CompTIA Cybersecurity Analyst (CySA+)

Overview

This 5-day CompTIA Cyber Security Analyst (CySA+ v4) course prepares cyber security professionals to detect, prevent, and respond to security incidents through continuous monitoring. Learners gain skills in security operations, vulnerability management, incident response, and effective reporting and communication. The course supports evolving organisational needs for threat management and risk mitigation.

Prerequisites

• CompTIA Security+ or equivalent knowledge.
• Hands-on experience as an incident response analyst or security operations centre (SOC) analyst, or equivalent experience.

Target audience

• Cyber security professionals responsible for incident detection, prevention, and response.
• Individuals seeking roles such as security analyst, SOC analyst, incident response analyst, vulnerability management analyst, security engineer, or threat hunter.

Objectives

Delegates will learn how to:

• Identify and investigate suspicious activity across networks, endpoints, and cloud environments to uncover potential security threats.
• Monitor and analyse data using industry-standard tools such as SIEM and EDR platforms.
• Identify, prioritise, and mitigate vulnerabilities using risk-based approaches.
• Investigate and respond to security incidents using structured processes and real-world techniques.
• Clearly communicate security findings and risks to stakeholders through reports and dashboards.
• Apply security practices across cloud and hybrid environments while supporting efficient and effective operations.
• Improve processes with automation.

Outline

System and network architecture concepts

• Logging concepts: ingestion, configuration, integrity and security, time synchronisation, and retention
• Operating system concepts, hardening, file structures, and critical processes
• Infrastructure concepts: cloud-native, virtualisation, containerisation, and APIs
• Network architecture: Zero Trust Network Access (ZTNA), SASE, and hybrid cloud
• Identity and access management: PAM, authentication/authorisation methods, and secrets management
• Encryption, data protection, and OT/ICS/SCADA fundamentals
• Security control types (physical, technical, administrative) and control functions

Analysing indicators of potentially malicious activity

• Network-based indicators: rogue devices, enumeration, and unexpected ports/traffic
• Host-based indicators: resource spikes, unauthorised software, LOLBins, and file changes
• Application- and cloud-based anomalies
• Identity-based indicators: impossible travel and unauthorised access
• Social engineering and Business Email Compromise (BEC)

Tools and methods to determine malicious activity

• Packet capture and analysis (Wireshark, tcpdump) and IDS/IPS engines (Snort, Suricata, Zeek)
• SIEM, EDR/XDR, and threat intelligence platforms (TIPs)
• File and reputation analysis; common log and file formats (JSON, XML, YAML, EVTX)
• Scripting for analysis with Python, PowerShell, and shell

Threat intelligence and threat hunting

• Threat actors, motivations, and TTPs; MITRE ATT&CK and the pyramid of pain
• Indicators of compromise: collection, analysis, and application (atomic vs. behavioural)
• Threat modelling (STRIDE), threat mapping, and cyber deception

Efficiency and process improvement

• Standardised playbooks and runbooks; SOAR and automation/orchestration
• Data enrichment, alert and rule tuning, and dashboards
• Tool integration via APIs, webhooks, and plug-ins

Artificial intelligence in security operations

• AI use cases in the SOC: log analysis, event correlation, documentation, investigations, and automation
• AI security risks: hallucinations, data exposure, model poisoning, and malicious prompts (prompt injection)
• AI governance and oversight: usage policies and legal/regulatory considerations

Vulnerability scanning methods and concepts

• Asset discovery and inventory; scan planning for scope, sensitivity, segmentation, and regulatory needs
• Internal vs. external, agent vs. agentless, credentialed vs. non-credentialed, active vs. passive scanning
• Baseline and compliance scanning (PCI DSS, CIS, ISO 27000)

Analysing and prioritising vulnerabilities

• Interpreting scanner output; validating, consolidating, and deduplicating findings
• Risk scoring with CVSS plus context; prioritisation using the Exploit Prediction Scoring System (EPSS)
• Handling false positives and tracking exceptions
• Software supply chain security and Software Bill of Materials (SBOM)

Vulnerability response, handling, and mitigation

• Controls to mitigate: patching, configuration changes, and compensating controls
• Change windows, rollback planning, retesting, and remediation validation
• Risk-based remediation planning and inhibitors to remediation

Attack methodology frameworks

• Cyber kill chain, MITRE ATT&CK, and the Diamond Model of Intrusion Analysis
• Testing guides and methodologies (OSSTMM, OWASP) for context

Performing incident response

• Lifecycle: detection, analysis, containment, eradication, and recovery
• Evidence acquisition and digital forensics fundamentals
• Root-cause analysis

Preparedness and post-incident activities

• Incident response plans, tooling, and playbooks
• Tabletop exercises and training; business continuity and disaster recovery alignment
• Post-incident review and lessons learned

Vulnerability management reporting and communication

• Compliance reporting, action plans, and inhibitors to remediation
• Metrics and KPIs; communicating risk to stakeholders

Incident response reporting and communication

• Incident declaration, escalation, and stakeholder identification
• Incident reporting, root-cause summaries, and lessons-learned communication

Exams and assessments

The course includes an exam voucher for the CompTIA Cyber Security Analyst (CySA+) CS0-004 certification.

Hands-on learning

Labs for hands-on learning are included, allowing delegates to practise skills in real-world scenarios.