IT Security and Cybercrime Prevention Training

About This Course

In an era of accelerating digital transformation, cyber threats have become one of the most significant risks facing organisations across every sector. From ransomware attacks and phishing campaigns to insider threats and advanced persistent threats, the cybercrime landscape grows more sophisticated by the day. Organisations that fail to invest in robust IT security capabilities risk not only financial losses but also reputational damage, regulatory penalties, and operational disruption.

TrainingComplex's IT Security and Cybercrime Prevention Training is a comprehensive, ten-day programme designed to build deep technical and strategic competence in cybersecurity. The course goes beyond theory, immersing participants in real-world scenarios, live tool demonstrations, and structured exercises that mirror the challenges security professionals encounter daily. Participants will gain fluency in global security frameworks such as ISO 27001, NIST, and the CIS Controls, while also developing practical skills in network security, vulnerability assessment, incident response, digital forensics, and cybercrime law.

The programme is structured to serve both the technical practitioner who needs hands-on skills and the manager or compliance officer who needs to understand risk governance and policy. By the end of the training, participants will be equipped to assess their organisation's current security posture, implement preventive controls, detect and investigate incidents, and drive a culture of security awareness across their teams. Whether you are looking to formalise your existing knowledge, respond to a recent incident, or build a security function from the ground up, this course provides the rigour and practical grounding needed to make a measurable difference.

Who Should Attend

IT managers, systems administrators, and network engineers responsible for organisational infrastructure
Cybersecurity analysts and information security officers at all experience levels
Compliance, risk, and audit professionals managing cyber-related regulatory obligations
Legal and governance officers handling data protection and cybercrime legislation
Senior managers and executives who oversee digital transformation or technology strategy
Government and public sector ICT officers responsible for national or institutional data security
Financial services professionals managing fraud prevention and digital banking security
Consultants and advisors supporting clients with ICT governance and security audits

Learning Objectives

Explain the current cyberthreat landscape, including the types, motivations, and methods of cybercriminals
Apply leading security frameworks including ISO 27001, NIST Cybersecurity Framework, and CIS Controls to organisational contexts
Conduct structured risk assessments and develop risk treatment plans aligned to business objectives
Design and implement network security architectures including firewalls, VPNs, IDS/IPS, and segmentation strategies
Perform vulnerability assessments and penetration testing using industry-standard tools and methodologies
Develop and operationalise an incident response plan, including containment, eradication, and recovery procedures
Apply digital forensics principles to preserve evidence, investigate incidents, and support legal proceedings
Assess the legal and regulatory environment governing cybercrime and data protection in their jurisdiction
Build and deliver effective security awareness programmes to reduce human-factor risks across the organisation
Secure cloud environments, mobile devices, and remote access systems against common attack vectors
Evaluate third-party and supply chain risks and implement appropriate vendor security controls
Prepare comprehensive IT security policies, standards, and governance documentation fit for audit and certification

Course Modules

Module 1: The Cyberthreat Landscape and Attacker Mindset

Evolution of cybercrime: from opportunistic hacking to organised criminal enterprises and state-sponsored attacks
Threat actor profiling: motivations, capabilities, and tactics of hackers, insiders, and advanced persistent threats
Common attack vectors: phishing, social engineering, malware, ransomware, and zero-day exploits
Emerging threats: AI-assisted attacks, deepfakes, supply chain compromises, and IoT vulnerabilities
The attacker lifecycle and kill chain models: how adversaries plan, execute, and persist within target environments
Threat intelligence sources and feeds: using open-source, commercial, and sector-specific intelligence to anticipate attacks

Module 2: IT Security Frameworks and Governance

Overview of ISO/IEC 27001, NIST Cybersecurity Framework, and CIS Controls in organisational practice
Building an Information Security Management System (ISMS): scope, policy, and top management commitment
Security roles and responsibilities: CISO, security operations, and governance committee structures
Aligning cybersecurity strategy with enterprise risk management and business objectives
Measuring the effectiveness of security governance: key performance indicators, audit cycles, and management review processes
Navigating multiple overlapping frameworks: selecting, combining, and tailoring standards to fit organisational context and sector requirements

