#advanced
#live-online

Advanced Windows Security Course for 2026

Duration: October - December 2025
with Paula Januszkiewicz · Sami Laiho · Peter Kloep · CQURE Academy Experts

October 28, 2025, 7:00 pm

Days

Hours

Min.

Sec.

6-week Live Online Cybersecurity Certified Course

Featuring Experts: Paula Januszkiewicz, Sami Laiho, Peter Kloep & more!

Crafted by top cybersecurity experts working on the frontlines of the cybersecurity industry

12 modules in 6 weeks
Interactive, hands-on formula feat. Q&A for each session
Access to the CQURE Training Lab during the course

Late Birds Discount -40% (the course has already started)
$1919 (€1799) (net – VAT excl.*)
~~$3199~~ (~~€2999)~~ (net – VAT excl.*)

*Tax exemption available for eligible businesses

€2999 (TAX incl.*)

Lowest price within 30 days - € 1799

Why this course?

Crafted by top cybersecurity experts working on the frontlines of the cybersecurity industry, our six-week course for advanced professionals holds practicality at its core. You’ll acquire the tools and techniques necessary to prepare yourself against threats in 2026, irrespective of your work location.

This unique course takes place ONLY once a year and each edition offers a fresh perspective and a new Syllabus.

To keep the training highly interactive, enrollment is limited to 200 participants.

https://youtu.be/Tr1Prm_Wutw

This unique course takes place ONLY once a year and each edition offers a fresh perspective and a new Syllabus.

To keep the training highly interactive, enrollment is limited to 200 participants.

Application

The Advanced Windows Security Course for 2026 is unique and not everyone’s cup of tea.
It’s designed for those who already have a solid foundation in cybersecurity.

Late Birds:
€1799(net)

Late Birds:
$1919(net)

The course has begun, but it’s not too late!

Join the course now and catch up easily!

Regular price:
€2999(net)

Regular price)
$3199(net)

Join our course at a competitive and fair price. This is the last chance!

Team plan

Unlimited duration

Need help?

Late Birds:
€1799(net)

Late Birds:
$1919(net)

The course has begun, but it’s not too late!

Join the course now and catch up easily!

Regular price:
€2999(net)

Regular price)
$3199(net)

Join our course at a competitive and fair price. This is the last chance!

Team plan

Unlimited duration

Need help?

Course benefits

You’ll participate in a live, online certification program, divided into 12 modules + 1 bonus module spread over 6 weeks.
Live, online sessions happening twice a week, 2 hours each (at 7PM CET / 10AM PDT / 1PM EDT).
The syllabus covers 12 modules.
The program has an interactive, hands-on formula — and after every class, you’ll be able to ask questions.
During the 6 week program, you’ll also get free access to the CQURE Training Lab and closed Discord group where you can share your challenges and upgrade your network.
Official CQURE certificate “Windows Security Master 2026” after passing the final exam.
All the video recordings and extra materials are yours to keep for 12 months from the start of the program.
30-Day, Money-Back Guarantee

LIVE Trainings

You’ll join our 2-hour long live classes on a special interactive platform – happening twice a week at 7PM CET (10AM PST / 1PM EST).

Action packed

You’ll go through 12 modules in 6 weeks. We’re not fluffing around, you’ve been warned.

Once a year only

We organise this course only once a year. Every next edition is updated with new tools and challenges.

12-month Access

You’ll get a full year of online access to all the recordings (counted from the first class).

Interactive classroom

After every class you’ll be able to ask questions.

Extra materials

We’ve prepared for you slides, extra materials and homework for each session.

The training lab

During the course you’ll have access to a special training platform where you can safely test your hacks.

Social & network

You’ll receive an official CQURE certificate “Windows Security Master 2026″ after passing the final exam. Yes, there will be a final exam. And 24 hours counting towards your CPE’s.

LIVE Trainings

You’ll join our 2-hour long live classes on a special interactive platform – happening twice a week at 7PM CET (10AM PST / 1PM EST).

Action packed

You’ll go through 12 modules in 6 weeks. We’re not fluffing around, you’ve been warned.

Once a year only

We organise this course only once a year. Every next edition is updated with new tools and challenges.

12-month Access

You’ll get a full year of online access to all the recordings (counted from the first class).

Interactive classroom

After every class you’ll be able to ask questions.

Extra materials

We’ve prepared for you slides, extra materials and homework for each session.

The training lab

During the course you’ll have access to a special training platform where you can safely test your hacks.

Social & network

You’ll receive an official CQURE certificate “Windows Security Master 2026″ after passing the final exam. Yes, there will be a final exam. And 24 hours counting towards your CPE’s.

