Licensed Operator Cybersecurity Technical Training
Strengthen skills. Test response. Build resilience.
Hosted by the Uganda Communications Commission (UCC), with support from the Forum of Incident Response and Security Teams (FIRST).
Four days of hands-on learning and cyber drills to strengthen the protection of critical communication infrastructure.
PREPARE.
PROTECT.
About the training
Strengthening cybersecurity across the communications sector
The Uganda Communications Commission (UCC), with support from the Forum of Incident Response and Security Teams (FIRST), will host the Licensed Operator Cybersecurity Technical Training from 22 to 25 September 2026 at the UCC Conference Hall in Kampala.
This four-day, hands-on engagement is designed to support licensed operators in strengthening the management of their critical communication infrastructure, with a particular emphasis on cybersecurity. It combines expert-facilitated training with realistic cyber-attack simulations to assess incident response readiness.
Training objectives
Build capability and trusted relationships
Protect critical infrastructure
Strengthen operators’ management of critical communication infrastructure, with particular emphasis on cybersecurity.
Promote knowledge sharing
Encourage internal knowledge sharing to strengthen cybersecurity capability within participating organisations.
Build trusted relationships
Strengthen relationships among constituents to support collaboration on cybersecurity.
Assess incident response
Simulate realistic cyber-attack scenarios to assess the effectiveness of existing incident response procedures.
Four days · Two stages
From technical learning to practical application
Two days of training facilitated by experts from FIRST, followed by a two-day cyber drill. Sessions run from 8:00 AM to 5:00 PM each day.
22–23 September 2026 · Days 1–2
Technical training
Experts from FIRST will facilitate two days of hands-on training to strengthen operators’ cybersecurity capabilities and prepare participants to apply their learning during the cyber drill.
24–25 September 2026 · Days 3–4
Cyber drill
Participants will apply learned skills in realistic cyber-attack scenarios, assessing practical application and the effectiveness of existing incident response procedures.
View full training programme
Day 1: September 22nd, 2026
Secure AI systems and build your AI-assisted investigation workspace
| Time | Activity | Responsible Person(s) |
|---|---|---|
| 8:00 AM – 9:00 AM | Registration, Breakfast and Networking | All |
| 9:00 AM – 9:15 AM | Opening Remarks and Welcome | DICT |
| 9:15 AM – 10:45 AM | Securing AI Systems: Protecting Models, Data, and Infrastructure | FIRST |
| 10:45 AM – 11:00 AM | Refreshment break | All |
| 11:00 AM – 11:40 AM | AI for Cybersecurity: Enhancing Threat Detection, Response and Resilience | FIRST |
| 11:40 AM – 12:20 PM | How AI Systems Are Attacked: Understanding Adversarial AI | FIRST |
| 12:20 PM – 1:00 PM | Securing AI Systems: Architecture & Data, Monitoring & Deployment | FIRST |
| 1:00 PM – 2:00 PM | Lunch and Networking | ALL |
| 2:00 PM – 3:00 PM | Better Prompts, Better Investigations: Context Engineering for Incident Response | FIRST |
| 3:00 PM – 3:55 PM | Build Your Investigation Workspace: Tools, Evidence and Workflow | FIRST |
| 3:55 PM – 4:50 PM | Getting Started with Codex CLI: An Analyst’s Practical Introduction | FIRST |
| 4:50 PM – 5:00 PM | Key takeaways, tea and daily wrap-up | UCC |
Day 2: September 23rd, 2026
Turn investigation methods into repeatable workflows, with evidence checks and analyst oversight.
| Time | Activity | Responsible Person(s) |
|---|---|---|
| 8:00 AM – 12:30 PM | ||
| 12:30 PM – 1:00 PM | Registration | UCC |
| 1:00 PM – 2:00 PM | Lunch and Networking | ALL |
| 2:00 PM – 2:30 PM | From Day 1: Recap, Questions and Lessons | FIRST |
| 2:30 PM – 3:00 PM | From One-Off Tasks to Repeatable Workflows: Creating Incident Response Skills | FIRST |
| 3:00 PM – 4:00 PM | Design Your Own Incident Response Skill: A Guided walk through | FIRST |
| 4:00 PM – 4:50 PM | Trust the Evidence: Validation, Evidence Handling and Analyst Oversight | FIRST |
| 4:50 PM – 5:00 PM | Key takeaways, tea and daily wrap-up | UCC |
Day 3: September 24th, 2026
Investigate realistic evidence, produce defensible findings and put your response skills into practice.
