software code or executables to identify malicious intent or actions. By understanding how malware works, security professionals can create threat intelligence that can help protect their networks and systems from attack. Threat intelligence can include information on specific threats, such as the malware families and variants involved, their methods of operation, and the potential impact on an organization. It can also include broader information on attackers, such as their tactics, techniques, and procedures (TTPs).

  • How to perform situational awareness assessments to identify an organization's current threat landscape

    Situational awareness is a key component of cyber threat intelligence. It allows organizations to understand their current environment and identify potential threats. By understanding the threats that are targeting their organization, they can better defend against them.

    Mapping Internet-facing assets

    Mapping your internet-facing assets is a critical step in building your cyber threat intelligence program. By understanding the assets that are exposed to the internet, you can more effectively identify and respond to cyber threats. Mapping your assets can help you answer important questions, such as:

    • Which assets are most at risk?
    • What are the most common attack vectors?
    • What are the most vulnerable parts of the network?
    • What is the potential impact of a cyber attack?

    Detecting phishing and spear-phishing campaigns

    Phishing and spear-phishing are two of the most common attacks used by cybercriminals. A phishing attack is an email or message that is sent to a user with the intention of getting them to click on a malicious link or open an infected file. A spear-phishing attack is a more targeted version of a phishing attack, where the email is sent to a specific individual or group of individuals.

    Detecting phishing and spear-phishing campaigns is important because it allows organizations to identify and protect their high-value employees and customers targeted by advanced threats.

    Detecting typo squatting

    Domain squatting is the act of registering a domain name with the intent of selling it to a legitimate party or using it for another malicious purpose. Typosquatting is a type of domain squatting that involves registering a domain name that is similar to a popular website in the hopes of confusing or luring visitors to the illegitimate site.

    Detection of typo squatting is an important part of CTI because it can help organizations identify malicious domains and IP addresses.

    Detecting information leaks

    Information leaks are a huge problem when it comes to cyber threat intelligence. If critical data is leaked, it can give hackers the information they need to launch an attack. This is why it is so important to detect any leaks as early as possible so that they can be fixed before they cause any damage.

    Leaks can happen in a number of ways, including through email, chat programs, and social media.

    Monitoring developers and system administrators

    Monitoring developers and system administrators is important in cyber threat intelligence because they are often the ones who are targeted by attackers. They can be targeted through phishing emails or malicious websites that exploit vulnerabilities in their systems. By monitoring their activity, we can detect these attacks and protect our networks from them.

  • How to perform enterprise investigations to identify threat actors that have breached the network

    When it comes to protecting your business from online threats, performing regular enterprise investigations is essential. By identifying and tracking down threat actors, you can reduce your risk of data breaches and other malware attacks. Additionally, investigating threats can help you better understand how cyber criminals are targeting your industry and what steps you need to take to stay ahead of them.

    Capturing and indexing forensics artefacts

    Forensics artefacts can play a critical role in cyber threat intelligence, providing insight into the tactics, techniques and procedures (TTPs) of attackers. By capturing and indexing these artefacts, organisations can improve their ability to detect and respond to threats.

    Forensics artefacts can include malicious files, email messages, network traffic and registry keys. By capturing and indexing these artefacts, organisations can build a database of TTPs that can be used to identify attacks and improve their defences.

    Baselining the enterprise network

    Baselining the enterprise network is a critical step in cyber threat intelligence. By creating a baseline of normal network activity, you can more easily identify any abnormalities that may be caused by a cyber attack. This can help you to quickly respond to any potential threats and protect your organization's data.

    Performing memory forensics at scale

    Memory forensics is much faster than traditional forensic methods. This is because the process of extracting data from a live system's memory is much faster than extracting data from a hard drive or other storage device.

    Memory forensics can provide a more complete view of the system than traditional forensic methods.

    By identifying and analyzing patterns in memory, analysts can quickly detect malicious activity and preventative action can be taken to stop potential attacks. Additionally, by scanning a large number of systems for threats, analysts can build a more complete picture of the types of threats faced by an organization and develop better defenses.