How is this training different from others?

Only once a year
Advanced stuff
Up-to-date tools
Cool presenters!
Exclusive study
Extra materials
Social & Network
Certification

Only once a year

You’ll only learn things that will be crucial and most relevant in the following 2026. We run the training only once a year, always with the newest content.

Advanced stuff

You’ll skip the fluff and go straight to the advanced stuff. The pace is quite intense, so expect a smoke coming out of your ears.

Up-to-date tools

The training is pretty hands-on because it has been designed by passionate practitioners and obsessive researchers from the CQURE Team. This course is filled with the newest tools and techniques so you will gain the most useful skills in the current cybersecurity reality.

Cool presenters!

We’ll bring a bunch of experts on board with Paula Januszkiewicz and Sami Laiho among instructors and the hosts of the program.

Exclusive study

Make your mark and capture the attention of potential employers in 2026 with this certified online course by CQURE. This unique course takes place ONLY once a year and each iteration offers a fresh perspective. Enrollment is exclusive to a select group of students, chosen meticulously through a stringent application process.

Extra materials

During the course you will be provided with a bunch of materials such as lab exercises, presentations, intriguing articles and useful tools to make your tasks a little bit easier!

Social & Network

You will be granted access to our closed Discord community server where you will be able to share your thoughts with other IT specialists.

Certification

You’ll receive an official CQURE certificate “Windows Security Master 2026″ after passing the final exam. Yes, there will be a final exam. And 24 hours counting towards your CPE’s.

Course syllabus

The Advanced Windows Security Course for 2026 will cover a diverse range of 12 subjects, all hand-selected by our globally acclaimed TOP cybersecurity experts – Paula Januszkiewicz, Sami Laiho, Peter Kloep, and Amr Thabet to name a few. The crucial topics are set to define the field in 2026, equipping you with the foresight and knowledge to stay ahead of the curve.

Each year, we strive to enhance our program, incorporating feedback and trends to keep it relevant and impactful.

This year get ready for 6 weeks of intense learning featuring:

Case Study: Real-World Ransomware Attack

Attack vectors (phishing, RDP, exploits)

Event timeline (detection → response → recovery)

Key organizational and technical mistakes

Lessons learned from the incident

Case Study: Insider Threat & Data Exfiltration

Characteristics of insider threats

How the attacker bypassed security controls

Security team’s response

What failed, what worked

Building an Effective Incident Response Strategy

What does it mean to be “ready” for an incident?

Six key IR pillars: Detection, Escalation, Communication, Documentation, Accountability, Recovery

The role of playbooks and tabletop exercises

Example metrics for measuring readiness

Hands-On Walkthrough: Building a Basic IR Playbook

How to build a simple playbook for a ransomware attack

Tools

The role of templates and checklists

Helpful Frameworks

Overview of frameworks (e.g., NIST, SANS IR Steps, MITRE ATT&CK)
Zero Trust and ZTNA

What are they?

What are the benefits?

Who are they for?

Zero Trust Networking

Different approaches

Various technologies

SWOT of ZTNA

Designing and implementing ZTNA

Best Practices

Lessons learned
Introduction and core OSINT Techniques

Information gathering beyond infrastructure

Azure-specific queries

Automated Discovery & Practical Application
MITRE ATT&CK & Attack Investigation

Understanding the MITRE ATT&CK Framework

Using the Current Attack Landscape With Attack Examples

Understand Incident Response Process & Digital Investigation

Introduction to AI for Cybersecurity

AI and Machine Learning Fundamentals

Supervised vs Unsupervised Learning

Generative AI and Large Language Models

Hands-on Lab: Simple Chatbot for Threat Analysis & Reporting

Prompt Engineering & Retrieval-Augmented Generation (RAG)

Prompt Engineering Best Practices

Different Prompt Templates for Cybersecurity Use Cases

Intro to Retrieval-Augmented Generation (RAG)

Incorporating RAG & Prompt Engineering

Intro To AI Automations & Tool Calling:

AI Automation & n8n Workflows

Tool Calling Principles in AI

Hands-on DNS Domain Check

AI Pitfalls & Obstacles

AI Hallucinations & How to Avoid it

Prompt Injections & AI Security
Opening & Introductions

Welcome and participant introductions

Training objectives and expected outcomes

Overview of Azure security landscape

Azure Security Architecture Overview

Microsoft Defender for Cloud

Azure Sentinel architecture and capabilities

Integration with Azure Monitor and Log Analytics

Native security tools ecosystem

Threat Detection in Azure

Hands-on Demo: Navigating Defender for Cloud dashboard

Understanding security alerts and severity levels

Azure Sentinel analytics rules and detection methods

Custom KQL queries for threat hunting

Interactive Exercise: Writing basic KQL queries

Incident Classification and Initial Response

Azure incident categorization framework

Severity assessment and business impact analysis

Escalation procedures and notification workflows

Case Study: Real-world incident classification examples
Introduction – The Risk of Privileged Access Abuse

