First Incident Responder

First Incident Responder

Onsite IT professionals are the first responders to security breaches. They are the ones who detect anomalies on the network, discover indicators of attack and compromise, and act according to how they have understood the situation.

This course teaches IT professionals structured techniques and gives specific tools to investigate incidents and make the right decisions when breached. Our teachers also equip the students with a structured process to work with professional teams of incident responders and digital forensics investigators to ensure positive outcomes as achieved for organizations affected by security breaches.

Asking the ask the right questions, following the right procedures, investigating systems effectively and rapidly, and correctly documenting findings, are crucial activities that guarantee the success of responding to breaches. Any failure on the part of the IT team to correctly assess a threat or act inappropriately in response to a compromise can lead to the rest of the organization being unable to further respond appropriately to the breach. Very often, a failure from business executives and board members to properly manage a breach can be directly linked to a failure in investigation and communication from lower-level employees who received little to no training in handling security incidents.

Theoretical knowledge makes up 50% of the class, and the other 50% consists of tabletop exercises and wargames.

Course Outcome:
By attending this class, you will learn:
  • The attacker mindset and tradecraft, and how to use this to inform incident response activities
  • A structured analytic technique to rapidly investigate anomalies on the network
  • The top locations to discover indicators of compromise and attack on the network
  • How to acquire forensics evidence and share it with the incident response team
  • A model to analyse the extent of a security breach and how to anticipate future attacks
  • A model to rate the sophistication of adversaries and, thus inform the business of the threats they are facing
  • How to deal with adversaries that specialize in ransom, blackmail and extortion
  • How to monitor adversaries on the network whilst critical business decisions are being made
  • A process to remove adversaries from the network and prevent them from coming back
  • How to communicate effectively during a breach and work as a team

Intended Audience:
IT professionals and managers.


This course is taught by experienced Mossé Security’s instructors. Our instructors have over 10 years of experience delivering penetration testing, red teaming and incident response services for a multitude of industries that have involved complex and multi-faceted approaches. Our instructors each possess the right balance of corporate experience and are competently skilled in presenting and teaching to groups.

Beyond their technical abilities and years of professional experience, our instructors are also trained teachers and public speakers. Their manner of teaching easily conveys their passion for computer security to every one of our students.

Notify Me!

We contact you next time this course runs

Course Overview