Explore short awareness sessions, multi-day technical laboratories and professional audit or governance programmes.
Risk management fundamentals and ISO/IEC 27005 approach; Asset-based vs scenario-based risk identification, and more.
Documented information required by ISO/IEC 27001:2022; Writing a clear information security policy and topic-specific policies, and more.
Role and responsibilities of the ISMS internal auditor; ISO 19011 auditing principles applied to ISO/IEC 27001, and more.
Quality management principles and the ISO 9001:2015 structure (Annex SL); Process approach, risk-based thinking and the PDCA cycle, and more.
Information security concepts: confidentiality, integrity, availability; ISO/IEC 27001:2022 structure, clauses 4–10 and Annex SL, and more.
Building the ISMS project plan and gap analysis approach; Defining scope, context, interested parties and boundaries, and more.
A full lead auditor programme: ISO/IEC 27001:2022 requirements, ISO 19011 auditing, audit planning, evidence, nonconformities and reporting.
End-to-end ISMS implementation: scope, risk assessment, Annex A controls, SoA, documentation and certification readiness.
A structured ISO/IEC 27001:2022 auditor overview covering requirements, ISO 19011 principles, risk-based auditing and reporting.
The Annex SL high-level structure shared across ISO management systems; ISO/IEC 27001 information security as the integration backbone, and more.
NIST Cybersecurity Framework 2.0 structure and purpose; The six functions: Govern, Identify, Protect, Detect, Respond, Recover, and more.
Third-party and supply chain risk landscape; Vendor inventory, tiering and criticality classification, and more.
Building a data classification scheme and labelling; Handling rules per classification level; Data retention schedules and legal/regulatory drivers, and more.
Data discovery and building a personal data inventory; Data flow mapping across systems and third parties, and more.
PIMS project initiation, governance and stakeholder management; Integrating privacy into an ISO/IEC 27001 ISMS, and more.
Privacy concepts, PII, controllers and processors; ISO/IEC 27701 as a privacy extension to ISO/IEC 27001; Structure of the 2025 revision and key changes, and more.
Planning a PIMS on top of an existing ISMS; Defining privacy scope, roles and PII processing context, and more.
When a PIA/DPIA is required and legal triggers; DPIA methodology and process steps; Describing processing operations and data flows, and more.
Secure AI/LLM application architecture; Threat modelling AI-enabled applications; Securing prompts, context and system instructions, and more.
Where AI and ML add value in security operations; AI-assisted alert triage and enrichment; Anomaly detection and behavioural analytics (UEBA), and more.
How AI is reshaping governance, risk and compliance work; Using LLMs to draft and refine policies and procedures, and more.
The rise of generative AI and shadow AI in the enterprise; Risks of ungoverned AI tool usage; Writing a practical enterprise AI acceptable use policy, and more.
LLM application architecture and attack surface; OWASP Top 10 for LLM Applications overview; Prompt injection and insecure output handling, and more.
Planning an AIMS project and governance structure; Defining AIMS scope, context and interested parties; AI policy, objectives and roles/responsibilities, and more.
AIMS project initiation, leadership and governance; Scope, context and stakeholder analysis for AI; AI policy, objectives and organisational roles, and more.
Audit AI management systems: ISO/IEC 42001 requirements, AI risk, Annex A controls, audit planning, evidence and reporting.
AI concepts, AI risks and responsible AI drivers; ISO/IEC 42001:2023 structure and Annex SL alignment; AI management system (AIMS) scope and context, and more.
Direct and indirect prompt injection techniques; Jailbreaks, system prompt leakage and bypass patterns, and more.
Responsible AI principles: fairness, accountability, transparency; AI governance operating models and roles, and more.
Cyber range environment and exercise design; Red team attack scenarios and objectives; Blue team monitoring, detection and response, and more.
MITRE ATT&CK framework structure: tactics, techniques, procedures; Using the ATT&CK Navigator for coverage mapping, and more.
Designing an open-source SOC stack architecture; Deploying and configuring Wazuh for endpoint detection, and more.
Detection engineering lifecycle and workflow; Translating threats and ATT&CK techniques into detections; Use case prioritisation and coverage mapping, and more.