    Using Python Pandas to analyse large datasets

    Python Pandas is a popular library used for data analysis and scientific computing. It provides data structures and operations for working with labelled or relational data. Pandas can be used to analyse large datasets for cyber threat intelligence. The library can be used to filter and clean up data, explore and visualize data, and model and predict outcomes. Pandas is well suited for working with big data sets at incredible speed.

  • Use pivot analysis to identify, map and track adversary attack campaigns and infrastructure

    Pivot analysis is a technique used in threat intelligence to identify connections between seemingly unrelated data sets. This can be used to identify malicious actors or malware families that may not be identifiable through other methods. Pivot analysis can also be used to identify new threats that may not have been previously identified.

    Identifying adversary infrastructure

    When it comes to cyber threat intelligence, one of the most important aspects is being able to identify adversary infrastructure. If you can't track and monitor the activities of your adversaries, you won't be able to defend against their attacks. By identifying adversary infrastructure, you can develop a better understanding of their tactics, techniques, and procedures (TTPs). This allows you to create more effective countermeasures and protect your organization from these threats.

    Identifying malware source code

    Malware source code is one of the most important aspects of cyber threat intelligence. By identifying the source code of malware, analysts can better understand how the malware works, who created it, and where it is being used. This information can help organizations defend against and respond to attacks. Identifying the source code of malware is not always easy, but it is essential for understanding the full extent of a cyber threat.

    Tracking attack campaigns

    The importance of tracking attack campaigns in cyber threat intelligence cannot be overemphasized. By tracking attack campaigns, organizations can gain a better understanding of the tactics, techniques, and procedures (TTPs) being used by cyber adversaries. This information can then be used to improve security posture and protect against future attacks.

    Hunting for malware developers

    There are a few important reasons why it is important to identify malware developers in cyber threat intelligence. One reason is that it helps to understand the motivation behind the malware. For example, if a particular piece of malware is being used for cyberespionage, it would be helpful to know who developed the malware so that you can narrow down your search for the culprits.

    Another reason is that it can help you to develop countermeasures against the malware. If you know who created the malware, you can study their methods and develop defenses against them in the future.

  • How to use open-source intelligence techniques to augment your threat intelligence production

    Open-source intelligence (OSINT) is data that is available to the public and can be used to supplement your organization's threat intelligence. This data can come from a variety of sources, including social media, public websites, and government data sets.

    Using OSINT techniques can help you to better understand your threat landscape and identify potential threats that may not be included in your organization's threat intelligence. Additionally, using open-source data can help you to identify malicious actors and their techniques.

    Identifying newly deployed malware infrastructure

    When investigating a security incident, it is important to identify any newly deployed malware infrastructure. This is the infrastructure that the attackers use to launch their attacks. Tracking adversary infrastructure can help to determine the scope of the attack and which systems may have been impacted.

    Passively monitoring adversary groups

    One of the most important aspects of threat intelligence is being able to monitor adversary groups. This allows organizations to track the activities of these groups, understand their tactics and techniques, and potentially detect them before they are able to launch an attack.

    Passively monitoring adversary groups can help organizations improve their defenses by giving them early warning of potential attacks. It can also help them to understand the capabilities of these groups, which can help them to better defend against attacks.

    Extracting IOCs from publicly available sources

    One of the most important aspects of intelligence-gathering is the ability to automate tasks whenever possible. Automating the extraction of Indicators of Compromise (IOCs) from publicly-available sources is one such task. Automating this process allows security teams to more quickly and easily collect data on potential threats. Additionally, automation allows for the regular updating of IOCs as new threats are identified.

  • How to plan and execute offensive countermeasures operations, including hacking back

    There is no one-size-fits-all answer when it comes to offensive countermeasures operations, such as hacking back. Depending on the specific situation and threat, a variety of tactics and techniques may be necessary to successfully achieve the desired outcome. However, some basics that are generally applicable include reconnaissance and mapping of the target environment, identification of potential entry points and vulnerabilities, as well as deployment of appropriate tools and techniques to exploit those vulnerabilities.

