What is the Ransomware: Negotiation & Threat Intelligence Course?

This advanced course is designed to equip professionals with the knowledge and skills to handle ransomware incidents end to end. From understanding the foundations of ransomware to engaging directly in negotiation simulations, you'll gain practical insights into managing cyber extortion scenarios.

The course is delivered in partnership with Validin and Crystal Intelligence, giving you real-world exposure to industry-leading tools used during live ransomware investigations:

• Validin is an infrastructure search and enumeration tool that contributed to the creation of two practical labs, one tracking Black Basta and one tracking Black Suit
• Crystal Intelligence is a leading blockchain intelligence firm providing real-time blockchain analysis, investigative, and compliance solutions to financial institutions, law enforcement, and regulators. You'll learn how to use Crystal's Blockchain Monitoring Solution with Entity Wallet Analyses

These partnerships ensure the course content reflects how ransomware tracking and investigation actually work in the real world, not just in theory.

What's Covered

The course is structured across seven core domains:

• Ransomware Foundations: ransomware basics, deployment, the negotiator's role, the ransomware ecosystem (RaaS, Initial Access Brokers), and communication processes
• Response Preparation: building organisational readiness for ransomware incidents
• Ransomware Threat Intelligence: tracking adversaries, threat profiling, and modelling
• Ransomware Considerations: legal, ethical, and strategic factors during an incident
• Negotiation Tactics During Contact: core negotiation techniques applied to ransomware scenarios
• Ransomware Negotiation Simulation: hands-on, scenario-based simulation of live negotiations
• Course Completion: consolidating your skills and finalising the course

Skills You'll Gain

By the end of the course, you'll have developed practical skills across:

• Tracking adversaries and threat actor attrition
• Threat modelling and profiling
• Ransomware negotiation techniques
• Incident response preparation and coordination
• Use of industry tools including Validin, Maltego, and Crystal Intelligence
• HUMINT (human intelligence) techniques applied to threat actor engagement
• Blockchain analysis applied to ransomware investigations

What's Included

When you purchase the course, you'll receive:

• Lifetime access to all lessons, quizzes, hands-on labs, and course materials
• Lessons available in 9 languages with native text-to-speech (currently in beta)
• A ransomware negotiation chatbot for applied practice
• Two practical labs developed in partnership with Validin, tracking Black Basta and Black Suit
• Hands-on exposure to Crystal Intelligence's Blockchain Monitoring Solution with Entity Wallet Analyses
• A Credly digital badge on successful completion
• An estimated 55 hours of focused study time

Who is This Course For?

This course is designed for security professionals working in or around ransomware incident response, including:

• Incident Responders preparing for or actively responding to ransomware events
• SOC Managers and Team Leaders building organisational readiness for cyber extortion scenarios
• Internal Managers responsible for coordinating responses across legal, communications, and executive teams
• Ransomware Negotiators looking to formalise and benchmark their applied skills
• Threat Intelligence Analysts wanting practical exposure to live ransomware ecosystems

How This Course Adds Value

Ransomware is one of the most disruptive threats organisations face today, and the gap between technical response and effective negotiation is where most teams struggle. This course addresses both sides head-on.

The hands-on labs, built in partnership with Validin and Crystal Intelligence, give you direct experience tracking real ransomware groups and analysing blockchain activity tied to extortion campaigns. By the end of the course, you'll be ready to engage threat actors with confidence, support investigations with real intelligence, and coordinate a defensible response across your organisation.

Prerequisites

This course is positioned as Advanced and is best suited to those with prior experience in incident response, SOC operations, or threat intelligence.

Important:
There are no formal entry requirements. The course is open to all clients and can be completed at your own pace.

Want to Learn More?

You can explore the full details on the main course page or get in touch with our team if you have specific questions before committing.

Still need help?

Submit a support ticket and our team will be happy to help.