Labs
Hands-on exercises in two forms. Incident replays let you watch an intrusion unfold at machine speed, then defend it — the attack chain lights up one trust boundary at a time until a control you deployed severs it. Triage exercises hand you real tool output and ask the question the tooling never answers: which of this actually matters?
🟡Intermediate
Incident Replay
Real incident
🛡 Defender challenge
One SSRF to 106 Million Records
The 2019 Capital One breach, reconstructed from the public record
18 min9 steps
Replay 🔴Advanced
Incident Replay
Real incident
🛡 Defender challenge
A Credential in a Docker Image
The 2021 Codecov Bash Uploader supply-chain compromise
18 min8 steps
Replay 🔴Advanced
Incident Replay
Real incident
🛡 Defender challenge
Anatomy of a Frontier-Lab Agent Intrusion
The July 2026 incident, reconstructed from Hugging Face's technical timeline
25 min17,613 steps
Replay 🟡Intermediate
Incident Replay
Fictional
🛡 Defender challenge
Shadow IT to Customer Data at Northwind
A fictional external-to-internal breach for training
15 min3,400 steps
Replay 🟢Beginner
Triage Exercise
Fictional
🔎 Triage exercise
Read Your First Scan
You ran the tools. Now work out what actually matters.
15 min5 decisions
Start triage 🟡Intermediate
Triage Exercise
Fictional
🔎 Triage exercise
Forty Findings, One Afternoon
Everything is 'high'. Decide what actually gets fixed first.
20 min5 decisions
Start triage