Cybersecurity Training Programmes on Advanced Persistent Threat Detection and Response

CSA is working with training providers to offer Practitioner Technical Programmes for relevant cybersecurity practitioners from enterprises, including Critical Information Infrastructure Owners (CIIOs). The programmes provide hands-on training to strengthen the technical capabilities required to protect against, detect, respond to and remediate advanced persistent threats.

The programmes comprise dedicated Information Technology (IT) and Operational Technology (OT) tracks:

• IT Track: Advanced Persistent Threat Detection and Response for IT Environment

• OT Track: Advanced Persistent Threat Detection and Response for OT Environment

Enterprises should nominate participants for the track most relevant to the systems they operate, manage or secure. Where both tracks are relevant to their roles and training needs, participants may attend both. The Practitioner Technical Programmes are offered through two training partnerships, one with SANS Institute and another with DART and Singtel Cyber Security Institute (CSI).

DART and Singtel Cyber Security Institute (CSI)

• IT Track:

o   30 November - 4 December 2026

o   11 - 15 January 2027

• OT Track:

o   23 - 27 November 2026

o   14 - 18 December 2026

SANS Institute

• IT Track:

o  1 - 7 March 2027

• OT Track:

o   30 November – 5 December 2026

Register for the SANS Practitioner Technical Programme ↗ (opens in new tab)

The CISO Technical Programme, conducted jointly by the Singapore Institute of Technology (SIT) and Cyberpro.AI ↗ (opens in new tab), is designed for Chief Information Security Officers (CISOs) and senior cybersecurity leaders responsible for protecting critical systems and organisational assets, including against advanced persistent threats.

Through this five-day programme, participants will strengthen their ability to lead and respond to complex cyber incidents through hands-on exercises, team-based activities and realistic simulations. The programme integrates strategic governance, technical understanding and operational execution, covering regulatory considerations, crisis decision-making and the practical application of AI in cybersecurity operations.

The programme culminates in a full-scale capstone exercise, where participants will lead an end-to-end response to a complex cyber incident, balancing technical, operational and regulatory considerations.

Course dates:

o   30 November - 4 December 2026

Register for the CISO Technical Programme ↗ (opens in new tab)

The Board Cybersecurity Programme is designed for Board Directors and senior leaders with oversight of organisational cybersecurity risks and resilience.

The programme will strengthen participants’ understanding of the evolving cyber threat landscape and the Board’s role in providing effective cybersecurity governance and oversight. Through practical case studies and facilitated discussions, participants will explore key considerations in overseeing cyber risks, assessing organisational preparedness and resilience, and making strategic decisions in the event of a major cyber incident.

The programme will also provide participants with practical perspectives on engaging the executive management team on cybersecurity matters, including the key questions that Boards should consider in exercising their fiduciary duties and effective oversight of their organisations’ cybersecurity risks and response.

Programme dates and registration details will be published when available

• Section A: Programme Overview & Eligibility

A1. What is the purpose of the cybersecurity training programmes on Advanced Persistent Threat Detection and Response?

The training programmes are designed to build capabilities relevant to the respective roles, helping cybersecurity professionals and leaders effectively manage cyber risks and strengthen their organisations’ cybersecurity resilience. For Critical Information Infrastructure (CII) owners, the programmes are also consistent with the Cybersecurity Code of Practice’s (CCoP) ↗ (opens in new tab) emphasis on strengthening cybersecurity competencies across CII organisations.

A2. Why does the training cover Board members, Chief Information Security Officers (CISOs) and cybersecurity practitioners instead of focusing only on technical staff?

Defending CII systems against sophisticated threats is an organisation-wide responsibility. Board members need to understand strategic cyber risk, exercise governance and oversight, lead through crises and make informed resource decisions. CISOs translate these priorities into security strategy and governance, while practitioners require the technical capabilities to protect, detect, respond to and recover from threats.

The three levels of training are designed to strengthen capabilities relevant to their respective roles.

A3. Who can participate in these training programmes?

The programmes are open to enterprises, including Critical Information Infrastructure Owners (CIIOs), and comprise three levels of training tailored to the respective roles: Cybersecurity Practitioners, Chief Information Security Officers (CISOs), and Board Directors.

Enterprises should nominate participants for the programme relevant to their respective roles.

