Last reviewed 4 November 2026 against the sources linked in this post.
It is 2:10 am and the SIEM shows a login from a new country, followed by a mailbox rule that forwards invoices outside the company. The analyst on shift has the tools to see it. What decides the next hour is whether they know the playbook: who to wake, what to contain and what to preserve. That is the job of security incident response training. It is also expensive to get wrong: IBM's Cost of a Data Breach Report 2026 puts the global average cost of a breach at USD 4.99 million, a record high.
Certifications teach the tools. This list covers the process and policy around the alert. You get 9 ready-made courses in 3 groups, what each fixes and how to roll them out. Each group ends with an Our pick. The two legal points describe US federal rules, so use this as a syllabus, not a ruling.
All 9 courses at a glance
| Course | What it covers | Length | Law behind it? |
|---|---|---|---|
| IT security practitioner skills | Triage, SIEM and XDR workflows, hardening and exam practice | 45 min | No |
| Cyber incident response and breach reporting | The first ten minutes, reporting and a tabletop drill | 35 min | No |
| ISO/IEC 27001 and the ISMS | Policy to practice, exceptions and talking to an auditor | 40 min | No |
| Insider threat awareness | Risk indicators, recruitment methods and reporting | 30 min | Yes (US cleared contractors) |
| Phishing & social engineering | Red flags, verification and reporting | 30 min | No |
| Social engineering, fraud and deepfakes | Phone, payment and impersonation scams | 35 min | No |
| Security awareness essentials | The stages of an attack and core habits | 35 min | Yes (US covered financial institutions) |
| Passwords, passkeys and multi-factor authentication | Safe sign-ins, MFA, passkeys and fake sign-in pages | 30 min | No |
| AI security for everyone | Shadow AI, prompt injection and manipulated outputs | 30 min | No |
Two courses sit on a US federal rule, and only for some organisations. Under the NISPOM rule, cleared defence contractors must give newly cleared employees insider threat awareness training before granting access to classified information and validate initial and annual completion. The FTC Safeguards Rule says covered financial institutions must provide security awareness training to their personnel. Neither sets a course for everyone else.
Security operations and incident response
IT security practitioner skills: certification prep and security operations
This 45-minute course opens with "the alert nobody opened", then covers threats and attack stages, identity, access and certificate management, detection and response in SIEM and XDR workflows, cloud hardening and DevSecOps, and exam practice with incident write-ups. It grounds a new analyst in the daily work and the vocabulary of the common certifications. The "triage it" scenario, where learners rate severity and pick the next step, works well as a Pick Answer round.
Cyber incident response and breach reporting for non-specialists
Analysts follow this flow and teach it to everyone else. This 35-minute course covers the first ten minutes, the signs to spot and how to report, what the response team does next and why people stay silent under pressure. It ends with a tabletop drill of each learner's role. Run it with the business units whose late reports cost your SOC the most time, and use the drill to agree who calls whom.
ISO/IEC 27001 and the information security management system
This 40-minute course explains what an ISMS is, how policy becomes practice, how to handle exceptions and weaknesses, and how to talk to an auditor. Analysts who know the controls can tie an alert to the control it tested and keep the records an auditor will ask for. The "surprise audit question" opener makes a good Open Ended slide: ask the team what evidence they would show.
Our pick: IT security practitioner skills. It is the only course here built for the analyst seat itself, and the triage lesson turns a pile of alerts into a routine with an owner.
Insider threat and social engineering
Insider threat awareness
Insider threat indicators are one of the signals a SOC watches for, and analysts need to know what a behavioural signal looks like next to a technical one. This 30-minute course covers why detection matters, behavioural, technical and financial indicators, how adversaries recruit trusted insiders, what to do and not do, and where to report. It ends with a 10-question final check at 80% to pass. A "colleague copying folders late at night" scenario makes a strong Pick Answer question.
Phishing & social engineering
Phishing reports fill the SOC queue, and analysts both triage them and train users to send better ones. This 30-minute course explains how attacks are built, the red flags, how to protect yourself and how to respond and report. It ends with a 12-question final check at 80% to pass. A spot-the-red-flags round works as a Pick Answer quiz. For more attack types, see our guide to social engineering examples.
