Volodymyr Bohdan, Lead Content Engineer on Windows Incident Response and Forensics
Ahead of the 9 November launch of the Windows Incident Response & Forensics learning path, we sat down with Volodymyr Bohdan, the TryHackMe content lead behind the path, to talk about why the team built it, the structure that pairs every attacker move with the response to it, and why the worst time to learn incident response is during an incident. Before TryHackMe, Volodymyr built his career facing real incidents firsthand, from small-business compromises to enterprise ransomware and espionage cases.
The path at a glance: 170+ MITRE ATT&CK techniques · 13 modules · 69 rooms · Difficulty: Hard · Live 9 November 2026 · Designed to cover over 90% of what responders see in the wild.
Readiness you build in advance
Why build this path, and why now?
"When we looked at the market, there were plenty of good courses out there on incident response, but we wanted to build the most comprehensive and detailed: the full IR lifecycle in a Windows environment, from the initial access point all the way to the end actions like encryption or exfiltration. It's closely tied to MITRE ATT&CK, which is like a lighthouse for incident responders."
The urgency comes down to how teams are forced to learn. "The worst time to learn incident response is during one. if something happens, you won't be sitting there thinking 'what do I need to do?' You'll already know how to handle it.
"That's the motivation behind the path. After completing it, you understand what to do during incident response: how to respond, assess the potential impact on your environment, contain it, and prevent it from happening again."
Why every room shows the attack and the response together
The path's signature structure is designed for optimal understanding, and to build the adversary fluency defenders need to stay ahead. Every core room walks the attacker's move and the responder's answer to it, in the same place.
"We start with how attackers perform an action and the motivation behind it. Why does an attacker choose a particular persistence method, and what do they get from it? Then we move to detection: how you spot that behaviour using logs and DFIR artifacts. Detection is crucial, but it's not the final stage. Once you find the activity, you need to know how to contain and remediate it, and then how to prevent it in the future. A lot of it might look theoretical, but all of it is hands-on. You have a compromised environment, logs, and artifacts to work through in the labs."
He's keen the techniques map to real adversaries, not textbook examples.
"We've built the course around real threat actor groups, roughly 30 of them, mapped straight into its structure. So as you move through the topics, you understand different threat actor profiles step by step: how a ransomware group operates, how an espionage group operates. It gives you a clear picture of how they actually behave in the wild."
How individual learning builds up team readiness
Volodymyr is clear that the real value is in building team readiness, practitioner by practitioner, not in any one person's progress. The real shift is from reactive to proactive.
"Don't treat a topic as something to learn in isolation. Take it back to your organisation. If a section covers what evidence to collect for an investigation, ask: do we have procedures for this? Could I actually do it in my network? Then in your next team meeting you can tell your manager, 'we don't have an incident response plan,' or 'we haven't tested ours in years, let's change that.' A detection engineer can flag a lateral movement method the team has no detection for. The SOC can ask whether they've seen this behaviour. The path improves the whole organisation, not just one person."
That loop, individuals building depth and then the team proving it together, is where the path meets TryHackMe's Live Breach cyber range, released in early October. The path is the individual-study half of readiness; the gaps a team surfaces under pressure point straight back to the modules that close them.
Who Windows Incident Response & Forensics is for, and how to drop into the stage you need
In short, three groups. Security teams building IR knowledge from the ground up, people crossing into IR from an adjacent domain, and experienced responders who want to dip in and out to sharpen particular skills. Because the path is modular, it serves all three without forcing anyone to start from zero.
"It's for security teams who want to understand incident response step by step. It's for people moving into IR from the SOC, from threat intel, from threat hunting, even from the red team side, because it covers the full lifecycle step by step. And it's for experienced responders who want to sharpen one skill. Say I'm a strong responder, but in the last incident I saw a Kerberos ticket attack I'd never encountered. I can jump into one or two modules and close that gap without redoing everything"
DefenseBox: the Swiss army knife for incident response
DefenseBox is the path's investigation environment, the defensive counterpart to TryHackMe's AttackBox. Its job is to absorb the setup and tooling overhead that exists within real incident response.
"In a real incident you collect evidence from everywhere: disk, memory, logs, artifacts, network devices. And you need somewhere to extract it, parse it, correlate it, and build your incident picture. DefenseBox is that one place. You don't need a range of separate machines, and you don't need to think about which tool to install or update. We handle that. It's built and maintained by responders who use this kind of box in real incidents.
"There are lots of separate tools on the market for this, and we've combined them in one machine. Everything is in one place, and that place is DefenseBox."
The role it plays for a business is to remove friction, and the risk that comes with training in production tools. On top of that, DefBox lets you simulate certain attacks in a lab environment, so you can see firsthand what artifacts attackers leave behind.
"Most companies have their own kind of defense box, a separate machine or just the team's laptops, but it's not set up with everything you need. Instead of researching and installing tools, you have one environment that's ready to go. In future we also want businesses to take a copy of this machine and use it in their own network, during their own incidents."
Why incident response skills matter now
Volodymyr points out that the speed and volume of attacks have changed the context in which cyber defense teams have to react, dramatically cutting their window for response.
"Attackers are getting through networks dramatically faster, and it accelerates year on year. CrowdStrike's latest Global Threat Report put the average breakout time, the window from initial access to the first lateral movement, at 29 minutes last year, a 65% jump in speed. Defenders have less and less time to react. And 2025 was one of the most active ransomware years on record: GuidePoint tracked a 58% rise in victims, and IBM puts the average incident at around five million dollars. When attackers move that fast and at that scale, having one hands-on place to build the knowledge and be ready is exactly what this path is for."
What he loved building, and a parting word
Volodymyr leads blue team content at TryHackMe across IR, SOC, hunting, and forensics, and came to it from years of front-line response across organisations of every size, against ransomware and espionage groups alike. Asked what he enjoyed building most, he named two things.
"Sharing real experience, real cases we've dealt with in the wild, so it never feels abstract. And the practical component: every section has a lab. You understand why an attacker does something, you have a real example, and then you test yourself. Can I see this? Can I detect it? Can I do something about it? That's the part I get excited about."
His parting advice picks up the same thread that runs through the whole path:
"Don't just think about yourself. Ask how each technique affects your organisation and your career. If you bring that back to your team, people see it: this person isn't only thinking about themselves. Go through it because a manager told you to and it's not worth much. Connect it to improving the bigger picture and its real value for everyone."
Explore the Windows Incident Response & Forensics path.
Joanna Duffy