SOC operating models, roles and analyst workflow; Log sources, telemetry and normalisation; SIEM fundamentals and dashboards, and more.
Advanced investigation methodology and pivoting; Hypothesis-driven threat hunting; MITRE ATT&CK-based hunt development, and more.
SOC operating models, log strategy, SIEM use cases, detection engineering, alert triage and threat hunting.
Incident response lifecycle and readiness; Building an IR plan, playbooks and runbooks; Roles, RACI and the incident command structure, and more.
IR readiness, evidence handling, forensic acquisition, Windows artifacts, timeline analysis and containment.
DFIR fundamentals and the investigation process; Evidence handling, chain of custody and acquisition; Windows forensic artifacts and analysis, and more.
Safe malware handling, static and dynamic analysis, behavioural observation, x64dbg reversing and IOC extraction.
Safe malware handling and lab setup; PE file structure and static analysis; Strings, imports and signature-based triage, and more.
The modern ransomware kill chain and double extortion; Ransomware readiness assessment; Backup, recovery and immutability strategy, and more.
Cyber threat intelligence lifecycle and levels; Strategic, operational and tactical intelligence; Indicators of compromise and the Pyramid of Pain, and more.
API architecture: REST, GraphQL and authentication; OWASP API Security Top 10 overview; Broken object level authorization (BOLA/IDOR), and more.
Active Directory architecture and trust model; Enumeration with BloodHound and LDAP; Kerberos attacks: Kerberoasting and AS-REP roasting, and more.
Advanced SQL injection and filter bypass; Blind, time-based and out-of-band injection; Advanced XSS and content-security-policy bypass, and more.
Cloud attack surface and shared responsibility; AWS enumeration and IAM privilege escalation; Azure and Entra ID attack paths, and more.
Penetration testing methodology and rules of engagement; Reconnaissance and OSINT; Scanning, enumeration and service discovery, and more.
Mobile app architecture and threat model; OWASP MASVS and MSTG methodology; Setting up Android and iOS testing environments, and more.
Internal network penetration testing methodology; Host discovery, scanning and service enumeration; Exploiting network services and misconfigurations, and more.
Reconnaissance, enumeration, exploitation, Active Directory attack paths, web exploitation and lateral movement.
Purpose and audiences of a VAPT report; Report structure and executive summary; Writing clear, reproducible findings; Risk rating, CVSS and business impact, and more.
Vulnerability management lifecycle; Scanning tools, configuration and authenticated scans; Validating and de-duplicating findings, and more.
Web application architecture and attack surface; OWASP Top 10 methodology; Broken access control and IDOR; Injection: SQLi and command injection, and more.
Wireless fundamentals and 802.11 security; WPA2/WPA3 and enterprise authentication; Reconnaissance and rogue access point detection, and more.
Secure cloud architecture principles; Landing zone concepts and account/subscription structure; Identity foundation and centralised access, and more.
Cloud computing and shared responsibility model; Identity and access management across AWS, Azure and GCP; Network security and segmentation in the cloud, and more.
Container fundamentals and threat model; Image security, scanning and signing; Docker/runtime hardening and configuration, and more.
DevSecOps principles and culture; Shifting security left in the SDLC; Securing source control and branch protection, and more.
Microsoft 365 and Entra ID security model; Identity protection, MFA and conditional access; Privileged identity and role management, and more.
The risk of hard-coded secrets and leaked keys; Secrets management concepts and vault solutions; Protecting API keys, tokens and credentials, and more.
Secure coding principles and common vulnerability classes; Input validation, output encoding and injection prevention, and more.
Secure SDLC principles and maturity models; Security requirements and secure design; Threat modelling methodology (STRIDE), and more.
Software supply chain threat landscape; Dependency and open-source component risk; Software Bill of Materials (SBOM) and formats, and more.
Secure code review methodology; Manual review techniques and hotspots; SAST tooling, configuration and triage; DAST for running applications, and more.
Bangladesh Bank cloud computing guideline overview; Permitted cloud models and data residency expectations; Cloud risk assessment and due diligence, and more.
Overview of the Bangladesh Bank ICT Security Guideline; ICT governance and organisational requirements; ICT risk management expectations, and more.
