Teaching
Teaching Approach
My courses combine academic foundations with operational cybersecurity practice across university programs, corporate training, and executive education. Lessons rely on real threat cases, structured analytical workflows, hands-on labs, and the link between technical findings and risk decisions.
Academic Teaching & Supervision
University of Rome Tor Vergata
Industry Lecturer, Master’s in Cybersecurity and Privacy (02/2023–Present)
- Teach modules on Cyber Threat Intelligence, ransomware ecosystems, and dark web intelligence.
- Apply MITRE ATT&CK and the Cyber Kill Chain to real datasets and investigative workflows.
- Run practical exercises on threat actor profiling, infrastructure mapping, threat hunting, and intelligence-driven incident response.
University of Sannio
Ph.D. in Information Technology for Engineering · Cultore della materia & Lecturer
- Deliver lectures in Cyber Threat Intelligence, ransomware ecosystems, dark web intelligence, and intelligence-led detection.
- Co-supervise bachelor’s and master’s theses on threat intelligence platforms, dark web monitoring, adversary simulation detection, and attack surface analysis.
Doctoral Degree
| Program | Institution | Year | Dissertation |
|---|---|---|---|
| Ph.D. in Information Technology for Engineering | University of Sannio | 2026 | Ecosystem Dynamics and Structural Resilience of the Ransomware Economy: A Longitudinal, Multi-Method Analysis of the Observable Disclosure Surface (2020–2025) |
Thesis Co-Supervision
| Academic Year | Student | Thesis Title |
|---|---|---|
| 2022/2023 | Raffaela Crisci | DARK WEB MONITOR: Evolution of a Threat Intelligence Platform for Monitoring the Dark Web to Intercept Data Leakage |
| 2022/2023 | Valerio Cammarota | Design and Implementation of a Threat Intelligence Platform for the Analysis of the Ransomware Phenomenon |
| 2022/2023 | Giulio Santabarbara | Evolution of the Ransomware Phenomenon: Analysis of the Cybergangs Business Model |
| 2022/2023 | Michele Nuzzo | Cyber Attacks Detection from Adversary Simulation Tools |
| 2022/2023 | Luca Ciarlo | Development and Implementation of Deepye: A Threat Intelligence Platform for Attack Surface Analysis |
Free University of Bozen-Bolzano
Thesis & Internship Collaboration with Würth Italia (2026–Present)
Through my role as CISO at Würth Italia, I host and mentor students on applied enterprise cybersecurity projects covering security governance, NIS2 compliance, ransomware economics, vulnerability management, and threat intelligence.
| Academic Year | Student | Thesis / Internship Topic |
|---|---|---|
| 2026/2027 | Nicole Bortolotti | The Ransomware Economy: Criminal Business Models and New Corporate Responsibilities after NIS2 |
University of Trento
Thesis & Internship Collaboration with Würth Italia (2026–Present)
I mentor University of Trento students carrying out internships and theses at Würth Italia on phishing awareness, supply-chain monitoring, ransomware on-chain analysis, and operational security.
| Academic Year | Student | Thesis / Internship Topic |
|---|---|---|
| 2025/2026 | Federico Gonzalez | SPEAR: Simulation of Phishing Environments for Awareness and Risk Analysis |
| 2025/2026 | David Brugnara | RansomPly: An Integrated Monitor for Supply Chain Attacks |
| 2025/2026 | Francesco Mario Boldrin | From Reactive to Proactive: Exploring a Behavior-Centered Approach to Ransomware On-Chain Monitoring |
Professional Courses & Training
Red Hot Cyber Academy
Instructor, Dark Web & Cyber Threat Intelligence Courses
Through the Red Hot Cyber Academy, I teach two structured training paths on Dark Web and Cyber Threat Intelligence in Live Class and E-Learning formats.
| Course | Format | Level | Duration | Certification | Link |
|---|---|---|---|---|---|
| Dark Web & Cyber Threat Intelligence | Live Class with instructor | Intermediate | 15 hours | Cyber Threat Intelligence Professional (CTIP) | Course page |
| Dark Web & Cyber Threat Intelligence | E-Learning with offline instructor support | Basic | 6 hours (5 modules, 17 lessons) | Cyber Threat Intelligence Fundamental (CTIF) | E-Learning course |
Live Class (Course Code: RHC0002)
- Instructor: Pietro Melillo, Ph.D.
- Format & Duration: 15 hours live with instructor (final exam for CTIP certification)
- Prerequisites: Basic cybersecurity concepts and standard internet navigation skills
- Topics: Safe access to Tor/dark web networks, underground forums and markets, botnets and infostealers, exploit markets, Initial Access Brokers, Telegram ecosystems, MaaS and RaaS models, Data Leak Sites, OSINT/HUMINT/TECHINT/CLOSINT, Traffic Light Protocol (TLP), threat hunting, IoCs, and intelligence reporting.
- Connected to the DarkLab Intelligence Laboratory for supervised practical exercises.
E-Learning
- Instructor: Pietro Melillo, Ph.D.
- Format & Duration: 6 hours of video lessons across 5 modules and 17 lessons (final exam for CTIF certification)
- Topics: Introduction to the dark web and safe access, deep web vs. dark web, dark markets, forums, Data Leak Sites, legal considerations, CTI lifecycle, collection sources, analysis models, intelligence sharing and reporting, ransomware gangs, and case studies.
IUSI Corporate University (Ferrara, Italy)
Cyber Security Instructor (10/2022–10/2024)
- Delivered modules in the Executive Master in Cybersecurity on penetration testing, incident response, and applied threat intelligence.
- Built hands-on labs covering reconnaissance, CVE exploitation, privilege escalation, and technical reporting.
- Supervised applied student projects linking offensive testing techniques with defensive operations.
Core Teaching Subjects
| Area | Topics Covered |
|---|---|
| Cyber Threat Intelligence | Intelligence lifecycle, requirements, source evaluation, correlation, and reporting |
| Dark Web Intelligence | Safe access OPSEC, underground forums, marketplaces, Data Leak Sites, legal/ethical limits |
| Ransomware Ecosystems | RaaS structures, extortion strategies, affiliate networks, victim disclosure tracking |
| Threat Actor Analysis | Actor profiling, infrastructure mapping, TTP analysis, MITRE ATT&CK |
| Incident Response & Threat Hunting | IoC/IoA lifecycle, SIEM detection workflows, alert triage, investigation playbooks |
| Security Governance & Risk | NIS2 readiness, ISO/IEC 27001, vulnerability prioritization (CVSS/EPSS), executive awareness |