Agentic AI
SOC Operations
Training

SOC analysts, incident responders, engineers and cybersecurity bachelor's and master's students build and test the agents. For the build labs, you need basic Python and familiarity with incident investigations, gained through work, coursework or practical labs. Students apply their academic knowledge to SOC exercises and keep their code for portfolio projects or further research. Executives and SOC leaders join paired labs to assess findings, set approval rules and decide how to evaluate a pilot. All participants work through the same incident exercises and final review.

You will build a connected workflow for triage, investigation, security RAG, multi-agent orchestration and governed response. Maintain evidence-linked case records, test analyst handoffs and evaluate agents on malicious and benign cases. Keep your code, workflow graphs, retrieval pipelines, evaluation fixtures, policies, operational runbook and SOC pilot plan. Malware sandbox findings support investigations rather than forming a separate specialization.

Yes. The labs cover Microsoft Defender for Endpoint / Defender XDR and CrowdStrike Falcon. You retrieve investigation data, configure permissions and use supported response actions. You learn the authentication, data formats and capabilities of each integration. Response actions run only in the lab through the approval controls you build.

You build on Amazon Bedrock AgentCore and compare models from Anthropic and OpenAI with open-weight models on the same labeled SOC tasks. You assess evidence quality, latency, cost and data handling, then learn how to adapt an open-weight workflow for your own environment. Deployment, tool access and logging determine the data boundaries. We provide model access and the AWS environment; no prior AI or AWS experience is required.

No. Bring a laptop with a modern browser. We provide AI-CyberRangeX, AWS and model access, with no personal API keys or cloud bill. Public cohorts use synthetic or anonymized cases, so you do not need company data. Attack simulations and malware analysis stay inside the isolated range. You keep lab access for 30 days after the course; the environment is then removed. Private-cohort data and deployment boundaries are agreed during scoping.

Microsoft Defender and CrowdStrike Falcon remain the core EDR labs. Additional SIEM, identity, email and ticketing examples use labeled training fixtures or adapters. Platform logos describe transferable integration patterns, not a promise of a dedicated live environment for every vendor.

The capstone assesses evidence accuracy, retrieval quality, orchestration, appropriate escalation, approval enforcement, recovery from failures and operational reporting. You compare models on the same labeled cases and document limitations. This is practical professional development, not a job-placement guarantee or a substitute for production experience.

Yes. A team pack can be split across public 2027 dates. Any cohort can be attended virtually at the host city's hours. Private cohorts can be scoped around your working week and environment, with delivery agreed in advance. Lab access continues for 30 days after the course so participants can repeat the exercises.

In-person training is offered only when at least 10 participants choose in-person attendance for the same cohort. Apsispoint will confirm the delivery format before you make travel arrangements.

Within five business days, you receive participant skills reports, the final exercise scorecard, the agent and policy repository, and certificates with 40 CPE credits per participant. Your team also leaves with a SOC pilot plan covering the use case, model choice, data boundaries, approval owners and success measures. Participants have 30 more days of lab access to test changes.

Choose a public course date and ask about seats. When online checkout is available, you can also pay by card or US ACH bank debit. For a full team or private cohort, use the Contact us link to send a training inquiry. An advisor will discuss your group size, preferred format and dates within one business day. Purchase orders, company invoicing and vendor onboarding documents are available on request.

Transfer your seat to a later cohort or a colleague at no charge up to seven days before the first day. Cancel 14 or more days before the first day for a full refund. If you leave before the end of day one, your seat is refunded in full under the first-day guarantee. A private cohort can be rescheduled once at no charge with 14 days' notice.