Breaking down what actually makes up an ICS from PLCs and HMIs to the networks beneath them and understanding how they differ from traditional IT environments you are used to.
Focusing on GoPhish customisation and OPSEC by removing default settings, changing identifiers, refining behaviour, and adjusting how campaigns operate so they blend in better and don't get burned.
Setting up a local on-prem phishing lab in VMware using GoPhish, configuring a simple mail setup, and testing how campaigns and templates work before moving into more advanced infrastructure.