    Once the attack is launched, it is important to maintain consistent monitoring and analysis of the target environment to ensure that the threat is neutralized and that no further damage is done. In some cases, it may also be necessary to take further defensive measures to protect the organization's systems and data.

    The bottom line is that effective offensive countermeasures require a high level of sophistication and expertise, and should be undertaken only after a careful risk analysis has been conducted.

    Safely probing adversary infrastructure

    One of the main goals of any cyber offensive countermeasure (COCM) is to safely probe adversary infrastructure in order to understand their activity, identify any valuable assets, and understand their attack surface. It is also important to identify any potential vulnerabilities that could be exploited in order to achieve this goal. This course teaches techniques to perform scans in way that cannot be attributed back to a OCM team.

    Identifying vulnerabilities in control panels

    Cyber threat actors write malware with the goal of establishing a foothold in the target environment. Once they have achieved this, they need to be able to control the malware in order to achieve their goals. This is where malware control panels come into play. These panels provide a web-based interface that allows the attacker to control the malware, issue commands, and gather information.

    However, these panels can also be hacked by offensive countermeasures teams. This allows the team to take over the malware, stop it from doing damage, and even use it to track down the attacker.

    Building and using a secure operating environment

    Building and using a secure operating environment is crucial in developing reliable cyber offensive countermeasures. Without a stable and secure system, any actions taken against potential cyber threats could be easily compromised, rendering the entire effort useless.

    Building and deploying honeypots

    A honeypot is a computer system that is configured to act as a decoy to lure cyber attackers. Once the attacker is attracted to the honeypot, their activities can be monitored and analyzed. This information can then be used to improve the security of the organization's real systems.

    Building and deploying honeypots is an important part of cyber offensive countermeasures. By setting up honeypots, we can learn about the tactics and techniques used by attackers, as well as the tools and malware they use.

  • How to attribute cyber attacks and malware to criminal groups or nation-state actors

    Attack attribution is the process of identifying the source of a cyber attack. This is important for several reasons. First, it allows organizations to identify and protect against potential attacks from the same source. Second, it helps law enforcement agencies identify and apprehend the perpetrators of cyber attacks. Finally, it allows victims of cyber attacks to seek justice and compensation.

    Attribution is not always easy, and there are several factors that can complicate the process.

    Using the Cyber Attribution Model

    The CAM has two closely interacting parts: Cyber Attack Investigation and Cyber Threat Actor Profiling.

    The Cyber Attack Investigation part is focused on professional and organized cyber attacks, such as espionage or APT campaigns. The goal is to help national cyber security centres identify and investigate these attacks.

    The Cyber Threat Actor Profiling is focused on identifying the actors behind these attacks. By understanding who is behind the attacks, security professionals can better protect their networks and systems from future attacks.

    Click here for more information

    Identifying code reuse

    Code reuse is a valuable technique for cyber attribution because it can help analysts identify the perpetrators of a cyberattack. By identifying code that has been reused in multiple attacks, analysts can build a profile of the attacker and determine their motives and methods. This information can then be used to track the attacker and prevent future attacks.

    Writing high-fidelity YARA rules

    One key part of attribution is being able to write high-quality YARA rules. YARA is a tool that allows analysts to identify and group malware samples based on certain characteristics. By creating YARA rules that are specific to your organization's malware, you can improve your chances of correctly attributing a cyber-attack.

  • How to write reports, disseminate intelligence and integration 3rd party feeds into your infrastructure

    Professionally documenting IOCs

    One key skill in producing cyber threat intelligence is by having a good understanding of what IOCs (indicators of compromise) are, and being able to document them in a way that is both professional and easy to understand.

    Developing a taxonomy

    One of the most important aspects of developing and using a taxonomy when documenting IOCs for cyber threat intelligence is that it can help to ensure that all collected IOCs are accurately and efficiently categorized. This can help to improve the overall quality and effectiveness of the threat intelligence. Additionally, a taxonomy can also help to improve the speed and accuracy of malware analysis.