A4. Are these programmes only for Critical Information Infrastructure Owners (CIIOs)?

No. The programmes are open to all enterprises. For CIIOs, the programmes provide relevant training options to develop and strengthen the cybersecurity competencies required for their respective roles. Cybersecurity professionals working or serving non-CIIOs may also register their interest, subject to eligibility and availability of training places.

A5. Are Sector Leads eligible to participate in the programme?

Yes. Sector Leads may register their interest in the training programme relevant to their respective roles and training needs. Participation is subject to the eligibility requirements and availability of training places for the respective programmes.

• Section B: Cybersecurity Code of Practice for Critical Information Infrastructure (CCoP) Applicability

B1. How do the programmes relate to the CCoP?

The specialised programmes support the CCoP’s emphasis on ensuring that relevant personnel have the necessary cybersecurity competencies to perform their roles effectively.

CIIOs are encouraged to assess the capabilities of their Board members, Chief Information Security Officers (CISOs) and cybersecurity practitioners, and identify suitable training based on their respective roles and competency development needs.

B2. Are these specific CSA-supported training programmes mandatory under the CCoP?

No. However, these training programmes are designed to contribute towards building the cybersecurity competencies that relevant personnel need to perform their roles effectively. Under the CCoP, Critical Information Infrastructure Owners (CIIOs) are required to ensure that employees who operate and manage CII attain the necessary cybersecurity competencies. To support CIIOs in this effort, CSA has worked with the training providers to curate these programmes to address relevant cybersecurity capability needs.  CIIOs should continue to assess the competencies required for relevant roles and provide appropriate training and development to address any gaps.

• Section C: Registration, Nominations & Course Runs

C1. Is there a limit on the number of participants each organisation can register for the training?

There is no limit on the number of participants an organisation can register their interest in the training programmes, subject to the maximum number of participants per class.

Organisations are welcome to register relevant participants based on their training needs.

C3. When should Critical Information Infrastructure Owners (CIIOs) sign up for the course?

CIIOs are encouraged to sign up as soon as possible. Registration deadlines, upcoming dates and availability will be published on CSA’s website and the respective training providers’ websites.

C4. Will there be additional training runs after the October and November/December 2026 sessions?

Yes. Additional training runs will be organised. The specific dates will be determined based on demand and published on the respective training providers’ websites.

CSA will also update its website with the training information when new training programmes are made available.

• Section D: Course Fees, Subsidies & Enquiries

D1. Are there course fees, or is the training subsidised?

Course fees are subsidised with applicable course fee funding under SkillsFuture.

For the actual subsidy rates and course fees, please refer to the respective training providers’ websites for the latest information.

D2. Does CSA provide additional sponsorship or co-payment for these courses?

No. CSA does not provide additional sponsorship or co-payment for these courses.

CSA has worked with the training providers to provision course fee subsidies under SkillsFuture where applicable. The course fee, after eligible subsidies, is to be borne by the participating organisation or individual.

D3. Where can participants find information on course fees, subsidies and course details?

For further information on the programme, including course details, fees, training locations and registration, please refer to the respective training provider’s website.

D4. Who should organisations contact if they have questions about programme eligibility or applicability?

For programme-specific enquiries, including eligibility, course dates and registration details, please contact the respective training provider.

For other related enquiries, please contact CSA at sgcybertalent@csa.gov.sg.

• Section E: Practitioner Technical Programme – Information Technology (IT) and Operational Technology (OT)

E1. What is the difference between the Information Technology (IT) and Operational Technology (OT) tracks?

Both tracks focus on strengthening practitioners’ capabilities to detect, respond to and recover from Advanced Persistent Threats (APTs), but are tailored to different operating environments.

The IT track focuses on enterprise IT environments, with training in areas such as threat hunting, digital forensics, incident investigation and response, and recovery from sophisticated cyberattacks.

The OT track focuses on Industrial Control Systems (ICS) and OT environments, covering areas such as OT asset visibility, industrial systems and protocols, OT-specific security controls, threat monitoring, incident response and the safe recovery of operational systems.

E2. Can a participant attend both the Information Technology (IT) and Operational Technology (OT) tracks for the Practitioner training?

Enterprises should nominate participants for the track most relevant to the systems they operate, manage or secure.

However, if both tracks are relevant to their roles and training needs, participants may wish to attend for both.