Operational Training
Three modules — digital investigation, virtual HUMINT and influence operations — delivered on site or online by operational practitioners.
Module 01 · Digital Investigation
Investigate the open web, methodically
Analysts learn to collect, verify and exploit public digital sources — from social platforms to dark web and leak databases — and to produce evidence that holds up.
Collection methodology
Scoping an investigation, sourcing, prioritization and multi-source corroboration.
Platforms & surfaces
Social networks, forums, blogs, dark web spaces, leak databases and official APIs.
Investigation tooling
Maltego, crawlers, monitoring and alerting stacks; automating repetitive collection.
Person & entity search
Identity resolution, relational mapping, email and phone cross-referencing.
Narrative & network analysis
Detecting emerging narratives, coordinated behavior and amplification networks.
Evidence & reporting
Archiving, chain of custody and writing intelligence products for decision-makers.
Module 02 · Virtual HUMINT
Operate inside closed communities
Operators learn to build credible avatars, enter closed communities and extract intelligence that open collection cannot reach — without exposing their organization.
Avatar creation
Identity construction, backstory, behavioral profile and platform-compliant setup.
OPSEC & infrastructure
Device, network and payment hygiene; attribution risk and how it is mitigated.
Community penetration
Mapping a target community, choosing entry points and credibilizing an account.
Interaction tradecraft
Conversational engagement, relationship building, elicitation and observation.
AI-assisted content
Generating contextual posts, images and profile material that sustain credibility.
Reporting & legal frame
Mission summary, sourcing, threat assessment and the legal limits of engagement.
Module 03 · Influence Operations
Shape the narrative — and defend against it
Teams learn to design, run and measure a narrative campaign — and to detect, attribute and neutralize hostile influence operations targeting their organization.
Campaign design
Objectives, audience segmentation, message framework and operational timeline.
Avatar network activation
Deploying a coordinated fleet of credibilized personas inside target communities.
Content & amplification
AI-assisted production and coordinated cross-platform distribution of narratives.
Hostile operation detection
Spotting coordinated inauthentic behavior, fabricated content and synthetic media.
Attribution & response
Tracing origin networks and building factual responses that neutralize them.
Measurement & crisis response
Reach, sentiment and impact indicators; rapid response under active attack.
Proposal
Three tracks, three modules
Delivered on site. The tracks stack: each one assumes the previous one. Commercial terms are issued after the scoping call.
- Collection methodology
- Investigation tooling (Maltego)
- Person & entity investigation
- Dark web & leak databases
- Certificate of completion
- Avatar creation & OPSEC
- Community penetration methods
- Virtual interaction tradecraft
- AI-assisted content creation
- Certificate of completion
- Campaign design
- Avatar network activation
- Content & amplification
- Detection, attribution & response
- Certificate of completion
Prerequisite: VHUMINT Practitioner, or equivalent demonstrated experience.
Enquire about datesTrain your own team
Cohorts are capped at five so every exercise is run individually. Tell us the team's starting level and we will place them on the right track.
Contact Covertia Core