    Preparing and drafting briefings

    When it comes to cyber threat intelligence, briefings are one of the most important things a CTI team can produce. They provide a high-level overview of the threats an organization is facing, as well as the corresponding mitigations and recommended actions. However, briefings aren't just for internal use—they can also be shared with clients and partners to keep them up-to-date on the latest threats and how they may impact their business.

    Employing Structured Analytics Techniques

    Structured analytics techniques (SATs) and critical thinking are important tools in cyber threat intelligence.SATs help analysts overcome these sources of error by forcing them to consider all possible explanations for evidence, and to systematically test their hypotheses. By doing so, analysts are able to reduce the effects of bias, and arrive at more accurate conclusions. Critical thinking is the process of thinking logically and rationally to identify the strengths and weaknesses of an argument or proposition.

    When used together, structured analytics and critical thinking can help analysts to better understand the data they are working with and to develop better insights into potential cyber threats.

Student Testimonial

Career Outcomes

This certification thoroughly prepares you for the following roles:

  • Cyber Threat Intelligence Analyst
  • Threat/Warning Analyst
  • Electronic Warfare Specialist
Certification Detail

MCSI certifications are highly respected and sought-after credentials in the industry. Earning an MCSI certification is a testament to your knowledge and skillset, and demonstrates your commitment to excellence. The content is cutting-edge, uniquely-designed, and hands-on. Our exercises teach in-demand skills that are immediately applicable in the field.

The certifications are valid indefinitely and do not require any renewal fees. The training is accessible without any time limits.


Training Modules

This course provides you with multiple training modules, each of which is designed to teach you practical skills that can help you solve important cyber problems. Each module offers exercises that will help you build your skills and capabilities.

  • MTIA-QS-01: Quickstarter - 11 exercises
  • MTIA-001: Lab Setup - 5 exercises
  • MTIA-002: Fundamentals - 5 exercises
  • MTIA-101: Open-Source Intelligence - 8 exercises
  • MTIA-102: Internal Logs Sources - 5 exercises
  • MTIA-103: Binary Classification - 4 exercises
  • MTIA-104: File and Executable Forensics - 3 exercises
  • MTIA-105: Memory Forensics - 5 exercises
  • MTIA-106: Network Forensics - 2 exercises
  • MTIA-107: Windows Forensics - 5 exercises
  • MTIA-108: Threat Hunting with YARA - 12 exercises
  • MTIA-109: Threat Hunting with Pandas - 5 exercises
  • MTIA-110: Threat Hunting with Velociraptor - 3 exercises
  • MTIA-111: Threat Hunting with GRR Rapid Response - 3 exercises
  • MTIA-201: Situational Awareness - 7 exercises
  • MTIA-202: Pivot Analysis - 4 exercises
  • MTIA-203: Harnessing Threat Feeds - 8 exercises
  • MTIA-204: Monitor New Threats and Vulnerabilities - 3 exercises
  • MTIA-205: Security Automation - 3 exercises
  • MTIA-301: Cyber Threat Mapping - 6 exercises
  • MTIA-302: Hypotheses Creation - 3 exercises
  • MTIA-303: Supporting Red Teams and Threat Hunting Teams - 3 exercises
  • MTIA-304: Reporting - 6 exercises
  • MTIA-305: Policies, Procedures and Methodologies - 11 exercises
  • MTIA-401: Cyber Counterintelligence - 1 exercises


Cyber professionals must be ready for everything. The typical security training strategy, which focuses on individual skills and tools, is insufficient. You must be able to operate as part of a team, see the big picture, and respond swiftly and effectively to unforeseen circumstances. That's why, as part of our training, we use replays of whole cyber missions. Our scenarios help you prepare for the demands of the job and give you confidence in your ability to work professionally.

  • MTIA-SC-01: Operation Phantom Protocol - 15 exercises

Enroll now with lifetime access for $450


MCSI Industry Certifications are important for you to earn because they signify that you have the skills required to work in a cybersecurity. Certificates of Completion are also important to earn because they signify that you have completed an exercise. Earning Certificates of Completion and Industry Certifications demonstrates that you are willing to put in the extra work to be successful.