Core Banking System (CBS) architecture and risk; Access control, segregation of duties and privileged access; Application and database security for CBS, and more.
Regulatory landscape for PSP, PSO and MFS providers; Security expectations for licensing and approval; Governance, policy and organisational requirements, and more.
The Report on Compliance (RoC) process and QSA role; Evidence types: interviews, observations and documentation; Mapping evidence to testing procedures, and more.
Service provider responsibilities under PCI DSS; Selecting the correct SAQ and understanding SAQ D; Scoping and shared responsibility for service providers, and more.
Network security controls and segmentation (Req 1); Secure configuration and system hardening (Req 2); Data protection and strong cryptography (Req 3–4), and more.
Payment ecosystem, card data and PCI DSS scope; PCI DSS v4.0.1 structure and 12 requirements; Cardholder data environment (CDE) and scoping, and more.
Scoping the cardholder data environment accurately; Network segmentation to reduce scope; Implementing requirements 1–6: build and maintain secure systems, and more.
SWIFT ecosystem and the Customer Security Programme (CSP); SWIFT CSCF structure: mandatory and advisory controls, and more.
Generative AI in the workplace: opportunity and risk; Data confidentiality and privacy when using AI; Acceptable use and approved AI tools, and more.
Cyber risk from a business and management view; Protecting business data and communications; Secure use of collaboration and cloud tools, and more.
Everyday cyber threats facing employees; Phishing, spear phishing and BEC in depth; Passwords, MFA and account protection, and more.
Scenario-based awareness for bank staff: phishing, password and MFA safety, data handling and social engineering.
Why cybersecurity matters to every employee; Recognising phishing and suspicious messages; Strong passwords, passphrases and MFA, and more.
The board's role and duty of care in cybersecurity; Cyber risk in business and financial terms; Key threats, breaches and lessons for leaders, and more.
Why data privacy matters and legal basics; Personal data, sensitive data and consent; Collecting, using and sharing data responsibly, and more.
Why fast, accurate incident reporting matters; What counts as a security incident; How and where to report incidents, and more.
How phishing and social engineering actually work; Spotting phishing, spear phishing and BEC; Malicious links, attachments and QR codes, and more.
How employees use generative AI tools day to day; Risks: data leakage, confidentiality and accuracy; What you should and shouldn't put into AI tools, and more.
Role of an awareness champion and programme goals; Adult learning and engagement techniques; Core security topics champions must master, and more.
Cyber resilience concepts and business impact analysis; Business Continuity Planning (BCP) fundamentals; Disaster Recovery (DR) strategy, RTO and RPO, and more.
Purpose, audiences and impact of audit reports; Report structure and executive summary; Writing clear, evidence-based findings, and more.
Understanding the surface, deep and dark web; How credentials and data are traded and leaked; Safe access and OSINT/dark web tooling, and more.
Data centre security domains and standards; Physical security, access control and zoning; Environmental controls: power, cooling and fire, and more.
IoT and embedded device ecosystem and risk; IoT attack surface: device, firmware, network, cloud; Firmware analysis and hardware interfaces, and more.
OT/ICS environments, SCADA and PLCs; Differences between IT and OT security; The Purdue model and network segmentation, and more.
The quantum threat to current cryptography; Symmetric vs asymmetric algorithm impact; NIST post-quantum cryptography standards, and more.
The modern CISO role and mandate; Building a cybersecurity strategy and operating model; Risk management and risk-based prioritisation, and more.
Cyber risk as a business and strategic risk; Governance roles: board, CXO and management; Duty of care, oversight and accountability, and more.
Why security metrics fail and how to fix them; KPIs vs KRIs and metric design principles; Selecting metrics that drive decisions, and more.
Turn Zero Trust into an enterprise roadmap: architecture, maturity assessment and phased implementation planning.
Guided exercises that let participants investigate, test, detect, audit and report.
Sessions delivered from real experience in banking, security testing, audit, IR and compliance.
Separate learning paths for technical teams, auditors, employees and senior management.
Private batch delivery, customized scenarios, assessments and organization-specific workshops.
Tell us your audience, business sector, capability gaps and preferred duration. We will structure a focused programme for your organization.