View our online, instructor-led courses that are coming soon and check out the on-demand courses available to you today. All courses can also be purchased using Expertise On Demand (EOD) units.
Learn more about Mandiant Expertise On Demand (EOD).
Linux Enterprise Incident Response
🗓 October 6–9, 2025 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
🗓 October 7–10, 2025 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 APAC 🌣 🕒 8:00 AM–2:30 PM Singapore UTC+8 • 10:00 AM–4:30 PM Sydney UTC+10
Incident Response for Management
🗓 October 13–15, 2025 (3 days) 💻 Online (instructor-led) 📚 $3,000 USD or 3 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
Linux Enterprise Incident Response
🗓 October 13–16, 2025 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 EMEA 🌣 • APAC evening ⏾ 🕒 8:00 AM–2:30 PM London UTC+1 • 3:00 PM–9:30 PM Singapore UTC+8
🗓 October 20–23, 2025 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
Windows Enterprise Incident Response
🗓 October 27–30, 2025 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
🗓 October 27–30, 2025 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 EMEA 🌣 • APAC evening ⏾ 🕒 8:00 AM–2:30 PM London UTC+0 • 3:00 PM–9:30 PM Singapore UTC+8
ThreatSpace: Triage and Investigations Workshop
🗓 November 3–4, 2025 (2 days) 💻 In-person in Sydney, Australia (instructor-led) 📚 $4,000 USD or 4 units
🌎 Sydney, Australia 🌣 🕒 8:30 AM–4:30 PM, daily
Incident Response in Google Cloud
🗓 November 10–13, 2025 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
🗓 November 10–13, 2025 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 EMEA 🌣 • APAC evening ⏾ 🕒 8:00 AM–2:30 PM London UTC+0 • 3:00 PM–9:30 PM Singapore UTC+8
🗓 November 17–21, 2025 (5 days) 💻 Online (instructor-led) 📚 $5,000 USD or 5 units
🌎 EMEA 🌣 • APAC evening ⏾ 🕒 8:00 AM–2:30 PM London UTC+1 • 3:00 PM–9:30 PM Singapore UTC+8
Windows Enterprise Incident Response
🗓 November 24–27, 2025 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 EMEA 🌣 • APAC evening ⏾ 🕒 8:00 AM–2:30 PM London UTC+0 • 4:00 PM–10:30 PM Singapore UTC+8
Cyber Team Response Lead (CTRL) Course
🗓 November 24–28, 2025 (5 days) 💻 In-person (instructor-led) 📚 $5,750 USD or 5 units
🌎 Sydney, Australia 🌣 🕒 8:30 AM–4:30 PM Australia/Sydney
🗓 December 1–4, 2025 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
Windows Enterprise Incident Response
🗓 December 1–4, 2025 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
Linux Enterprise Incident Response
🗓 December 8–11, 2025 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
🗓 December 8–11, 2025 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-8 • 4:00 PM–10:30 PM London UTC+0
🗓 December 8–12, 2025 (5 days) 💻 Online (instructor-led) 📚 $5,000 USD or 5 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
Tabletop Exercise Train the Trainer (TTX T3)
🗓 December 9–11, 2025 (3 days) 💻 In-person (instructor-led) 📚 $4,250 USD or 4 units
🌎 Sydney, Australia 🌣 🕒 8:30 AM–4:30 PM Australia/Sydney
Windows Enterprise Incident Response
🗓 December 9–12, 2025 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 APAC 🌣 🕒 8:00 AM–2:30 PM Singapore UTC+8 • 11:00 AM–5:30 PM Sydney UTC+11
🗓 January 12–15, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
🗓 January 19–23, 2026 (5 days) 💻 Online (instructor-led) 📚 $5,000 USD or 5 units
🌎 EMEA 🌣 • APAC evening ⏾ 🕒 8:00 AM–2:30 PM London UTC+0 • 4:00 PM–10:30 PM Singapore UTC+8
Building a Resilient Cyber Security Program