Obtain CPE points by solving exercises


Achieve multiple certifications


Receive help from instructors online

MCSI's MTIA certification provides you with the required skills and knowledge aligned to the Australian Signals Directorate's Cyber Skills Framework . Upon reaching each level, you will earn a certificate of achievement. Click here to learn more about our multi-credentialed approach.

Certificate Level Curriculum Completion Requirement Scenarios Completion Requirement
MCSI Threat Intelligence Learner Level 1 0% 0%
MCSI Novice Threat Intelligence Practitioner Level 2 20% 0%
MCSI Threat Intelligence Practitioner Level 3 50% 0%
MCSI Senior Threat Intelligence Practitioner Level 4 70% 10%
MCSI Certified Principal Threat Intelligence Practitioner Level 5 80% 25%
MCSI Certified Expert Threat Intelligence Practitioner Level 6 95% 50%

In a single course, MCSI offers multiple industry certifications. You will save time and money with us because you will receive several accredited levels of competencies with a single purchase rather than having to buy multiple courses. Our goal is to provide you with a course that will take you from beginner to expert.

Career Pathways

This certification aligns with the following career pathways:

Certifications are important tools to validate your skills and knowledge. They can provide you with the credentials you need to get ahead in your career.

There are many reasons why a person should select certifications that teach practical skills over an open-book theory exam. Hands-on experience is crucial in many industries, and theory exams cannot replace the real-world application of skills. Furthermore, practical skills are often more marketable than theoretical knowledge, and can help a person secure a job in their desired field. Finally, practical skills can provide a foundation for further learning, while theory exams may only teach limited information. In conclusion, selecting a certification that teaches practical skills is the best way to ensure success in today's competitive job market.

Sample Exercises

Below are three (3) exercises from the 100+ exercises available in MTIA - Certified Threat Intelligence Analyst:

Use Shodan.Io To Passively Map An Organization's External Facing Assets (Novice)


Write A Python Script To Scrape Online Content For Indicators Of Compromise (Advanced Beginner)


Perform A Code Review Of The Control Panel Of The Zeus Banking Trojan (Competent)


Our Instructors

Student exercises are reviewed and graded by multiple instructors. This one-of-a-kind approach allows you to get highly personalized input from a number of successful professionals.

MCSI's teachers bring real-world experience and knowledge to the classroom, ensuring that students have the skills they need to excel in the field of information security. Due to their extensive experience in penetration testing, vulnerability assessment, reverse engineering, incident response, digital forensics, and exploit development, students will understand the most up-to-date defensive and offensive cybersecurity strategies and procedures.

Our instructors are passionate about information security and are always looking to further their own knowledge. Students who attend an MCSI course can be confident that they are learning from some of the best in the business. They can adapt their teaching approaches to match the demands of any student, regardless of their degree of expertise.

The MCSI team strives to provide the most comprehensive and up-to-date cybersecurity training available. Whether you are a seasoned security professional or new to the field, MCSI has a course that will meet your needs.

Receive personalized feedback from cybersecurity experts:

  • Overcome challenges and hurdles preventing you from advancing your skills
  • Receive guidance on how to focus your training efforts and avoid wasting time
  • Learn how to meet the industry's quality standards and produce high-quality work
  • When you're stuck, go to a support forum or ask inquiries to the instructors right on the platform

Help and Support

24/7 Discord Community

If you're looking for additional support during your studies, consider joining our Discord server. Our community of fellow students and instructors is always available to provide help and answer any questions you may have.

Personalized Support

Your submissions will be reviewed by MCSI instructors, who will provide you with personalized feedback. This input is critical since it can assist you in identifying the areas where you need to enhance your skills. The instructor's feedback will also tell you how well you did an exercise and what you can do to improve your performance even further.

Click here to see an example of personalized feedback.

