Training Mission: On Training the US Army to Use the Army Endpoint Security Solution

The Challenge

A Massive Training Need for a Massive Security Environment

U.S. Army soldiers, government civilians, and contractors needed training on TYCHON, Elastic Defend , Elastic Security, and ThreatQuotient — integrated tools within the Army Endpoint Security Solution (AESS). Everforth ECS provides the AESS for Army Cyber Command (ARCYBER) and Network Enterprise Technology Command (NETCOM). One of the world’s largest endpoint security environments, the AESS protects up to 750,000+ desktops, servers, virtual machines, and other endpoints across the Army’s global infrastructure.

INTENSIVE ONLINE TRAINING

days

hours per day

110

lab exercises

The Solution

Merging Immersive Training Technologies With Deep Cyber Subject-Matter Expertise

Everforth ECS has been training Army analysts to use AESS since 2019 and reimagined the broader training program in 2020 in response to the COVID-19 pandemic. Needing to transition to remote delivery and alignment, Everforth ECS’ revamped AESS Analyst training course included a learning management system and course platform, a cyber range simulating the AESS production environment, and (using VMware technology) virtualized solutions to give instructors and students access to their personal computers. In combination with the Army’s Teams environment, this technology allowed Everforth ECS to deliver its AESS Analyst training course to students around the world.

Additionally, Everforth ECS trainers built a follow-on training component consisting of course videos, continued use of the cyber range, and access to subject matter experts, allowing students to refresh their learning after course completion.

Staff Sgt. Jones works with a cyber warfare trainer of 3rd Infantry Division

Ongoing Advancement and Modernization

Needing to keep pace with modern threats and advancing technologies, in the years since the AESS Analyst course’s launch, the program has remained highly invested and committed to a continual service improvement process that ensures the training program meets AESS’ evolving needs.

That process was put to the test in March 2026, when AESS transitioned from McAfee Endpoint Security to Elastic Defend. Everforth ECS trainers integrated the new platform into the cyber range immediately and ran an agile needs analysis to assess the impact on the AESS Analyst course. The team redesigned the course around Elastic Defend, building new hands-on labs and reworking two case studies and the capstone exercise to reflect the platform’s capabilities.

What was delivered: a full course redesign completed in under three weeks, with the revised AESS Analyst course delivered the first week of April, giving Army cyber defense personnel timely, relevant training aligned with the technology they use operationally.

Additionally, the team also expanded support for remote learners and graduates who need just-in-time refresher training. Since May 2026, the program has released 13 new instructional videos covering Elastic Defend workflow changes, bringing the on-demand learning library to 63 videos, hosted on the NETCOM G3/5 SharePoint site. Designed primarily for Site Reviewers, several videos also help defensive cyber analysts apply Elastic Defend to common operational use cases.

2,022

personnel trained in
216 classes over 69 months

4.84/5

satisfaction rating

spin-off courses

The Results

2,000+ Trained to Defend the United States Against Threats

When Everforth ECS trainers began offering the intensive, remote instructor-led AESS Analyst course, they thought they would train no more than 200 students. Adoption of the AESS platform across the Army has been steady and continuous, however, and course graduates have spread the word about the course, driving a massive training demand. As of August 2026, Everforth ECS has facilitated 216 classes and issued 2,000+ completion certifications.

Rave Reviews, Spin-off Courses, a Model for Future Training

Army students have given the AESS Analyst training course an average satisfaction rating of 4.84 out of 5, drawn from 698 student surveys submitted since Day 1, and classes are in high demand and fill quickly. Ratings have climbed year over year (4.83 in 2023, 4.89 in 2024, 4.90 in 2025, and 4.94 in 2026) reflecting the training team’s commitment to continuous improvement efforts. Organizers of various Army and multi-force cybersecurity training programs regularly integrate the course into their curricula.

This training success has inspired three additional Everforth ECS training courses (Site Reviewer, Forescout Comply-to-Connect, and Data Reviewer) that provide specialized AESS training for several distinct Army cybersecurity roles. Everforth ECS is also now using the AESS Analyst course as a model for the design of future training solutions.

These role-based offerings continue to grow. The team plans to record nine to 12 additional videos covering new capabilities across the AESS environment, including AESS’s GIT solution for USIEM users, Forescout capabilities for Comply-to-Connect users, and Elastic Defend workflows for Site Reviewers — reinforcing the program’s commitment to relevant training throughout the technology lifecycle.

Training Mission