Labs
Interactive incident replays. Press play and watch an intrusion unfold at machine speed — the attack chain lights up one trust boundary at a time, phase activity climbs, and every step is annotated with the commands and the defensive lesson. The best way to learn attack surface management is to watch a real one fail.
🟡Intermediate
Incident Replay
Real incident
🛡 Defender challenge
One SSRF to 106 Million Records
The 2019 Capital One breach, reconstructed from the public record
18 min9 actions
Replay 🔴Advanced
Incident Replay
Real incident
🛡 Defender challenge
A Credential in a Docker Image
The 2021 Codecov Bash Uploader supply-chain compromise
18 min8 actions
Replay 🔴Advanced
Incident Replay
Real incident
🛡 Defender challenge
Anatomy of a Frontier-Lab Agent Intrusion
The July 2026 incident, reconstructed from Hugging Face's technical timeline
25 min17,613 actions
Replay 🟡Intermediate
Incident Replay
Fictional
🛡 Defender challenge
Shadow IT to Customer Data at Northwind
A fictional external-to-internal breach for training
15 min3,400 actions
Replay