Practitioner
Certified Incident Responder
2026 edition
Self-paced PECB training delivered via myPECB.
Global training partner Aegentra is an official PECB authorised training partner and an official CompTIA partner.
Master the detection, response, and mitigation of cybersecurity incidents to minimise impact, ensure business continuity, and strengthen organisational security. Certified Incident Responder (CIR) equips security professionals with the advanced skills and methodologies to manage complex incidents across the modern threat landscape — threat intelligence, malware analysis, containment strategies, and forensic investigation — through hands-on exercises and real-world simulations. You will learn to plan, coordinate, and execute incident response procedures, conduct digital forensics, collaborate with stakeholders, and build incident response playbooks tailored to your organisation.
- CPD credits
- 31
- Course languages
- English
Who it is for
- Incident response team members and cybersecurity analysts managing security events
- IT security professionals enhancing their technical and strategic incident response skills
- Security operations centre (SOC) personnel involved in threat detection and response
- Professionals transitioning into specialised incident response roles
- Managers and team leaders coordinating incident response strategies and protocols
What you will learn
- Develop and implement effective incident response strategies and manage response efforts across teams and technologies.
- Evaluate ransomware attack vectors and mitigation techniques and execute a robust response plan to minimise impact.
- Analyse malware behaviours, create tailored remediation strategies, and use forensic techniques to trace and neutralise malicious code.
- Identify and respond to external threats targeting network perimeters, with tools and techniques for early detection and containment.
- Develop remediation plans to eliminate recurring threats and recognise advanced persistence strategies.
Course content
Day 1 — Fundamentals of incident response and strategic handling
- The incident response lifecycle and frameworks
- Building and coordinating the response team
- Strategic incident handling and response playbooks
Day 2 — Ransomware and malware incident response
- Ransomware attack vectors and containment
- Malware behaviour analysis
- Remediation and recovery strategies
Day 3 — Perimeter threats detection, analysis, and response
- Threat intelligence and early detection
- Perimeter threat detection tools and techniques
- Containment of external threats
Day 4 — Persistence, forensics, and continual improvement
- Detecting and remediating advanced persistence mechanisms
- Digital forensics and evidence handling
- Post-incident review and continual improvement
Day 5 — Certification exam
- PECB Certified Incident Responder exam
- 3 hours, five competency domains
Prerequisites
- Before attending, understand the fundamentals of cybersecurity and incident response.
- The full credential has separate professional and project experience requirements; PECB assesses the application after the examination.
The exam
- Format
- Open-book, technical exam
- Duration
- 3 hours
- Questions
- 20 technical questions in the current English PECB examination record
- Pass mark
- 70%
What is included
Course materials
- 450+ pages of comprehensive training materials
- Hands-on exercises, real-world simulations, and quizzes
- 12 months access via myPECB
Exam package
- Official PECB CIR exam voucher
- 3-hour exam, remotely proctored
- Two attempts (initial + one free resit within 12 months)
- PECB digital certificate on pass