Our personalized support will take your skills to the next level. Read what a student says about it:

Quick Questions

If you have any questions or need clarification on any of the exercises, MCSI offers a Quick Questions section on each exercise where you can ask for help. This is a great resource to use if you need assistance. This feature is only available for paid courses.

Actively Maintained Course

This course is actively maintained to ensure that it is current and error-free. We want to ensure that you have the best possible experience while taking this course, which includes having access to accurate and current information. This course is also tested for flaws on a regular basis, so you can be sure you're getting a high-quality product.

This course is constantly updated with the support of trustworthy industry peers to ensure that students are acquiring the most up-to-date information and skills. This dedication to staying ahead of the curve is what distinguishes this course as one of the greatest in the market.


Training Laptop Requirement

This course can be completed on a standard training laptop. To ensure you have the necessary hardware to complete the course, your machine should meet the following specifications:

  • 64-bit Intel i5/i7 2.0+ GHz processor or equivalent
  • 8GB of RAM
  • Ability to run at least (1) virtual machine using Virtual Box, or an equivalent virtualization software
  • Windows 10 or later, macOS 10 or later, or Linux
  • Local administrator privileges
Do you support older operating systems?

Yes. Many of the exercises can be completed on older OS versions. A few of our students are successfully using older equipment to learn cyber security.

Proficiency in the English language

You must have the ability to comfortably read and understand IT documentation written in English. Ideally, they have an IELTS score of 6.5 with no band less than 6 (or equivalent).

Note: You can register for this course without having undertaken an English test.

Prerequisite Skills

  • Writing scripts in Python
  • Using command line utilities and tools
  • Operating virtual machines
  • Troubleshooting and resolving software errors

Prerequisite Knowledge

  • Knowledge of cyber threats and vulnerabilities
  • Knowledge of cyber attack stages (e.g., reconnaissance, scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks)
  • Knowledge of attack methods and techniques (DDoS, brute force, spoofing, etc.)
  • Knowledge of common computer/network infections (virus, Trojan, etc.) and methods of infection (ports, attachments, etc.)
  • Knowledge of fundamental cyber operations concepts, terminology/lexicon (i.e., environment preparation, cyber-attack, cyber defense), principles, capabilities, limitations, and effects
  • Knowledge of the basics of network security (e.g., encryption, firewalls, authentication, honey pots, perimeter protection)
  • Knowledge of the common networking and routing protocols (e.g. TCP/IP), services (e.g., web, mail, DNS), and how they interact to provide network communications

Lab Environment

This course teaches you how to setup and configure your own cybersecurity lab.

There are numerous advantages to creating your own cybersecurity lab rather than paying for one. The cost savings are perhaps the most evident benefit. When compared to the expense of licensing a pre-built lab, creating your own lab can save you thousands of dollars. You also have the option of customizing the lab environment to meet your specific requirements. You can, for example, select the hardware and software that will be used in your lab.

Another advantage of setting up your own cybersecurity lab is that it allows you to learn new skills. Building a lab from the ground up necessitates knowledge of networking, system administration, and other technical subjects. This experience is invaluable in your career as a cybersecurity professional.

We frequently see students who can complete a task in a pre-built lab but cannot complete the same task at work. This is because these labs are meant to lessen work complexity, thereby creating an illusion of personal capabilities. It's also worth noting that you'll be expected to set up your own lab to test tools and techniques in the workplace. Employers may give you the resources to set up virtual computers and networks, but it will be up to you to manage the lab environment and maintain your tools.

Finally, you should know that pre-built labs are not commonly licensed by top cybersecurity professionals. They've realized that setting up a lab is simple, efficient, adaptable, cost-effective, and that it sparks creativity. It also nullifies risk of performing unauthorized actions against systems provisioned by a third-party.

Aptitude Test (Optional)

This is an intermediate course. It includes exercises for novices but assumes that they have competent IT skills and a strong understanding of cybersecurity concepts.

Aptitude Test:

If you're not sure if you'll be able to fully enjoy this course, then contact us via email to organize a free aptitude test. This test will determine whether you meet the course's basic baseline criteria. If you've never studied with us before, it will also introduce you to the MCSI Method™.

