Enterprise Defender: Advanced Security Essentials
Enterprise defender training in Toronto picks up where a foundation course stops. You spend eight weeks on the techniques modern attackers actually use, then on the detection and response work that answers them across a real corporate estate.
The penetration testing content here is taught from the defender's side: you run the tooling so you recognize what it leaves behind in your logs, not so you can sell a test.
- Duration
- 8 weeks
- Format
- Live online, instructor-led
- Prerequisites
- Security Essentials: Network, Endpoint and Cloud
- Class size
- Capped at 12 learners
What you will be able to do
- Identify attacker tooling from the traces it leaves in network and host logs
- Run a defensible incident handling process from detection to lessons learned
- Perform static triage on an unknown binary and decide whether it is malicious
- Reconstruct an intrusion sequence from a full packet capture
- Test your own controls with the same tools an attacker would use
- Harden Active Directory against the attack paths you have just demonstrated
- Write an incident report that survives review by legal and management
Course outline
6 modules
- Reconnaissance and what it looks like in your logs
- Initial access techniques in current use
- Privilege escalation on Windows and Linux
- Lateral movement and credential theft patterns
- Exfiltration channels and their signatures
What you need before you start
- Security Essentials or about a year of hands-on security or systems work
- Ability to work in a Windows domain and a Linux shell
- Understanding of TCP/IP and common application protocols
- A machine capable of running remote lab sessions for several hours
Who this course is for
- Security analysts moving beyond first line triage
- System and network administrators who own security outcomes
- Incident responders who want a broader technical base
- Blue team members preparing for CySA+
- Consultants advising small teams on practical defence
Where this leads
Prepares you for
CySA+
Awarded by CompTIA
Content aligns with CompTIA CySA+, particularly the incident response and vulnerability management domains. CompTIA awards the certification; we deliver training toward it. You register for and sit the exam yourself once you feel ready.
Questions about this course
More in cyber defence
Entry-levelSecurity Essentials: Network, Endpoint and Cloud
A ten week security essentials course in Toronto covering network, endpoint, cloud, identity and cryptography foundations for new defenders.
10 weeks · live online
Contact for pricingView outline
CoreSOC Analyst Training Program
SOC analyst training in Toronto covering alert triage, log analysis, SIEM workflows, escalation and the tradecraft that holds up on a busy queue.
10 weeks · live online
Contact for pricingView outline
CorePractical Open Source Intelligence
Practical OSINT training in Toronto: build sock puppets, geolocate imagery, mine corporate records and turn findings into a written analytic product.
6 weeks · live online
Contact for pricingView outline
Ready to launch your cyber security career?
Join the next live online cohort. No experience required, just bring the curiosity.