Definition of privileged access abuse

Real-world examples of incidents

Common abuse scenarios:

Data theft

Privilege escalation

Creation of hidden accounts

Tampering with audit logs

Privileged Access in SQL Server – Architecture and Risks

Overview of high-risk roles: sysadmin, CONTROL SERVER, db_owner

Differences between logins and users

Role chaining and impersonation

Common misconfigurations and privilege creep

Abuse Scenarios – What Attackers Do With Privileges

Creating backdoor logins

Granting roles silently

Disabling auditing or deleting logs

Detection Techniques – How to Identify Privileged Abuse

Using SQL Server Audit (Enterprise edition)

Extended Events for tracking GRANT, REVOKE, ALTER, EXECUTE AS

Default Trace usage

Monitoring login attempts, privilege changes, and schema modifications

Defense and Mitigation

Principle of least privilege

Avoiding fixed server roles when possible

Regular review of privileges

Implementing alerts and controls

Advanced Detection Patterns (Optional)

Tracking EXECUTE AS usage

Detecting chained escalation scenarios

Forwarding audit logs to an external SIEM

Q&A and Wrap-up

Summary of detection and defense strategies

Resources and script package
Introduction

Scope: practical Windows attacks in real-world pentests

Focus on obfuscation, LOLBins, covert exfiltration, SMB relay, ADS, IFEO

Obfuscation

PowerShell and binary obfuscation basics

Practical examples of obfuscation for stealth

Why attackers use obfuscation during engagements

Using LOLBins

Using built-in Windows binaries for payload execution and file transfer

Key LOLBins: rundll32, regsvr32, certutil, bitsadmin

Using LOLBins for stealth data exfiltration

Covert Exfiltration

Exfiltrating data via ICMP, DNS, HTTP

HTML smuggling for bypass and delivery

Using malicious links + LLMNR/NBT-NS to capture/relay credentials

SMB Relay Attacks

LLMNR/NBT-NS poisoning for credential capture

Performing SMB relay when SMB signing is disabled

Using Alternate Data Streams (ADS)

Hiding and executing payloads within ADS

Practical usage and detection considerations

Abuse of Image File Execution Options (IFEO)

Using IFEO for persistence or defensive evasion

Practical examples from engagements

Practical Attack Flow Example

Combining covered techniques into a realistic internal pentest chain
Why PowerShell for IR

Benefits for live investigations

Risks and common abuse patterns

Collecting Evidence

Processes, network connections, event logs

Registry and scheduled tasks

Threat Hunting Techniques

Detecting suspicious processes and scripts

Finding lateral movement and persistence

Case Study: Live Investigation with PowerShell

Using PowerShell for timeline building

Identifying attacker activities

Detection and Logging

PowerShell logging and Script Block Logging

Correlating with Sysmon and EDR

Best Practices

Safe evidence collection

Avoiding contamination and ensuring validation
Evidence Collection and Investigation

Azure logging architecture and data sources

Hands-on Lab: Collecting evidence using Azure tools

Activity logs and diagnostic logs

VM snapshots and network flow logs

Using Azure Resource Graph for investigation

Preserving evidence for forensic analysis

Containment and Remediation Strategies

Network isolation using NSGs and Azure Firewall

Identity-based containment (revoking access, MFA)

Practical Exercise: Incident containment scenarios

VM isolation and quarantine procedures

Automation and Orchestration

Azure Sentinel Playbooks demonstration

Logic Apps for incident response automation

Demo: Automated response workflow creation

Integration with external ticketing systems

Recovery and Post-Incident Activities

System restoration from backups

Security posture improvement

Documentation and lessons learned process
Planning and Processes

From Zero to “Tier0”

Why is tiering essential?

Which systems are Tier0?

Common misconfiguration in current networks

Naming convention and Role- and Permission-definition

Lessons from the Field

What works in real-world deployments

What stopped customers from successfully implementing tiering

How to get from A to B?

How to achieve user / admin-acceptance?