Easier Courses:

If you are convinced that this course is too difficult for you, then you should start with something easier. We recommend checking out the following courses:

You won't need to complete all of these easier courses in their entirety. Most likely, you already have adequate skills and only need to fine-tune them before taking an intermediate course like this one. Choose a route, follow it, enhance your skills, and then return to this course in a few months!


Why MCSI's Threat Intelligence Analyst Certification is World Class

why MCSI certifications

Comprehensive, Effective, Exceeds Standards

Holders of the MTIA Certification have completed 100 practical online exercises thus demonstrating that they have the skills and knowledge to disrupt and defeat ongoing malicious adversary cyber campaigns, and deter future campaigns.

why MCSI certifications

Internals Focused

Students who have obtained this Certification have demonstrated that they have a full understanding of the Windows operating system's internals for digital forensics, incident response and malware analysis purposes.

why MCSI certifications

Programming Oriented

The challenges that students have had to overcome successfully in order to obtain this Certification have required them to write software in Python. This guarantees that Threat Intelligence Analyst certified by MCSI can develop capabilities to defend large-scale enterprise networks.

Enrollment and Fees



Terms and Conditions

  • No discounts
  • No refunds
  • No transfers
  • No renewal fees
  • No hidden fees
  • No time limits
  • Exercises must be completed on MCSI's Online Learning Platform
  • You'll also be charged GST if you live in Australia

Cooling-Off Policy

Received a full refund if you changed your mind about a purchase within 24 hours. No questions asked. Read the full details here.

Don't Buy This Course

Don't buy this course if you think learning cyber security is simple, that it will only take a few hours, that remembering a few concepts from videos and books would be enough, or, that you should be provided with walkthroughs and solutions to practical problems instead of thinking critically for yourself.

Our competitors are misleading you by claiming that their video courses and open-book theoretical certificates will teach you everything you need to know about cyber security. We recommend that you stay away from our courses until you've realized that cybersecurity requires hundreds of hours of training against difficult challenges under the watchful eye of experts encouraging you to improve your weaknesses. Only then will you understand the value of this course and the benefits that the MCSI Method™ can bring to your career. We only want satisfied customers.

When purchasing a course, you acknowledge that you understand and agree with our 100% practical MCSI Method™: no solutions, no walkthroughs, and you're expected to use critical thinking and research to solve the exercises. If you're not sure how this work, try our free version before buying.

How does MCSI Compare?

If you are looking for a certification that will give you an edge in the job market, look no further than MCSI certifications. Thanks to our innovative approach, cybersecurity training is more affordable and effective than traditional methods.

MCSI Certifications Traditional Vendors Industry Conferences Conference Workshop Cybersecurity Bootcamps Cyber Ranges
Cost $450 $5,000+ $900+ $4,000+ $10,000+ $3,000+
Hours of training 600+ hours 40-48 10+ 16-40 450 40-100
Certifications 5 1 0 0 1 0
Online Yes Some No No No Yes
practical 100% 50% 0% 50% 50% 100%
Maintenance Level High Low Low Low Low Low
free trial Yes No No No No No
Access to instructors Yes Some No Yes Yes Some

Our pricing is more affordable than our competitors because we have reinvented how cyber training is done online. Our innovative Online Learning Platform is highly effective at teaching cyber security. The platform provides a more engaging and interactive learning experience than traditional methods, which helps students learn and retain skills better. Try the free version and see for yourself.

Enroll now with lifetime access for $450

Bloom's Taxonomy

Bloom's Taxonomy is a system for categorizing distinct stages of intellectual growth. It is used in education to assist students comprehend and learn material more effectively. MCSI teaches students how to apply, analyze, evaluate, and create at the highest levels of the taxonomy. The majority of our competitors are simply concerned with getting you to remember concepts.

The intellectual developments outlined in Bloom's Taxonomy are directly tied to your capacity to advance in your cyber security career. Employers look for people who can solve challenges that are worth paying for. With us, you'll learn practical skills that are in demand and applicable to a wide range of cyber occupations.

