Digital, AI and Cyber Security
Cyber Security
Cybersecurity and Enterprise Resilience
Defending an organisation that cannot be made secure, and continuing to operate once something has got through.
- Duration
- 5 days
- Contact hours
- 30
- Level
- Intermediate
- Fee from
- US$1,500
Overview
Security programmes fail in a predictable way: controls are bought, the inventory is incomplete, and nobody has tested what happens when an attacker is already inside. Resilience is the other half and usually the weaker one, because recovery plans are written once and never exercised against a scenario in which the recovery systems are themselves affected. This week treats the two together, from identifying what the organisation cannot operate without to running an incident and getting back. Delegates work from their own environment and leave with a tested plan rather than a document.
Who should attend
Information security managers and officers, IT managers responsible for infrastructure and recovery, risk and continuity managers, and internal auditors reviewing security.
What you will be able to do
- Identify what the organisation cannot operate without, and what depends on it.
- Prioritise controls against the way attacks actually arrive rather than against a checklist.
- Detect an intrusion that is already inside the perimeter.
- Run an incident with a defined command structure, including the decisions nobody wants to take.
- Test a recovery plan against a scenario where the recovery systems are affected.
How it is taught
Short input, then work, across 5 days of roughly 6 teaching hours each. Exercises run on situations delegates bring rather than on a case study written for a different organisation. Cohorts are capped so that everybody is asked something.
Available as classroom, live online, in house.
Programme outline
Day 1
What is actually being defended
- Asset and dependency inventory, and why it is always incomplete
- What the organisation cannot operate without, and for how long
- Threats this organisation faces, not threats in general
- Accepting that some compromise is certain
Day 2
Controls worth the money
- Identity, patching and backup, and why they stay first
- Segmentation, so one compromise is not every compromise
- A framework as a checklist against a framework as a plan
- Third parties, and the access nobody is tracking
Day 3
Detection
- Assuming presence, and looking for it
- Logging that would show what you need afterwards
- Alert volume, and the backlog problem
- Exercising detection rather than assuming it works
Day 4
Running an incident
- Command, roles and who is allowed to decide
- Containment against preserving evidence
- Communicating internally, to customers and to a regulator
- The hardest decisions, taken in advance
Day 5
Getting back
- Recovery when the recovery systems are affected
- Order of restoration, and the dependencies that dictate it
- Testing against a scenario rather than reading the plan
- What to change afterwards, and proving it changed
What you leave with
- A dependency map of the delegate's critical services, with single points of failure named.
- A prioritised control plan tied to the threats the organisation actually faces.
- An incident response and recovery plan with roles, thresholds and a tested escalation path.
Dates and fees
| Dates | Location | Format | Fee |
|---|---|---|---|
| 23 to 27 November 2026 | Dar es Salaam, Tanzania | Classroom | US$1,500 |
| 30 November 2026 to 4 December 2026 | Accra, Ghana | Classroom | US$1,500 |
| 7 to 11 December 2026 | Nairobi, Kenya | Classroom | US$1,500 |
| 14 to 18 December 2026 | Dubai, United Arab Emirates | Classroom | US$1,500 |
Fees are per delegate and cover tuition, all programme materials and the certificate. Travel, accommodation and visas are arranged by the delegate. Registration closes two weeks before a programme starts.
Certificate
A GATI certificate recording what was attended, issued after the programme has run and attendance has been taken. Attending at least 80 per cent of the days earns a certificate of completion; attending less earns a certificate of attendance stating exactly what was attended. Every certificate carries a code that anybody can check against GATI's own record.
It records participation. and GATI does not claim one it does not hold.