Implement Tiering

PowerShell-Scripts

GPOs

Moving resources

Administrative workstation / Jump-host

Just-In-Time-Administration

Simple Just-In-Time solution

Required / useful tools

Administrative Forest

Benefits of an Admin Forest

Automatic synchronization

Tools for easy management
Base infrastructure of the cluster

Cluster Networking (traffic going outside, coming inside, and in the cluster)

Identity & Permissions (RBAC model)

Monitoring and Security Monitoring
TLS Fundamentals and Windows Server Implementation

Scanning and Hardening the System-Wide TLS Settings

Securing .NET Applications with TLS

Discovering, understanding, and fixing issues in code

Who is it for?

In the realm of cybersecurity, knowledge is the ultimate currency. While the digital world may offer unlimited access to information, it’s critical to discern that not all information holds significant value. AWSC is a certified 6-week online cybersecurity course created for advanced professionals as well as all the geeks who are already fluent in the Windows environment (including security skills, penetration testing, etc.).

Intermediate to advanced Windows Security Professionals

This program is for you, if you want to level up and become key expert in your company (or even in your field). We promise to challenge your ways of thinking and executing.

Ethical Hackers (who are familiar with…)

Attendee needs to have general fluency in Windows environment (including security skills, penetration testing etc.) Active Directory related knowledge is required. Take the quiz to see where are you at.

Brave Newbies

If you are a newbie you can still apply, but the program WILL NOT cover the basics — so it might be really challenging for you to get in or to keep up with the group.

How persuade your manager that this course is meaningful?

Investing in knowledge is one of the most worthy investment not only for us, but also for our environment. Learning new skills and insights in terms of cybersecurity may benefit with gaining awareness and as a result, may prevent falling a victim to cyber threats in the future.

Protects the Company

You will be the valuable element in regards to company’s safety – knowing about potential threats and ways of avoiding them may be incredibly useful in a daily company life.

Improves Employees skills

Not only your company will gain a specialist in terms of cybersecurity, but also you will unlock the door for expanding your skills horizon even further.

Boosts customer confidence

Completed course with personal certification may be the perfect advantage when it comes to business.

Helps comply with regulations

Knowledge is power—it helps navigate through complex regulatory landscapes. Keeping up-to-date with the latest cybersecurity regulations and standards ensures your company remains compliant, thus avoiding costly penalties and reputational damage.

Saves money in the long run

Who would have want to pay regularly for help in case of emergency data leakage in a company? It’s much better to educate the employees and prevent any cybersecurity risks.

Prepares for emerging threats

After our course, you will be educated in the possible threats and you will identify any suspicious activity online with ease.

Protects the Company

You will be the valuable element in regards to company’s safety – knowing about potential threats and ways of avoiding them may be incredibly useful in a daily company life.

Improves Employees skills

Not only your company will gain a specialist in terms of cybersecurity, but also you will unlock the door for expanding your skills horizon even further.

Boosts customer confidence

Completed course with personal certification may be the perfect advantage when it comes to business.

Helps comply with regulations

Saves money in the long run

Who would have want to pay regularly for help in case of emergency data leakage in a company? It’s much better to educate the employees and prevent any cybersecurity risks.

Prepares for emerging threats

After our course, you will be educated in the possible threats and you will identify any suspicious activity online with ease.

Register now and learn from the best!

6-week Live Online Cybersecurity Certified Course

Crafted by top cybersecurity experts working on the frontlines of the cybersecurity industry.

12 modules
6 weeks – twice a week, 2 hours each
Interactive, hands-on formula feat. Q&A for each session
Access to the CQURE Training Lab during the course
Discord group
CQURE certificate “Windows Security Master 2026” after passing the final exam.

DURATION: 28 October – 4 December, 2025

By
checkout

We recommend this method if you would like to purchase up to 10 seats.

