A specialized, hands-on training program for security professionals confronting the evolving landscape of digital threats culminating in a live, scenario-based tabletop exercise.
Through real-world scenarios and collaborative analysis, participants learn modern methods for conducting cyber investigations including dark web analysis, cryptocurrency transaction tracing, and digital forensics.
The course equips attendees with the practical skills and investigative techniques needed to strengthen operational readiness against evolving cybercrime threats. As technology continues to evolve, so do the tactics used by illicit actors to recruit, finance, plan, and communicate with greater reach and anonymity. This course offers a deep dive into the tools and techniques behind stopping these threats.
Provide participants a thorough understanding of how illicit state and non-state actors conduct cyberspace operations and how to investigate them.
Rather than relying on dry lectures, dense slides, and scripted delivery, each lesson breaks complex technical topics into clear, digestible concepts connected to real-world scenarios with practical solutions. The course unfolds in two key stages.
Foundational knowledge across the dark web, cryptography, cryptocurrency, and digital forensics all built up module by module so participants move from little or no prior experience to solid mid-level proficiency.
Participants apply the investigative tools and techniques in a simulated environment. The TTX includes a pre-brief, a practical scenario, and a debrief to reinforce learning and produces an actionable intelligence assessment.
At the culmination of the classroom instruction, participants will be familiar with the following domains and the way illicit organizations exploit each.
The TTX is team-based and places participants in a real-time investigative environment. At its culmination, participants will be able to:
Conduct basic encryption and decryption
Safely navigate the dark web
Conduct a proactive intelligence search on the dark web
Conduct meta-data analysis
Conduct imagery geo-location analysis
Track an IP address
Track and analyze a cryptocurrency address
Submit a cryptocurrency subpoena
Conduct intelligence analysis leveraging the dark web and blockchain
Deliver an intelligence briefing for a national security event
Tailored for professionals across law enforcement, intelligence, cybersecurity, national security, and defense from junior to senior levels, regardless of prior experience. This course has been delivered at leading institutions worldwide:
Thomas Hader is a former US Marine Corps Intelligence Officer, last assigned as a Law Enforcement Task Force Liaison to the DEA Special Operations Division. Previously he served as a Special Activities Officer with the Security Assistance Group – Ukraine (SAG-U), a CI/HUMINT Company Commander, and an Intelligence Officer for the Marine Corps Cyber Operations Group.
He is a primary lecturer for the NATO School Oberammergau’s Defense Against Terrorism Course (DAT-C) and a Lead Advisor with NATO’s Global Threats Advisory Group. Thomas has published academic articles on terrorist use of the dark web, finance, and recruitment networks — including work examining the nexus between Russia’s cryptocurrency policy and its intent to attack Ukraine, weeks before the invasion.
He is a writer and editor of two NATO publications: the Counterterrorism Reference Curriculum (CTRC) and Narco-Insecurity Inc. Thomas has also been published with the Center for Strategic and International Studies, Small Wars Journal, Interzine, and Terrorism Electronic Journal. He received his BA from the Pennsylvania State University and MSc from the London School of Economics & Political Science.
The schedule can be amended to meet the needs of the hosting organization and delivered across multiple days. Let’s build your team’s operational readiness.
Request Information →