CREST Practitioner Intrusion Analyst (CPIA)
About This Course
The CREST Practitioner Intrusion Analyst (CPIA) course is a five-day, intensive programme mapped directly to the CREST CPIA technical syllabus, designed to develop highly skilled practitioners in the fields of incident handling and technical analysis. The curriculum is deeply rooted in critical industry competencies, deliberately focusing on Cyber and Data Breach Incident Management, Threat and Vulnerability Management, and Digital Forensics to accurately reflect the core investigative nature of the syllabus.
Organised into six comprehensive domains, the course guides learners through the complete engagement lifecycle, from legal compliance and threat assessment to advanced network intrusion analysis and reverse engineering. Participants will acquire the hands-on capabilities required to identify and prioritise cyber threats, extract crucial evidence from host systems, analyse malware behaviour, and execute systematic digital forensics to detect, report, and resolve sophisticated cyber intrusions effectively.
What You'll Learn
• Learning Outcome 1: Apply Cyber and Data Breach Incident Management principles to construct defensible incident timelines, ensure legal compliance, and manage end-to-end intrusion analysis engagements.
• Learning Outcome 2: Communicate technical findings clearly through structured interim and final reporting to support stakeholder decision-making, rapid containment, and situation resolution.
• Learning Outcome 3: Execute Threat and Vulnerability Management by evaluating risks across networks, hosts, and applications, and recommending proportionate mitigations to reduce organisational exposure.
• Learning Outcome 4: Analyse network traffic, access controls, and log data to detect unusual protocol behaviour, beaconing, command-and-control channels, and data exfiltration.
• Learning Outcome 5: Conduct Digital Forensics on Windows file systems, registry hives, and volatile memory to forensically acquire data, recover hidden artefacts, and reconstruct host intrusions.
• Learning Outcome 6: Perform static and dynamic reverse engineering on malware to bypass anti-forensic countermeasures, identify infection vectors, and extract actionable indicators of compromise.
Entry Requirements
At least 1 year of working experience in IT administration, network administration, technical support, security operations, incident response, or related technology functions
Foundational understanding of computer networks, operating systems and cybersecurity concepts
Familiarity with system logs, networking protocols and security monitoring activities
Ability to analyse technical information and follow documented investigation procedures
Working proficiency in Microsoft Office applications (Word, Excel, PowerPoint)
Ability to speak, listen, read and write English at a proficiency level equivalent to the Employability Skills Workforce Skills Qualification (ES WSQ) Workplace Literacy (WPL) Level 6