What it is
Training delivered by someone who does the work being taught. It can be a one-off talk on a specific subject, a full course, or a course developed to your requirements and handed over so your own instructors can run it.
I have been teaching since 2019: foundation and advanced courses for companies across the industry, training providers, armed forces and academic institutions, in Israel and abroad.
The material comes out of engagements. The scenarios in the lab are built from investigations I have actually run, with everything identifying stripped out. When someone asks whether that actually happens, the answer is a case rather than a hypothesis, and the follow-up question, what did you do about it, has an answer too.
The design assumption throughout is that adults learn a skill by using it. Slides carry the framing; the lab carries the learning.
Courses I teach
Each of these has been delivered before, and each can be run as a talk, a workshop or a full course, adapted to your audience.
| Course | For | What people learn | Aligned certifications |
|---|---|---|---|
| Cyber Security Essentials | Newcomers to the field, IT staff, career changers | The foundations security work stands on: networking, Linux and Python, taught through the security tasks they are used for | SANS / GIAC: GFACT (SEC275) · GISF (SEC301) · GSEC (SEC401) · GPYC (SEC573) Other: CompTIA Network+ · CompTIA Linux+ · CompTIA Security+ · PCEP (Python Institute) |
| DFIR and Threat Hunting | SOC analysts, incident responders, IT security teams | Investigating an incident from the first alert to the final report, and hunting proactively for what the alerts missed | SANS / GIAC: GCFE (FOR500) · GCFA (FOR508) · GEIR (FOR608) · GCIH (SEC504) · GNFA (FOR572) · GLIR (FOR577) · GCFR (FOR509) · GCTI (FOR578) Other: INE eCTHP |
| SIEM and SOC | SOC analysts, detection engineers | Working a SIEM properly: collecting the right logs, triaging and investigating alerts, and writing detections that hold up | SANS / GIAC: GSOC (SEC450) · GCDA (SEC555) · GMON (SEC511) · GCIA (SEC503) Other: CompTIA CySA+ · Microsoft SC-200 · Splunk Core Certified Power User |
| Annual security awareness | All employees | Recognising phishing and payment fraud, protecting accounts, and knowing what to do and who to tell when something looks wrong | Supports the awareness requirement in ISO/IEC 27001 |
| Secure development (SSDLC) | Developers and team leads | Building security into every stage of development: threat modelling, secure coding, code review, dependencies, and coding safely with AI assistants | SANS / GIAC: GWEB (SEC522) · GCSA (SEC540) Other: ISC2 CSSLP |
Where a course lists certifications, its content is mapped to their exam objectives. The exam itself is taken separately with the certifying body. A detailed syllabus for any course is available on request.
A subject that is not on the list (Microsoft 365 forensics, business email compromise, security of AI agents, a board briefing) can be developed to order.
Formats
The format follows from the level you need people to reach, not the other way round.
