All courses
Cyber Threat Emulation Initial Access logo

TRAINING / CTE-IA

  • Offensive security
  • Intermediate

Cyber Threat Emulation — Initial Access.

Plan and conduct authorized initial-access exercises. Connect emulation decisions to the defensive gaps an engagement needs to test.

Book this courseExplore curriculum
Meet your instructors
Duration
5 days
Level
Intermediate
Delivery
In-person / Remote
Completion
Accredible certificate

Authorized adversary emulation

Course overview.

Cyber Threat Emulation — Initial Access covers the planning, execution, and reporting of authorized initial-access exercises. Students work within defined objectives and constraints in a controlled training environment.

The curriculum moves through engagement planning, infrastructure preparation, reconnaissance, initial access, and access continuity. A culminating exercise brings those elements together, followed by reporting and an outbrief. Throughout the course, operational decisions are connected to the assessment questions and defensive gaps the exercise is intended to examine.

Who it is for

  • Red team operators
  • Penetration testers
  • Security teams responsible for adversary-emulation exercises

Tools and concepts

  • Isolated cyber range
  • Emulation infrastructure
  • Endpoint tooling
  • Engagement planning and reporting

Learning outcomes

What your team will practice.

  • Define an authorized test plan and prepare infrastructure for the exercise.

  • Use reconnaissance findings to choose an initial-access scenario for an authorized assessment.

  • Conduct a scoped initial-access exercise and assess the resulting access.

  • Evaluate persistence and access-continuity choices within the exercise constraints.

  • Execute the exercise objectives and explain the findings to the client team.

Curriculum

Inside the course.

Topics covered across five days of instructor-led training.

01

Engagement planning and infrastructure

Define an authorized test plan and prepare infrastructure for the exercise.

  • Emulation doctrine and white-cell coordination
  • Objectives and operating constraints
  • On-premises and cloud exercise infrastructure
02

Reconnaissance and exercise preparation

Use reconnaissance findings to choose an initial-access scenario for an authorized assessment.

  • Perimeter intelligence and OSINT
  • Scenario selection
  • Endpoint tooling considerations
03

Initial access and environment assessment

Conduct a scoped initial-access exercise and assess the resulting access.

  • Controlled phishing exercises
  • Environmental analysis
  • Endpoint triage
04

Access continuity

Evaluate persistence and access-continuity choices within the exercise constraints.

  • User-context persistence
  • Operational continuity
  • Adapting tooling to the environment
05

Culminating exercise and reporting

Execute the exercise objectives and explain the findings to the client team.

  • Coordinated range exercise
  • Evidence and engagement reporting
  • Outbrief and after-action review

Preparation

Before your team attends.

Prerequisites

  • Working knowledge of Windows, Linux, and networking.
  • Experience using a command line and administering a test environment.

What to bring

  • A laptop, charger, and a modern web browser.
  • Internet access suitable for connecting to the training environment.

What is included

  • Instructor-led demonstrations and guided lab exercises.
  • Course reference materials.
  • An Accredible certificate of completion.

The training team

Meet your instructors.

Workforce alignment

NICE Framework alignment.

Course objectives align with selected parts of the NICE Framework, version 2.2.0. This is a curriculum alignment, not full work-role qualification or NIST endorsement.

  • Vulnerability AnalysisPD-WRL-007
  • Systems Testing and EvaluationDD-WRL-007
View curriculum alignment

NICE alignment describes assessment and testing skills. It does not represent a complete red-team work role or authorize activity outside the training environment.

  1. Engagement planning and infrastructure

    Define an authorized test plan and prepare infrastructure for the exercise.

    Related work roles: Systems Testing and Evaluation (DD-WRL-007)

    tasks
    • T0080Develop test plans to address specifications and requirements
    knowledge
    • K0955Knowledge of penetration testing principles and practices
    • K0956Knowledge of penetration testing tools and techniques
    skills
    • S0598Skill in creating test plans

    Test planning covers engagement objectives and infrastructure needs; it does not imply coverage of every system-testing task.

  2. Reconnaissance and exercise preparation

    Use reconnaissance findings to choose an initial-access scenario for an authorized assessment.

    Related work roles: Vulnerability Analysis (PD-WRL-007)

    tasks
    • T0845Identify cyber threat tactics and methodologies
    • T1619Perform risk and vulnerability assessments
    knowledge
    • K0692Knowledge of vulnerability assessment tools and techniques
    • K0955Knowledge of penetration testing principles and practices
    skills
    • S0516Skill in performing threat emulation tactics

    Reconnaissance informs the emulation scenario and assessment of the target environment.

  3. Initial access and environment assessment

    Conduct a scoped initial-access exercise and assess the resulting access.

    Related work roles: Vulnerability Analysis (PD-WRL-007)

    tasks
    • T1091Perform authorized penetration testing on enterprise network assets
    knowledge
    • K0956Knowledge of penetration testing tools and techniques
    • K0845Knowledge of cyber intrusion activity phases
    skills
    • S0516Skill in performing threat emulation tactics

    Initial-access exercises practice authorized penetration testing and emulation within a controlled range.

  4. Access continuity

    Evaluate persistence and access-continuity choices within the exercise constraints.

    Related work roles: Vulnerability Analysis (PD-WRL-007)

    tasks
    • T0845Identify cyber threat tactics and methodologies
    knowledge
    • K0845Knowledge of cyber intrusion activity phases
    skills
    • S0516Skill in performing threat emulation tactics

    The mapping covers understanding and emulating adversary methods, not a claim of complete operational capability.

  5. Culminating exercise and reporting

    Execute the exercise objectives and explain the findings to the client team.

    Related work roles: Vulnerability Analysis (PD-WRL-007); Systems Testing and Evaluation (DD-WRL-007)

    tasks
    • T1091Perform authorized penetration testing on enterprise network assets
    knowledge
    • K0955Knowledge of penetration testing principles and practices
    skills
    • S0459Skill in creating security assessment reports
    • S0842Skill in interpreting test results

    The exercise practices authorized testing; the outbrief translates observed test results into assessment findings.

NIST NICE Framework source data

Bring CTE-IA to your team.

Tell us your team size, preferred dates, and delivery format. Include CTE-IA in your inquiry.

Book this courseAll courses