Tooling changes every eighteen months. The method does not: how you read a chain, build a cluster and defend a conclusion. That is what we teach, and it is assessed.
Take them in sequence or drop a team straight into the level that matches the work they already do.
How transactions, addresses, UTXOs and account models actually work. Enough to read an explorer with confidence and stop taking a vendor's risk score on faith.
The working method. Peel chains, mixer analysis, bridge reconciliation and the discipline of separating what you can prove from what you merely believe.
The first twenty-four hours. Containment while tracing runs, evidence preservation that survives challenge, and communicating to a board mid-incident.
Need something between the levels, or a syllabus built around your own typologies? That is most of what we run.
Request a custom cohortRoughly a fifth of the time is instruction. The rest is people working real structures with someone experienced looking over their shoulder.
A short diagnostic before day one so we know who is genuinely new and who has been doing this for three years without formal method. Mixed rooms are fine; unacknowledged mixed rooms are not.
Every exercise runs on real chain data. Synthetic teaching sets are clean in ways real matters never are, and people trained on them freeze the first time a cluster does something odd.
Where confidentiality allows, we build the practical around a matter your team actually holds. Nothing transfers into practice faster than solving your own backlog in the room.
The course ends in a graded practical, not a completion certificate. People pass by producing a defensible trace with its confidence stated, or they do not pass.
Everyone who completes a course keeps a direct line to the instructor for six months. Real questions arrive weeks later, back at the desk, not during the workshop.
Leadership does not need to run a trace. They need to know what the exposure is, what adequate looks like and which three questions to put to their own team on Monday. That is the briefing.
Your office, your case data, your room. Best for assessed practicals.
Live delivery in half-day blocks so nobody loses a full week.
A scripted breach run against your real escalation paths.
A syllabus built from your typologies and your open backlog.
Practitioner and Advanced cohorts finish with a graded practical. Passing means producing a defensible trace with its confidence stated, the same bar our own investigators are held to.
Yes, on site, remote or split. Practicals work best in a room together, so where budget allows we suggest running theory remotely and bringing everyone in for the assessed days.
It is a large part of what we do. Agency cohorts get an adjusted syllabus covering evidential handling and disclosure obligations in the relevant jurisdiction, delivered alongside the same technical method.
Courses are priced per cohort rather than per seat, up to sixteen people. That makes it economic to include adjacent teams: legal and SOC staff who benefit from the shared vocabulary even if they never run a trace themselves.
A half-day executive briefing for boards and leadership: what the exposure actually is, what good looks like and which questions to ask internally. No exercises, no tooling, just the decisions that sit at that level.
Tell us who is in the room and what they work on. We will come back with a syllabus, a format and a fixed cohort price.