🗓 January 21–23, 2026 (3 days) 💻 Online (instructor-led) 📚 $3,000 USD or 3 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–1:30 PM Los Angeles UTC-7 • 4:00 PM–9:30 PM London UTC+1
🗓 January 20–23, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 APAC 🌣 🕒 8:00 AM–2:30 PM Singapore UTC+8 • 10:00 AM–4:30 PM Sydney UTC+10
Windows Enterprise Incident Response
🗓 January 26–29, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
🗓 January 26–29, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 EMEA 🌣 • APAC evening ⏾ 🕒 8:00 AM–2:30 PM London UTC+0 • 4:00 PM–10:30 PM Singapore UTC+8
Linux Enterprise Incident Response
🗓 February 2–5, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
Windows Enterprise Incident Response
🗓 February 3–6, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 APAC 🌣 🕒 8:00 AM–2:30 PM Singapore UTC+8
Incident Response in Google Cloud
🗓 February 9–12, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
Building a Resilient Cyber Security Program
🗓 February 16–18, 2026 (3 days) 💻 Online (instructor-led) 📚 $3,000 USD or 3 units
🌎 EMEA 🌣 • APAC evening ⏾ 🕒 8:00 AM–1:30 PM London UTC+0 • 4:00 PM–9:30 PM Singapore UTC+8
Incident Response for Management
🗓 February 18–20, 2026 (3 days) 💻 Online (instructor-led) 📚 $3,000 USD or 3 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
🗓 February 23–26, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
Windows Enterprise Incident Response
🗓 February 23–26, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 EMEA 🌣 • APAC evening ⏾ 🕒 8:00 AM–2:30 PM London UTC+0 • 4:00 PM–10:30 PM Singapore UTC+8
🗓 February 23–27, 2025 (5 days) 💻 Online (instructor-led) 📚 $5,000 USD or 5 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
Windows Enterprise Incident Response
🗓 March 2–5, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
Fundamentals of Industrial Control Systems (ICS) Security
🗓 March 9–11, 2026 (3 days) 💻 Online (instructor-led) 📚 $3,000 USD or 3 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–1:30 PM Los Angeles UTC-7 • 3:00 PM–8:30 PM London UTC+1
Linux Enterprise Incident Response
🗓 March 9–12, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 EMEA 🌣 • APAC evening ⏾ 🕒 8:00 AM–2:30 PM London UTC+0 • 4:00 PM–10:30 PM Singapore UTC+8
🗓 March 16–19, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 3:00 PM–9:30 PM London UTC+1
Linux Enterprise Incident Response
🗓 March 17–20, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 APAC 🌣 🕒 8:00 AM–2:30 PM Singapore UTC+8
Building a Resilient Cyber Security Program
🗓 April 8–10, 2026 (3 days) 💻 Online (instructor-led) 📚 $3,000 USD or 3 units
🌎 APAC 🌣 🕒 8:00 AM–1:30 PM Singapore UTC+8
🗓 April 13–16, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
Linux Enterprise Incident Response
🗓 April 13–16, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
🗓 April 13–17, 2026 (5 days) 💻 Online (instructor-led) 📚 $5,000 USD or 5 units
🌎 EMEA 🌣 • APAC evening ⏾ 🕒 8:00 AM–2:30 PM London UTC+0 • 3:00 PM–9:30 PM Singapore UTC+8
Windows Enterprise Incident Response
🗓 April 14–17, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 APAC 🌣 🕒 8:00 AM–2:30 PM Singapore UTC+8
Windows Enterprise Incident Response
🗓 April 20–23, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
🗓 April 20–23, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 EMEA 🌣 • APAC evening ⏾ 🕒 8:00 AM–2:30 PM London UTC+0 • 3:00 PM–9:30 PM Singapore UTC+8
Fundamentals of Industrial Control Systems (ICS) Security
🗓 April 27–29, 2026 (3 days) 💻 Online (instructor-led) 📚 $3,000 USD or 3 units