Module 3: Cyber Risk Assessment and Management

Conducting asset identification and classification for information and technology assets
Threat and vulnerability analysis: qualitative and quantitative risk assessment methodologies
Risk treatment options: mitigation, transfer, acceptance, and avoidance with practical application
Documenting the risk register and communicating cyber risk to senior management and the board
Integrating threat intelligence into the risk assessment process to ensure ratings reflect the current threat environment
Reviewing and maintaining the risk assessment cycle: trigger events, periodic reviews, and continuous risk monitoring practices

Module 4: Network Security Architecture and Design

Fundamentals of secure network design: segmentation, DMZs, and defence-in-depth principles
Firewall configuration, intrusion detection and prevention systems (IDS/IPS), and traffic monitoring
VPN technologies, secure remote access, and zero-trust network access (ZTNA) principles
Wireless network security: WPA3, rogue access point detection, and guest network isolation
Network access control (NAC): enforcing device compliance and restricting lateral movement within the corporate network
Encryption in transit: TLS configuration best practices, certificate management, and eliminating legacy insecure protocols

Module 5: Vulnerability Assessment and Ethical Hacking

Vulnerability scanning methodologies and tools: Nessus, OpenVAS, and Qualys in practice
Penetration testing phases: reconnaissance, scanning, exploitation, and reporting
Web application security: OWASP Top 10 vulnerabilities and common remediation techniques
Ethical and legal boundaries of penetration testing: scope, authorisation, and responsible disclosure
Red team versus blue team exercises: simulating adversarial tactics to test detection and response capabilities under realistic conditions
Vulnerability prioritisation and remediation tracking: using CVSS scores, exploitability context, and asset criticality to drive patching decisions

Module 6: Endpoint, Identity, and Access Management Security

Hardening endpoints: patch management, application whitelisting, and endpoint detection and response (EDR)
Identity and access management: role-based access control, least privilege, and privileged access management
Multi-factor authentication implementation strategies and common bypass attack prevention
Mobile device management (MDM) and bring-your-own-device (BYOD) security policy frameworks
User lifecycle management: provisioning, periodic access reviews, and timely de-provisioning to prevent orphaned account risk
Directory services security: securing Active Directory and cloud identity providers against credential attacks, pass-the-hash, and Kerberoasting

Module 7: Cloud Security and Remote Work Environments

Cloud shared responsibility models: understanding security obligations in AWS, Azure, and Google Cloud
Securing cloud storage, virtual machines, and containerised workloads against misconfiguration attacks
Remote workforce security: secure collaboration tools, VPN policies, and home network risk management
Cloud security posture management (CSPM) and continuous configuration monitoring
Identity and access management in cloud environments: federated identity, service account hygiene, and managing over-privileged cloud roles
Securing CI/CD pipelines and DevSecOps practices: integrating security controls into build, test, and deployment workflows to prevent code-level compromise

Module 8: Cybercrime Law, Data Protection, and Regulatory Compliance

Overview of cybercrime legislation across key jurisdictions: Computer Misuse Acts, Budapest Convention, and African Union Convention on Cyber Security
Data protection regulations: GDPR, Kenya Data Protection Act, POPIA, and NDPR obligations for organisations
Reporting obligations: breach notification timelines, regulatory engagement, and law enforcement cooperation
Ethical dimensions of cybersecurity: privacy rights, surveillance, and responsible use of security tools
Cross-border data transfers and jurisdictional challenges: adequacy decisions, standard contractual clauses, and managing multi-jurisdiction compliance
Building a compliance monitoring programme: internal audits, regulatory horizon scanning, and maintaining up-to-date records of processing activities

Module 9: Incident Detection, Response, and Recovery

Building a security operations function: SIEM tools, log management, and alert triage workflows
Incident classification and escalation: severity levels, communication trees, and crisis management protocols
Containment, eradication, and recovery procedures aligned to the NIST incident response lifecycle
Post-incident review: root cause analysis, lessons learned documentation, and control improvement
Developing and exercising incident response plans: tabletop simulations, red team scenarios, and ensuring staff readiness before a real event occurs
Coordinating with external stakeholders during incidents: law enforcement liaison, cyber insurance notification, and managing public or media communications

