AI-Powered Threats
Three of the most consequential AI-enabled attacks of the last two years, rebuilt as investigations you work rather than cases you are told about. Participants analyse the actual artefacts — headers, call metadata, transcripts — and reach a verdict, the way the analyst on the queue had to.
This workshop is no longer offered as a scheduled open session. The material now runs inside our weekend cohorts, which have published dates and seats you can book today. It is still available as a private session for a single team or institution.
See the weekend cohorts →- Format
- Hands-on labs · self-paced or facilitated
- Duration
- Half day · 3 micro-projects
- Who it is for
- SOC analysts, security teams, working professionals
What you leave able to do
- Triage a business email compromise where the "proof" is a deepfaked video call
- Spot the metadata tells in a cloned-voice vishing attempt
- Separate AI-written phishing from human-written phishing on evidence, not instinct
- Write the escalation the way a SOC lead needs to read it
Run of play
- 1
The $25M deepfake call
The Arup Engineering case. Work the CFO email, the meeting invite and the WhatsApp metadata, and find where the story breaks.
- 2
The cloned voice
The Ferrari attempt. Call transcript and message metadata, and the one question that ended it.
- 3
Spot the AI phish
Two emails, one human-written and one machine-written. Decide which is which and defend the call.
Case-led
Built on real, named cases
Every scenario in this session is drawn from a documented incident rather than an invented one.
- Arup Engineering deepfake video call, February 2024 — $25M
- Ferrari CEO voice-clone attempt, 2024
- IBM research on AI-generated phishing, 2024
What runs now
This format now runs as a dated cohort
The material from this workshop is taught across the AI SOC Analyst weekend cohort, which has published dates and seats you can book today.
Sat 17 Oct 2026
Foundations and the first alert
Sat 24 Oct 2026
AI-era phishing and the initial foothold
Sat 31 Oct 2026
Endpoint investigation and containment
Sat 14 Nov 2026
Cloud SOC and lateral movement
Sat 21 Nov 2026
Detection engineering and automation
Sat 28 Nov 2026
Immersive day and certification exam
Or take the full programme
Six Saturdays live, plus three months of the complete lab course.
Other courses running now
Prerequisites
None. A browser is enough — the labs run in the cloud.
Want this run for your team?
Sessions are scoped to the audience — a placement cell, a security team and a leadership group each need a different shape. Tell us who it is for and we will come back with a format and a date.