| Time | Activity | Responsible Person(s) |
|---|---|---|
| 8:00 AM – 8:30 AM | Registration & Breakfast | ALL |
| 8:30 AM – 9:30 AM | Practical Lab 1 – Follow the Phishing Trail: Investigating a Phishing Site and Infrastructure with AI | FIRST |
| 9:30 – 10:30 AM | Practical Lab 2 – Find the Foothold: Windows Artifacts, Account Abuse and Persistence with Codex | FIRST |
| 10:30 AM – 10:40 AM | Refreshment break | ALL |
| 10:40 AM– 11:10 AM | Connect the Dots: Building Investigation Timelines and Correlating Evidence | FIRST |
| 11:10 AM – 11:50 AM | From Evidence to Action: Generating Clear Incident Findings and Reports | FIRST |
| 11:50 AM – 12:10 PM | Capture the Method: Building Reusable Incident Response Skills for Future Investigations | FIRST |
| 12:10 PM – 12:40 PM | Use AI with Confidence: Limitations, Security and Human Judgement | FIRST |
| 12:40 PM – 1:00 PM | Technical training wrap-up and key takeaways | UCC |
| 1:00 PM – 2:00 PM | Lunch Break and Networking | ALL |
| 2:00 PM – 3:00 PM | Get Drill-Ready: Simulation Platform Walkthrough and Participant Onboarding | UCC |
| 3:00 PM – 3:15 PM | Cyber Drill Mission Brief: Scenario, Rules and Expectations | UCC |
| 3:15 PM – 4:45 PM | Cyber Drill Exercise: Investigate, Coordinate and Respond | UCC |
| 4:45 PM – 5:00 PM | Tea and daily wrap-up | UCC |
Day 4: September 25th, 2026
Complete the cyber drill and translate the experience into improvements for security operations.
| Time | Activity | Responsible Person(s) |
|---|---|---|
| 8:00 AM – 8:30 AM | Registration & Breakfast | UCC |
| 8:30 AM – 12:30 PM | Cyber Drill Continued: Apply Investigation and Response Skills | FIRST |
| 12:30 PM – 1:00 PM | Cyber Drill Debrief: Lessons, Response Gaps and Improvement Actions | UCC/FIRST |
| 1:00 PM – 1:15 PM | Closing remarks | UCC |
| 1:15 PM – 2:00 PM | Lunch and Departure | UCC |
Professional development
Certification awards for the top 15 performers
Upon completion, the top fifteen (15) performers will be awarded professional cybersecurity certifications to further enhance individual and organisational capabilities in responding to cyber threats and strengthening the sector’s cybersecurity posture.
Plan your attendance
Dates, time and venue
Dates
22–25 September 2026
Four consecutive days of training and practical exercises.
Daily time
8:00 AM–5:00 PM
East Africa Time (Kampala).
Venue
UCC Conference Hall
UCC House, Spring Road,
Bugolobi, Kampala.
Frequently asked questions
About the engagement
Who is the training intended for?
The training is intended for licensed operators, to strengthen cybersecurity capability and the management of critical communication infrastructure.
Who is hosting and supporting the training?
The Uganda Communications Commission (UCC) is hosting the training with support from the Forum of Incident Response and Security Teams (FIRST). Experts from FIRST will facilitate the two-day training session.
What is the training format?
The engagement takes place in person at the UCC Conference Hall. It consists of two days of hands-on technical training followed by two days of cyber drills to assess the practical application of learned skills.
What is the purpose of the cyber drill?
The drill will simulate realistic cyber-attack scenarios to assess how participants apply learned skills and evaluate the effectiveness of existing incident response procedures.
Will all participants receive professional certifications?
The professional cybersecurity certification awards described for this engagement are for the top fifteen (15) performers upon completion.