Module 10: Digital Forensics and Evidence Management

Principles of digital forensics: chain of custody, evidence integrity, and forensic readiness planning
Forensic acquisition techniques: disk imaging, memory capture, and network traffic analysis
Investigating common incidents: ransomware infections, insider data theft, and account compromise
Preparing forensic reports and supporting legal proceedings or disciplinary processes
Cloud and mobile forensics: challenges of acquiring evidence from cloud-hosted environments, encrypted devices, and ephemeral container workloads
Anti-forensics awareness: recognising log tampering, file deletion artefacts, and timestamp manipulation to ensure investigations are not misled by attacker counter-measures

Module 11: Third-Party, Supply Chain, and Vendor Security

Mapping and assessing supply chain cyber risks across hardware, software, and service providers
Vendor security assessment frameworks: due diligence questionnaires, audits, and contractual requirements
Managing access granted to third parties: privileged remote access controls and activity monitoring
Incident coordination with external partners and managing breach notification in multi-party environments
Software supply chain integrity: verifying code provenance, managing open-source dependencies, and responding to compromised software updates
Ongoing third-party risk governance: periodic reassessment schedules, risk tiering of suppliers, and offboarding procedures to close residual access when relationships end

Module 12: Security Awareness, Culture, and Human Factor Risk

The human element in cybersecurity: psychology of social engineering and why technical controls alone are insufficient
Designing and delivering effective security awareness training programmes for diverse staff audiences
Phishing simulation campaigns: planning, execution, measurement, and follow-up coaching
Building a security-aware culture: leadership buy-in, incentive structures, and continuous reinforcement strategies
Tailoring awareness content to role-specific risks: finance teams, executives, IT staff, and remote workers each face distinct threat profiles requiring targeted messaging
Measuring the impact of awareness programmes: tracking click rates, reporting behaviour, knowledge assessment scores, and demonstrating return on investment to management

Module 13: IT Security Policy Development and Organisational Roadmap

Drafting core security policies: acceptable use, password management, incident response, and data classification
Conducting a security maturity assessment and benchmarking against industry standards
Developing a prioritised cybersecurity improvement roadmap aligned to budget and risk appetite
Presenting the security programme to leadership: communicating risk in business language and securing organisational investment
Policy lifecycle management: establishing review cycles, version control, staff attestation processes, and handling policy exceptions in a controlled manner
Embedding security into organisational change processes: ensuring new projects, mergers, acquisitions, and system deployments trigger appropriate security review from the outset

Requirements & Prerequisites

Participants should have a working knowledge of IT systems, networking concepts, or information management gained through professional experience or formal study. Familiarity with basic network components such as routers, switches, and firewalls is recommended. Prior experience in a dedicated cybersecurity role is helpful but not required, as the programme is designed to accommodate motivated professionals transitioning into security-focused responsibilities.

Training Methodology

Simulated cyberattack and defence exercises using sandboxed lab environments that replicate real organisational networks
Live demonstrations of ethical hacking tools including Kali Linux, Wireshark, Metasploit, and Nessus, with guided hands-on practice
Case study analysis of high-profile cybercrime incidents drawn from African, Middle Eastern, and global contexts
Scenario-based incident response tabletop exercises requiring teams to contain, investigate, and recover from a simulated breach
Digital forensics workshops where participants collect, preserve, and analyse evidence from compromised systems
Policy drafting workshops in which participants produce actual security policies, acceptable use statements, and incident response plans for their own organisations
Group risk assessment sessions applying the ISO 27001 and NIST frameworks to supplied organisational profiles
Panel discussions and facilitated debate on cybercrime law, ethics, and the evolving regulatory environment
Peer review of participants' vulnerability assessment reports with structured expert feedback
Reflection journals and individual action planning to translate learning into immediate workplace improvements

Organisational Benefits

Reduced exposure to cyber incidents, data breaches, and associated financial and reputational costs
Strengthened compliance posture against data protection regulations and sector-specific cybersecurity mandates
A more capable and confident in-house security team, reducing dependence on costly external contractors
Improved incident response times and better-documented recovery procedures that limit operational downtime
Greater executive and board-level understanding of cyber risk, enabling more informed strategic decision-making
A security-aware workforce culture that treats cyber hygiene as a shared organisational responsibility
Better vendor and third-party risk management, closing common gaps in the organisational security perimeter
Readiness for ISO 27001 certification or other internationally recognised security accreditation processes

Where Is IT Security and Cybercrime Prevention Training Offered?

