Training

• August 3, 2026 Training Incident Response Black Hat USA 2026 Mariano E Quintana AR·Felipe Barbosa Alves BR Adversary Tradecraft Decoded: CTI from Zero to Hero

  Adversary Tradecraft Decoded: CTI from Zero to Hero is an immersive training program designed to bridge the gap between foundational cybersecurity knowledge and the practical, operational use of Cyber Threat Intelligence (CTI). This course provides a structured path for participants to transform raw adversary tradecraft into actionable intelligence products that support detection, response, and strategic defense.

  Starting from first principles, attendees will explore the intelligence lifecycle, types of CTI, and the role of cognitive biases in analysis. The course then advances into the practical decoding of adversary Tactics, Techniques, and Procedures (TTPs), mapping them against frameworks such as MITRE ATT&CK to create consistent and reliable intelligence outputs. Participants will learn to apply open standards (STIX, TAXII, OpenIOC), enrichment methods, and structured analytic techniques to normalize and contextualize threat data.

  The centerpiece of the training is a cloud-based lab environment that recreates realistic attack scenarios in a safe and controlled setting. Participants will investigate a simulated phishing and privilege escalation incident, reconstruct the cyber kill chain using the Diamond Model, extract indicators, and identify adversary behaviors. Through guided exercises, they will practice building competing hypotheses (ACH), mitigate the influence of analytical bias, and ultimately produce both technical and executive-level CTI reports.

  What makes this program unique is its dynamic and in-depth approach to understanding how intelligence is truly built, not just as a theoretical exercise, but as the foundation for making future decisions about whether and how to share it. Learners are pushed to challenge their own hypotheses and identify the biases inherent in the analytic process. While they work through a known case, the procedures and steps they follow can be directly applied to generating new, useful intelligence beyond the classroom.

  This hands-on, end-to-end process ensures that learners not only grasp the theory of CTI but also experience how to operationalize it in passive defense and threat hunting contexts. By simulating the work of real-world analysts, participants will leave with the ability to generate intelligence products that directly support security operations, reduce uncertainty in incident response, and inform decision-making at tactical, operational, and strategic levels.

  ResearchersMariano E Quintana AR·Felipe Barbosa Alves BR

  Presented at Black Hat USA 2026

  View official session
• August 3, 2026 Training Malware & Reversing Black Hat USA 2026 Verónica Valeros AR·Sebastián García AR Advanced Malware Traffic Analysis

  This intensive two-day training teaches you how to understand, detect, and investigate modern malware attacks through hands-on network traffic analysis. Instead of relying on tools or dashboards, you will learn to recognize malicious behavior by developing analytical skills, technical intuition, and a solid methodology drawn from real incidents.

  Across nine modules, you will analyze real-world captures, build timelines, and learn to separate normal from malicious activity. You will investigate ransomware behavior, botnet communications, DGAs, encrypted traffic, and custom protocols. You will also generate and analyze network logs and use machine learning.

  The training combines short theory blocks with guided labs, peer discussions, and exercises distilled from decades of experience in traffic analysis. By the end, you will have the confidence and methodology required to analyse traffic and make informed decisions during real incidents.

  ResearchersVerónica Valeros AR·Sebastián García AR

  Presented at Black Hat USA 2026

  View official session
• June 22, 2026 Training AI Security TROOPERS26 Salvador Mendoza MX Automating Cybersecurity Operations with Models, Agents, and Orchestrators

  This training introduces cybersecurity automation using AI models, agents, orchestration, and MCP (Model Context Protocol). It focuses on building flexible security workflows where models help analyze alerts, logs, and security data; agents decide what actions to take; and orchestrators connect tools, data, and people into reliable processes.

  The course emphasizes practical design patterns and hands-on examples, including low-code workflow engines and human approval steps. By the end, participants are expected to be able to design scalable automations that reduce repetitive work, improve response time, and integrate AI into security operations while keeping human oversight in place.

  ResearchersSalvador Mendoza MX

  Presented at TROOPERS26

  View official training