Program Outline  (July 17-23) Denver 

Program Outline 
CYBINT1 – Collection Methods and Techniques, Collection Planning, PIRs, Collection Process Flow, Collection Tools and Targeting, Alignment with Hunt and Detect Needs, Ties to CSIRT, TTPs, IoCs, Threat Intelligence, Open Source Intelligence, All-Source Intelligence – 1.5 Days (Case Study 1)
CYBINT2 – Organization, Production, and Structured Analytic Techniques, Use of Techniques, Production Management, Critical Thinking, Process Flow, Metrics, Intake forms, and templates – 1 Day (Case Study 2)
CYBINT3 – Types and Methods of Analysis, Decomposition, Recomposition, Methods for Fusion, Case Studies in Analysis, Cognitive Bias, Credibility and Reliability of Sources, Confidence Levels, Analysis of Competing Hypothesis, SOPs, Flow into Hunt, Detect, CSIRT, TTPs, IoCs, Inductive/Abductive/Deductive Reasoning  – 1 Day (Case Study 3)
CYBINT4 – Identifying Your Consumers, Stakeholder Identification, and Analysis, Standing Orders from Leadership, Analytic Writing, BLUF, AIMS, Types of Reports, Product Line Mapping / Report Serialization, and Dissemination, Cyber and Threat Intelligence Program Strategic Plan, Goals, Objectives, Cyber Operations Order (Cyber OPORD). Case Study Presentations 2 Days
Lecture, Hands-on, Apprenticeship, in class exercises, student presentations, analytic products, templates, course material—55-60 CPEs

All Case Studies use all methods, techniques, and tools referenced in the course material. The Case Studies used are straight from the headlines giving students real world experience during the class.


Register for the Denver Course here

The course will run over 6 consecutive days covering a Sunday through the following week with a wrap-up on Friday.  Students are expected to attend each hour of each day since the course is comprehensive with each day building upon the next. Days start at 7 AM and run to 6 PM. Breakfast, lunch, and afternoon snacks/tea are provided. Lunches are usually working lunches. Class minimum is 15 with a maximum of 25.

In addition to the cyber intelligence tradecraft, Treadstone 71 is partnering with Stellar Solutions ( to provide a table top exercise based upon one of the case studies delivered during the course. Former Air Force Major Generals Bio–Larry Wells and Bio–Punch_Moulton  will be on hand to drive this exercise. 

Tentative Dates (Approximate since the course will be 6 days) and Locations so far:

Denver July 17-23  now open for registration

Denver October 16-22

To stay abreast of locations and program information, please email

Students who successfully complete the course will be certified as Cyber Intelligence Tradecraft Professional. 55-60 CPEs awarded for the course. This course is highly specialized following intelligence community tradecraft. You won’t get this at SANS although emulated. If you want tradecraft that lays the foundation for a solid program, education that creates a lasting impact, then this is the course for you. This course started six years ago at Utica College as part of their Master’s program.

CyberIntelTradecraftCertification – SV

Course books and manuals will be provided to students upon accepted enrollment. This course follows traditional intelligence community tradecraft. Treadstone 71 has been teaching cyber intelligence courses in various forms for 5 years. From academic settings and corporate environments to government facilities. Our customers include some of the largest firms in the world many of whom are part of critical infrastructures recognizing the need to learn how to create intelligence ( We support our training with onsite consulting services that teach you how to create a sustainable program aligned to stakeholders. Ultimately, we teach you what most vendors cannot or will not – how to fish for yourself.

Students are evaluated based upon deliverables of each section and the final written project.


Course Fee, Course Lab and Materials Fee (includes books, templates, structured techniques application, etc.).

$5990.00 required 15 days prior to course start. Discounts available

This course combines lecture, research, and hands-on team assignments. Students need to bring a laptop that does not have corporate controls (tablets will not suffice).

How is this course different from the current Treadstone 71 Cyber Intelligence course?

This course provides definitive sections along the intelligence lifecycle that are in-depth. Students are required to demonstrate understanding and use of collection methods using defined targets and target case studies, understanding and applying analytic techniques, when and how to use analytic techniques and analytic types. Students are presented several case studies for analysis, required to use tradecraft methods, and provide written reports in standard analytic format. Students are also required to orally present their deliverables to the class.

(Learn about the Treadstone 71 Cyber Intelligence Development Program)


Who may attend this course?

Treadstone 71 urges organizations to send teams to this training in order to build the foundation of a program built upon standardized intelligence tradecraft. Treadstone 71 will consider all US-based organizations and organizations within NATO countries.

If we want this course to be taught to our organization privately?

Treadstone 71 will teach private courses.

To stay abreast of locations and program information, please email

By Treadstone 71

@Treadstone71LLC Cognitive Warfare Training, Intelligence and Counterintelligence Tradecraft, Influence Operations, Cyber Operations, OSINT,OPSEC, Darknet, Deepweb, Clandestine Cyber HUMINT, customized training and analysis, cyber psyops, strategic intelligence, Open-Source Intelligence collection, analytic writing, structured analytic techniques, Target Adversary Research, strategic intelligence analysis, estimative intelligence, forecasting intelligence, warning intelligence, Disinformation detection, Analysis as a Service