Social engineering, fraud and deepfakes: phone, payment and impersonation scams
Payment fraud and faked voices now reach the SOC as incident reports. This 35-minute course follows a convincing request, covers the tactics, how to verify a payment change, faked voice and video, and why seniority, politeness and secrecy are pressure, not proof. A Word Cloud on "why would someone skip the check?" shows which pressure to brief against. Help desks face the same calls: see our IT help desk training list.
Our pick: Insider threat awareness. It is the one threat here that starts inside the perimeter, so analysts who know the human indicators catch what the logs alone miss.
Account and AI security
Security awareness essentials
This 35-minute course sets the baseline your analysts reinforce across the business: why people are targeted, the anatomy of an attack, red flags, how to protect yourself and how to respond and report. It ends with a 12-question final check at 80% to pass. For covered financial institutions it is the course with the FTC Safeguards Rule noted above behind it. Analysts can co-host it and add a real anonymised alert from your own queue to the live deck.
Passwords, passkeys and multi-factor authentication for staff
Compromised credentials are a common cause of the alerts a SOC investigates. This 30-minute course covers why accounts are the target, strong and unique sign-ins, multi-factor authentication and passkeys, fake sign-in pages and the grey areas of sharing, shortcuts and recovery. A Rating Scale on "how sure are you that you would spot a fake sign-in page?" gives a before-and-after read.
AI security for everyone: shadow AI, prompt injection and manipulated outputs
Prompt injection and unapproved AI tools are new alert categories. This 30-minute course covers shadow AI and a compromised chatbot, prompt injection and poisoned content, hidden instructions in PDFs and emails, free AI extensions and unknown code packages, and how to report an incident or request an approved tool. Analysts need it to recognise the pattern when a user reports a chatbot that "did something odd".
Our pick: AI security for everyone. Prompt injection is new enough that many playbooks do not cover it yet, so this course gives the SOC and the business the same words for a new kind of incident.
How to roll the plan out
Order it by what costs most when it goes wrong. With the average breach at USD 4.99 million in IBM's 2026 report, start with the courses that shorten the time from alert to containment.
- In the first month of a new analyst: IT security practitioner skills, incident response and breach reporting, and ISO 27001.
- Within the first quarter: insider threat awareness, phishing, and fraud and deepfakes, so analysts can triage the reports these courses produce.
- Each year: a refresher quiz on each course, plus the AI security course whenever a new AI tool is rolled out.
- When it applies: if you are a cleared US defence contractor, give insider threat training before access to classified information and every year after; if you are a covered financial institution, keep security awareness training current as the FTC Safeguards Rule describes. Ask your counsel what else applies in your country or state.
Ways to run these courses on AhaSlides
You can build any of these as a self-paced course with the AhaSlides course creator, run them as a live Q&A session deck, or both, with a post-course survey and a 30-day check-in to see what changed.
- Pick Answer: show an alert and four possible next steps, or ask which signal points to an insider.
- Word Cloud: ask "What slows down our first ten minutes?" The biggest words show where the playbook needs work.
- Rating Scale: before and after, ask "How confident are you running a ransomware containment step alone?" from 1 to 5.
- Open Ended: collect anonymous near-misses and false positives at the end of a live session.
FAQ
What training does a SOC analyst need?
A SOC analyst needs SIEM and detection skills, the incident response process and security fundamentals. The courses above cover the process and policy side; vendor and certification courses cover the tools.
What certifications help SOC analysts?
Common ones include CompTIA Security+ and CySA+, plus vendor and SANS certifications. The practitioner skills course above helps analysts prepare, but it is not a certification.
How do SOC analysts learn on the job?
Mostly through shadowing, playbooks and tabletop exercises, not classroom courses alone. A short course before a tabletop gives everyone the same starting point.
What is an insider threat?
An insider threat is a risk from employees or contractors who misuse their access, on purpose or by mistake. It includes unwitting insiders who are tricked into helping someone else.
This post is general information, not legal advice. For a decision about your own workplace, speak to a qualified lawyer or the regulator.
