Held from 31st August to 1st September 2026 at BOCRA Spectrum House, Phakalane, the two-day workshop strengthened participants' ability to learn from past incidents and share threat intelligence effectively. It ran in two phases, both built around a selected threat actor. On the first day, participants reviewed incidents linked to the threat actor, focusing on identifying root causes, applying severity classifications, and using incident-tracking metrics to measure response performance. This highlighted gaps in detection and response, as well as lessons for handling similar incidents in the future. The second day focused on the actor's trends and tactics, techniques, and procedures (TTPs), with participants analyzing how the actor operates, how its methods have changed over time, and how this intelligence can be shared among stakeholders to support early detection and a coordinated response.