This course runs in-person across: Johannesburg, Mombasa, Nakuru, Lagos, Riyadh, Dar es Salaam, Nairobi, Zanzibar, Kigali, Cape Town, Dubai, Abuja, Accra, Naivasha, Kampala, Pretoria, Addis Ababa, Arusha, Kisumu, plus Live Virtual (online) cohorts. Browse live dates for your city below.

Upcoming Schedules

Location	Format	Dates	Price
Johannesburg, South Africa	In-Person	5 Oct 2026 – 16 Oct 2026	USD 7,000
Mombasa, Kenya	In-Person	5 Oct 2026 – 16 Oct 2026	KES 230,000
Nakuru, Kenya	In-Person	12 Oct 2026 – 23 Oct 2026	KES 230,000
Lagos, Nigeria	In-Person	12 Oct 2026 – 23 Oct 2026	USD 5,000
Live Virtual	Online	17 Oct 2026 – 6 Dec 2026	KES 160,000
Riyadh, Saudi Arabia	In-Person	19 Oct 2026 – 28 Oct 2026	USD 9,000
Dar es Salaam, Tanzania	In-Person	19 Oct 2026 – 30 Oct 2026	USD 4,600
Nairobi, Kenya	In-Person	19 Oct 2026 – 28 Oct 2026	KES 230,000
Zanzibar, Tanzania	In-Person	19 Oct 2026 – 28 Oct 2026	USD 5,000
Kigali, Rwanda	In-Person	19 Oct 2026 – 28 Oct 2026	USD 3,800
Cape Town, South Africa	In-Person	19 Oct 2026 – 28 Oct 2026	USD 7,600
Dubai, United Arab Emirates	In-Person	19 Oct 2026 – 30 Oct 2026	USD 8,200
Abuja, Nigeria	In-Person	19 Oct 2026 – 28 Oct 2026	USD 5,600
Accra, Ghana	In-Person	26 Oct 2026 – 4 Nov 2026	USD 7,600
Naivasha, Kenya	In-Person	26 Oct 2026 – 4 Nov 2026	KES 240,000

+232 more dates — view live schedule →

Frequently Asked Questions

Do I need to be a cybersecurity specialist to attend this course?

No specialist background is required, though participants should have general IT or information management experience. The programme is structured to build progressively, making it accessible to IT generalists, compliance officers, and managers while still offering sufficient depth for those with existing security knowledge.

Will participants get hands-on practice with real security tools?

Yes. The course includes structured lab sessions using industry-standard tools such as Kali Linux, Wireshark, Nessus, and SIEM platforms in a controlled sandboxed environment. Facilitators guide participants through practical exercises so that tool exposure translates into usable skills rather than passive observation.

What certification will I receive upon completing the course?

Participants who attend the full programme and complete the required exercises will receive a Certificate of Completion from TrainingComplex. The course also provides foundational knowledge that supports preparation for internationally recognised certifications such as CompTIA Security+, CEH, and CISSP, which participants may pursue independently.

Is the course content relevant to my country's legal and regulatory context?

Yes. The programme covers cybercrime legislation and data protection regulations across multiple jurisdictions including East Africa, West Africa, Southern Africa, and the Middle East, as well as international frameworks like the GDPR and the Budapest Convention. Facilitators draw on locally relevant case studies and adapt regulatory discussions to the participants' operating contexts.

Can this training be delivered in-house for our organisation's IT and security team?

Absolutely. TrainingComplex offers customised in-house delivery of this programme, allowing the content, case studies, and practical exercises to be tailored specifically to your organisation's systems, policies, and threat environment. Contact us to discuss scheduling, group size, and any bespoke content requirements.

View Live Schedule & Book →