020 7193 4905

Cyber Security & Investigation Training Courses

Providing training internationally fronm the UK’s most experienced and knowledgeable practitioners

Comprehensive training courses

Everybody engaged or involved with First Response Training is a specialist in their own field, having gained that knowledge and experience through a law enforcement, military, intelligence or specialist career.

First Response only provide training courses that are written or delivered by the best practitioners available. Our trainers are active operators who also teach, which ensures that our courses are always up-to-date, reflecting not just changes in technology, but industry best practice and compliance with laws and regulations across the various jurisdictions we operate in. We offer a catalogue of specialist training courses and the ability to deliver ‘ad-hoc’ packages to suit your particular requirements.

Whether you’re running an in-house investigations team, part of corporate security or a law enforcement agency, our courses are the perfect starting point for those that examine computer data as part of their day to day operations.

If you don’t see the particular course you and your team need, let us know as we are constantly expanding our portfolio of courses based on client feedback.

First Responder (Foundation)

This 1 day course takes help-desk and IT staff who are typically the first ‘on scene’ when some form of internal investigation involving computer data is required. The course provides detailed awareness on the fragile nature of digital evidence, the acquisition process, evidential integrity and continuity, and explores the legal implications of various first responder actions.

First Responder (Advanced)

The three day course builds on the foundation course and provides delegates with hands-on sessions using tools to forensically acquire digital data from a variety of sources, some basic analysis capabilities using free tools, writing up results, preparing statements and assisting with internal disciplinary procedures and interviews, as well as giving evidence at a tribunal or court.

Use of on-line false personas in investigations

This 1 day practical course is designed to enable delegates to build, maintain and deploy passive ‘on-line false personas’ for use in Internet based investigations. It covers organisational management and operator trade craft in deploying such a technique.

Open Source investigation, the internet and compromise

This is a 1 day introductory session for investigative professionals who use the internet to conduct research or investigations. It is also suitable for those who wish to protect themselves on-line.
It can act as a refresher session for those who have already undertaken training in these areas.

Foundation Internet and Open Source Investigation course

This 3 day course is designed for those who use the Internet to conduct research or investigations and forms the basis for further training.

Intermediate Open Source Investigation course

This 4 day immersive learning course is suitable for those who use the internet to conduct open source investigations or intelligence research. Delegates will undertake a number of on-line exercises throughout the course with a final exercise using the skills they have learned over the 4 days.

Cybercrime Investigator (Foundation)

This 4 day course suitable for those who investigate cyber enabled and cyber dependent crime. It covers current trends and threats and follows the First Response investigative centric approach, ensuring that all material complies with criminal justice rules and procedures, the intention being that it is admissible in courts and tribunals.


  • Cybercrime investigator investigation basics
  • Investigation strategy
  • Build your case file
  • Witness statements
  • Exhibits & Chain of Custody
  • Open Source sites & tools
  • Forensic Tools
  • Forensic imaging
  • Introduction to Networks
  • Introduction to investigating cybercrime

Cybercrime Investigator (Advanced)

This 4 day course builds on the foundation techniques and as such they should have attended the First Response Cybercrime Investigator (Foundation) course or similar.
The course suitable for those who investigate serious and complex cyber enabled and cyber dependent crime.


  • How to conduct investigations into online criminal activities
  • Technical tools used in the commission of cybercrime.
  • Wi-Fi in cybercrime investigations.
  • Deep and dark Web in cybercrime.
  • Investigation of Unix based systems
  • International organisations and partners that can support a complex cybercrime investigation.
  • Prepare and present case papers to a prosecutor as they relate to a complex cybercrime investigation

Bespoke Training

Aside from the courses set out above, we can also develop and deliver bespoke training courses to meet specific requirements. We will provide lunch and materials and can conduct the training at your site or ours. Discounts are available when we train on-site.

For more detailed information on any of these courses, or to discuss your specific needs, give our Training Director, Andrea Bradley a call on +44 207 193 4905.