Book
your spot

Contact
us

FAQ

This course is for geeks who want to become advanced Windows security experts. If you want to set yourself (and your company) apart from your competition, this is the course for you. You must already be fluent in the Windows environment (including security skills, penetration testing, etc.). Active Directory-related knowledge is required. We already have a great group of approved applicants from the Microsoft Ignite Conference where we did a soft launch of this course. Including:
- Professionals with over 5 years of experience in Windows and security-related projects.
- Working in public, commercial, and security consulting companies.
If you are not sure if you qualify for the course, take the quiz to see where you stand. If you score above 12 points, you should apply here.
To qualify for the course, you need to complete the application form here. The application is FREE 🙂. We will review the applications to see if you qualify, and we will email you straight after we approve your application. If you do not qualify, we will also inform you by email. If we need more information from you, we may ask you to schedule a short interview with a member of our team. After we approve your application, you will have some time to submit your payment. You can pay online (recommended) or contact us to pay via your company payables department.
Once your application is approved and you pay your tuition, this is what you will get access to:
- 12 Live Online Sessions with Paula or other CQURE Academy instructors. Sessions happen twice a week on Tuesday and Thursday. Sessions will be held at 7 PM CEST (1 PM New York / 10 AM San Francisco). Each session will last 2 hours. You can ask questions in every session.
- 12-month access to video recordings of every session.
- Slides & Scripts & Tools from the Live Sessions for download.
- Free Access to our CQURE Lab, for 6 weeks of the course (so you can practice and do homework).
- Access to a Private Discord Group (for students only), where you can network and exchange questions and ideas during the time of the course.
- Certification Exam at the end of the course.
- CQURE Academy Certificate – “Windows Security Master 2026” – if you pass the exam.
CQURE Academy design CQURE Labs are a great battlefield! You will learn how to hack and secure in a safe environment. Virtual lab can be accessed from anywhere where there is an Internet connection. After login, you will have full access to preconfigured virtual machines (with great performance) where you will be able to attack different targets, search for misconfigurations, search for the evidence and other interesting and very practical activities. During the training you will be given certain tasks to do at home and because CQURE Lab can be accessed anytime, during the day and night – you plan your activities by yourself, depending on your availability and mood! Technically CQURE Lab is a set of virtual machines available through RDP connection. You will obtain your own username, password and connection parameters and you can connect to the lab from any RDP client.
You get full access to all live session video recordings. We highly encourage you to participate in the live sessions so you can interact with us and the other students live online. You will learn best when we help you work through your questions. Keeping up with the course flow we have designed will help you hold yourself accountable to complete the course promptly. That being said, we understand life and work happen. That is why you will have access to all of the material for 12 months.
We are not just a training company. All of our experts spend 60% of their time working as consultants on client cases around the world. We split the rest of our time evenly between research and teaching. This allows us to stay up to date on cutting-edge security knowledge, skills, and tools that other training institutes lack. This rare. Every year’s course will be completely rebuilt to keep up with emerging security trends. Finally, we believe the best way to make you learn is to keep the course fun, social, and interactive. We are cool geeks :). Paula is widely recognized as the best speaker and instructor at international security conferences. At the Microsoft Ignite 2015, unofficial polling marked her as the best speaker (no, we did not ‘hack’ the results!).

Your Experts

This course is delivered by one of the greatest, world-renowned Cybersecurity Experts with practical knowledge from tons of successful projects, many years of real-world experience, great teaching skills and no mercy for misconfigurations or insecure solutions.

No results found.

Need help with cybersecurity?

Need help with cybersecurity?

Need help with cybersecurity?

Advanced Windows Security Course for 2026

6-week Live Online Cybersecurity Certified Course

Why this course?

Application

Late Birds:€1799(net)

Late Birds:€1799(net)

Late Birds:$1919(net)

Late Birds:$1919(net)

Regular price:€2999(net)

Regular price:€2999(net)

Regular price)$3199(net)

Regular price)$3199(net)

Team plan

Team plan

Team plan

Team plan

Need help?

Need help?

Need help?

Need help?

Late Birds:€1799(net)

Late Birds:€1799(net)

Late Birds:$1919(net)

Late Birds:$1919(net)

Regular price:€2999(net)

Regular price:€2999(net)

Regular price)$3199(net)

Regular price)$3199(net)

Team plan

Team plan

Team plan

Team plan

Need help?

Need help?

Need help?

Need help?

Course benefits

LIVE Trainings

LIVE Trainings

Action packed

Action packed

Once a year only

Once a year only

12-month Access

12-month Access

Interactive classroom

Interactive classroom

Extra materials

Extra materials

The training lab

The training lab

Social & network

Social & network

LIVE Trainings

LIVE Trainings

Action packed

Action packed

Once a year only

Once a year only

12-month Access

12-month Access

Interactive classroom

Interactive classroom

Extra materials

Extra materials

The training lab

The training lab

Social & network

Social & network

How is this training different from others?

Only once a year

Advanced stuff

Up-to-date tools

Cool presenters!

Exclusive study

Extra materials

Social & Network

Late Birds:
€1799(net)

Late Birds:
€1799(net)

Late Birds:
$1919(net)

Late Birds:
$1919(net)

Regular price:
€2999(net)

Regular price:
€2999(net)

Regular price)
$3199(net)

Regular price)
$3199(net)

Late Birds:
€1799(net)

Late Birds:
€1799(net)

Late Birds:
$1919(net)

Late Birds:
$1919(net)

Regular price:
€2999(net)

Regular price:
€2999(net)

Regular price)
$3199(net)

Regular price)
$3199(net)

By
checkout

Book
your spot

Contact
us