- Awarenesseveryone
- Working knowledgeIT and developers
- CapabilitySOC and responders
- Ownershipyour own instructors
| Format | Typical length | What it is for |
|---|---|---|
| Talk or lecture | 45 to 90 minutes | A wide, mixed audience: an all-hands, a board, a conference, an industry association. One subject, understood properly, and what to do about it on Monday. |
| Workshop | Half a day to one day | One team, one specific skill, hands-on. Narrow enough to be finished in the room. |
| Course | Two days to several weeks | A team building a capability it will use afterwards. Full lab, exercises across the whole arc of the work, and the queries and playbooks to take home. |
| Course development | Built to order | Organisations, academies and training providers who will teach it themselves. Syllabus, labs, participant materials and instructor notes, delivered and handed over, including a train-the-trainer session so it runs without me. |
Who it's for
The usual reasons people call:
- A team that just got a tool. The EDR or SIEM was bought, and nobody uses it beyond closing the alerts it raises
- A SOC that closes alerts but does not investigate. The capability gap is real and everyone in the room knows it
- Developers who now have to care. After a finding, a customer requirement, or a review that did not go well
- The yearly awareness session. For all employees, and one they actually listen to
- An academy or training provider. Building a programme, or needing an instructor for one that already exists
- A certification or regulatory requirement. Documented competence and awareness training that has to be real, not a slide deck signed off
- A conference, association or partner. A talk that has to hold a mixed room for an hour, or a course placed with an end client, in Hebrew or English
What you get
- The training itself, delivered. In Hebrew or English, on site or remote, by the person who wrote it
- A working lab. Provisioned and tested before day one, not on the morning of it
- Participant materials. Exercises, references, and the queries, playbooks and checklists used during the course, so people leave with tools and not only notes
- Pre-course level check. A short questionnaire to every participant, so the course is pitched at the room that will actually be in it
- Certificate of completion for each participant
- Sponsor debrief. A written summary of where the team was strong, where it was not, and what to do next
- For course development. The full syllabus, labs and instructor notes, handed over for your team to run
How it works
- 1 · Scoping
- 2 · Level check
- 3 · Tailoring
- 4 · Delivery
- 5 · Debrief and follow-up
| Phase | What happens |
|---|---|
| 1 · Scoping | Who the audience actually is, what they need to be able to do afterwards, language, format, group size and dates. A course is normally booked four to six weeks ahead; a talk needs far less. Dates are held once they are confirmed in writing, with a cancellation window agreed at the same time. |
| 2 · Level check | A short questionnaire to every participant. The gap between the level a sponsor believes the team has and the level it has is the most common reason training lands badly, and it costs ten minutes to close. |
| 3 · Tailoring | Content and labs adjusted to the tools, the stack and the constraints the group actually works with, and, where you want it, to a real scenario from your own sector. |
| 4 · Delivery | The training, with the lab tested and running beforehand. Exercises are worked in small groups, and the day ends with people having done the thing rather than watched it. |
| 5 · Debrief and follow-up | The written summary to the sponsor, materials and certificates issued, and lab access for the agreed period afterwards. |
What makes a course work
These are the things that decide whether the course lands, and they are decided before it starts.
- A real level check. Half a room lost by lunch on day one cannot be recovered later in the week.
- Participants released from duty. People half-attending while covering their normal work derail a lab-based course for everyone else, not only for themselves.
- A group size that allows attention. Beyond a certain number a hands-on course quietly becomes a lecture. The cap is agreed at scoping.
- A sponsor who wants the debrief. The honest summary is uncomfortable, and it is the part that turns a training day into a plan.
Where this stops
The limits, stated before you book rather than discovered afterwards.
- The certificate is issued by hodsec and records completion. It is not an accredited credential; certification exams are taken with the certifying body.
- Mentoring after delivery is available separately and is not folded into the price.
- Rebuilding a syllabus around one client's environment is course development rather than tailoring, and is scoped as such.
- Lab infrastructure, hosting, and how long access lasts afterwards are agreed at scoping. What is agreed is what is delivered.
What I need from you
- Logistics. A room or a tested video-conference setup, the number of participants, and the level they actually start from rather than the level on paper. For lab-based courses, the lab infrastructure and access to it are agreed before day one
- One person on your side who owns the logistics and can confirm the audience and the dates
Who delivers the training
I deliver the training myself. The person who built the material is the person in the room. When a programme needs a specialism outside my own, I bring in instructors I have worked with before, and you always know who is teaching.
Confidentiality
Anything I see of your environment, your systems or your team's skill level while preparing or delivering the training stays between us. Full confidentiality is guaranteed during the engagement and after it, and an NDA can be signed before we discuss any detail.
Standards the training follows
- MITRE ATT&CK. The structuring vocabulary for hunting and incident response content
- NICE Framework (NIST SP 800-181). Mapping a course to the roles and skills you are trying to build
- ISO/IEC 27001. Documented competence and awareness, for organisations under or heading towards certification
- OWASP (Top 10, ASVS). For the secure development courses
After the course
Repeat cohorts as the team grows, an advanced follow-up once the basics are in place, a hunting or review engagement run alongside the team just trained, or consulting on what the debrief exposed. Each is optional and scoped separately.