Industry Recognized Skills

MCSI credentials are well-respected around the world, and organisations searching for people with real cyber security abilities seek them out. Obtaining an MCSI certification verifies your understanding of critical cyber security topics as well as your ability to provide real-world results.

The ability of MCSI's training programme to give students with real-world, hands-on experience is unrivalled. Students must conduct their own research and develop their own answers in order to complete our practical exercises, which are meant to give them the skills they need to be successful in the field.

With MCSI, you will build a comprehensive cybersecurity portfolio of your skills as you complete exercises. This portfolio is a powerful tool for displaying your cybersecurity knowledge and abilities. A portfolio, as opposed to typical resumes and paper-based credentials, presents a more thorough summary of your skills and accomplishments.

Students Feedback

Here's what students say about the MCSI Method™ and our Online Learning Platform:

Student Testimonials

Information Security Professionals made a median salary of $103,590 in 2020. Cybersecurity roles are regularly ranked #1 jobs in the United States.

If you are looking to increase your earning potential, this course will put you on track for jobs that offer a salary of $75,000 to $150,000 per year. Why spend tens of thousands of dollars on degrees or theoretical certifications when you can develop in-demand practical skills in a shorter amount of time?

Enroll now with lifetime access for $450

Frequently Asked Questions

What is the MCSI Method™?

Common Questions

  • Are solutions included in certifications and bundles?
    • No. Our method of teaching cyber security consists of challenging you with real-world problem statements that you're expected to research and solve by doing your own research. This is how you'll be expected to work in the field. When you fail an exercise, we provide you with constructive feedback to improve and try again.
  • Do bundles, training content, or certificates ever expire? Am I expected to buy again in the future?
    • Upon purchase, bundles and certificates are permanently unlocked with no recurring or ongoing fees.
  • Do I need to buy the training and the certification separately?
    • No. The price provided covers both. You only pay once.
  • Do you offer any special offers and discounts?
    • We understand that many of our customers may be looking for discounts, and we would love to be able to offer them. However, we do not provide discounts because we believe that our prices are fair and reasonable. We work hard to keep our prices low, and we feel that discounts would be unfair to our other customers. We hope you understand.
  • If I can't solve the exercise where do I go for help?
  • Who reviews and marks exercises?
    • Trained cyber security instructors that work for Mossé Cyber Security Institute.
    • MCSI instructors are highly qualified and experienced professionals who are able to teach a variety of topics related to information security. They have the ability to tailor their teaching methods to meet the needs of each student, regardless of their experience level. In addition, they are always up-to-date on the latest trends and developments in information security, which enables them to provide students with the most relevant and current information.
  • We can't pay via credit card. Can you raise an invoice for wire payment instead?
    • Yes. Send us the list of bundles and certifications you want to purchase at [email protected]
  • Can I access a trial/demo the certification programmes prior to enrolling?
    • We provide a free curriculum with 100+ hours practical exercises you can try.
    • The Free Curriculum teaches Security Tools, Penetration Testing, Red Teaming, Threat Hunting, Cyber Defence, GRC and Windows Internals.
    • Try the Free Curriculum
  • Do you provide Continuing Professional Education (CPE) credits?
    • Yes. Every single exercise offers CPE credits. The number of credits earned depends on the difficulty of the exercise completed. Below are the CPE Credits achieve for an exercise in each difficulty:
    • Novice exercises = 1 CPE credits
    • Advanced Beginner exercises = 2 CPE credits
    • Competent exercises = 5 CPE credits
  • Do I need to complete an exam to receive MCSI Certification?
    • No. MCSI Certifications are completed by solving practical cybersecurity exercises.
  • Do I need to purchase cybersecurity tools or subscriptions?
    • No. Only free or trial versions are used in our exercises. You do not require making any purchases.

More Kind Words from Students

Enroll now with lifetime access for $450


We'll respond within 24 hours

Visit our Frequently Asked Questions (FAQ) page for answers to the most common questions we receive.

Ready to learn hands-on cyber security skills online?

Try 100 hours for free