🌎 EMEA 🌣 • APAC evening ⏾ 🕒 8:00 AM–1:30 PM London UTC+0 • 3:00 PM–8:30 PM Singapore UTC+8
Building a Resilient Cyber Security Program
🗓 April 27–29, 2026 (3 days) 💻 Online (instructor-led) 📚 $3,000 USD or 3 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–1:30 PM Los Angeles UTC-7 • 4:00 PM–9:30 PM London UTC+1
🗓 May 4–8, 2026 (5 days) 💻 Online (instructor-led) 📚 $5,000 USD or 5 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
Incident Response in Google Cloud
🗓 May 11–14, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
🗓 May 12–15, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 APAC 🌣 🕒 8:00 AM–2:30 PM Singapore UTC+8
Incident Response for Management
🗓 May 18–20, 2026 (3 days) 💻 Online (instructor-led) 📚 $3,000 USD or 3 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
Windows Enterprise Incident Response
🗓 May 18–21, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 EMEA 🌣 • APAC evening ⏾ 🕒 8:00 AM–2:30 PM London UTC+0 • 3:00 PM–9:30 PM Singapore UTC+8
Windows Enterprise Incident Response
🗓 May 26–29, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 APAC 🌣 🕒 8:00 AM–2:30 PM Singapore UTC+8
Windows Enterprise Incident Response
🗓 June 1–4, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
🗓 June 1–4, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 EMEA 🌣 • APAC evening ⏾ 🕒 8:00 AM–2:30 PM London UTC+0 • 3:00 PM–9:30 PM Singapore UTC+8
Building a Resilient Cyber Security Program
🗓 June 8–10, 2026 (3 days) 💻 Online (instructor-led) 📚 $3,000 USD or 3 units
🌎 EMEA 🌣 • APAC evening ⏾ 🕒 8:00 AM–1:30 PM London UTC+0 • 3:00 PM–8:30 PM Singapore UTC+8
🗓 June 8–11, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
🗓 June 22–25, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
Fundamentals of Industrial Control Systems (ICS) Security
🗓 June 29–July 1, 2026 (3 days) 💻 Online (instructor-led) 📚 $3,000 USD or 3 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–1:30 PM Los Angeles UTC-7 • 4:00 PM–9:30 PM London UTC+1
Linux Enterprise Incident Response
🗓 July 6–9, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
Windows Enterprise Incident Response
🗓 July 13–16, 2026 (4 days) 💻 Online (instructor-led) 📚 $4,000 USD or 4 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
🗓 July 20–24, 2026 (5 days) 💻 Online (instructor-led) 📚 $5,000 USD or 5 units
🌎 Americas 🌣 • EMEA evening ⏾ 🕒 8:00 AM–2:30 PM Los Angeles UTC-7 • 4:00 PM–10:30 PM London UTC+1
Basic Static and Dynamic Analysis (16 hours) $2,000 USD or 2 units Register now
Cyber Intelligence Foundations (24 hours) $3,000 USD or 3 units or 2 Analyst Access Entitlements Register now
Cyber Intelligence Production (8 hours) $2,000 USD or 2 units or 1 Analyst Access Entitlement Register now
Cyber Threat Intelligence Program Design Playbook (6 hours) $2,000 USD or 2 units or 1 Analyst Access Entitlement Register now
Election Security (16 hours) $2,000 USD or 2 units or 1 Analyst Access Entitlement Register now
Inside the Mind of an APT (14 hours) $2,000 USD or 2 units or 1 Analyst Access Entitlement Register now
Intelligence Research I—Scoping (8 hours) $2,000 USD or 2 units or 1 Analyst Access Entitlement Register now
Intelligence Research II—Open Source Intelligence (OSINT) (16 hours) $2,000 USD or 2 units or 1 Analyst Access Entitlement Register now
Introduction to Threat Intelligence and Attribution (8 hours) $2,000 USD or 2 units or 1 Analyst Access Entitlement Register now
Protecting the Perimeter: Practical Network Enrichment (8 hours) $2,000 USD or 2 units Register now