Platform Updates

Improvements to AI Scenario Generator

We're thrilled to unveil major improvements to our AI Scenario Generator, enhancing your ability to create highly specific, contextually rich, and coherent Crisis Simulation scenarios. In this release, we've:

• Refined the prompts sent to the OpenAI service behind the scenes to improve the quality of the scenarios.
• Added a new Briefing prompt field, allowing you to give additional detailed, unstructured information about the scenario to increase the relevance to your organization and the outcomes that you want to achieve. This text can include specific organizational characteristics (for example, "our main plant is in a coastal flood plain, dependent on a single rail line for raw materials"), recent internal incidents, current geopolitical tensions relevant to your operations, specific types of threats that you're preparing for (for example, "focus on insider threats combined with supply chain disruption"), or even details about target audiences for specific messaging within the crisis.
• Added a new Reference file field, allowing you to upload PDF documents as additional contextual input for the AI (such as copies of recent news articles related to real-world incidents, industry-specific threat intelligence reports, case studies of past crises, or tone of voice guidelines).
• Added the ability to preview and edit the briefing, allowing you to tweak it to more readily suit your needs. You can review it for accuracy, consistency, and alignment with your training objectives (for example, adjusting phrasing, editing details, adding specific organizational terminology, refining the initial trigger event or impacts, and/or adding specific learning objectives directly into the briefing).

The result of these enhancements is a more engaging workflow that produces small scenarios that require minimal refinement. The text in the optional Briefing prompt field provides nuance that is integrated throughout the generated scenario. Key entities, relationships, themes, and factual details are extracted from the PDFs provided in the optional Reference file field and seamlessly weaved into the generated scenario to enhance realism and relevance.

The updated AI Scenario Generator is capable of meeting the needs of a wide range of customers, including:

• Inexperienced Crisis Simulation users who want to start their exercising journey. They can use this feature to upload a PDF of a cyber attack and build short scenarios relevant to their exercise that require minimal edits.
• Experienced Crisis Simulation users who just need inspiration. They can provide additional context and specificity using the Briefing prompt and Reference file fields, which they can continue to build on and edit before publishing.

For further details, see:

• Creating a Scenario with the AI Scenario Generator
• Guidance documentation on effective prompting

Lab Builder Improvements

This release encompasses major improvements to our Lab Builder.

Practical Lab Template Library

The new Lab Template library lets you attach preconfigured virtual machines to your custom labs. These virtual machines are already loaded with the tools that your teams use daily. You can also upload additional files in *.zip or *.tar format, allowing you to integrate learning material that you want to use in a lab (such as logs, malware, or scripts). The end result is that you can dive right into exploring artifacts and logs without the need to build machines from scratch, saving valuable time and effort.  

We're offering the following templates, which reflect the most common open-source tools available:

• DFIR Machine, a remote desktop that is pre-configured with a wide range of Digital Forensics and Incident Response tools to support investigation, containment, and recovery tasks for your lab.
• Kali Linux Machine, a remote desktop that runs Kali Linux, a powerful Linux distribution. It comes pre-loaded with a number of security tools for offensive security labs.
• RE/Malware Machine, a remote desktop that is designed for static and dynamic malware analysis in a controlled lab environment. It comes preloaded with reverse engineering and behavioral analysis tools.

Now you can easily build and host your own labs on the Immersive platform--from basic internal security policy labs to training your technical teams on internal tools.

For more details, see Template Machines. 

New Lab Creator Role

We've created a new role in the Immersive platform that grants users the ability to build labs and curate collections without requiring them to be Organization Administrators. 

The new Lab Creator (Product permissions) check box provides full access to the Lab Builder to create and manage custom labs. Managers and Organization Administrators can assign a Lab Creator role to anyone they want, allowing them to create labs and collections. Lab Creators can handle the full end-to-end workflow of building, publishing, and assigning content. 

For further details, see Accessing Lab Builder. 

User Interface Uplift for Immersive Labs

We've enhanced the user interface for Immersive Labs with a fresh new look, bringing accessibility and responsiveness to the forefront. The updated user interface:

• Supports customer accessibility requirements.
• Includes a condensed, user-friendly task panel.
• Offers improved readability.
• Eliminates the concept of "lab types," allowing each task to be used in any lab type.

This UI uplift currently only affects a subset of practical labs.

Streamlined User Status and Management

We're pleased to announce that user statuses and the user management process within the Immersive platform have been streamlined and simplified.

We've introduced new, descriptive statuses that more accurately reflect the user's place in their onboarding journey, making things easier for platform administrators and managers. The current user statuses are:

• Pre-registered: An account has been created for the user, but they haven't received an invitation or signed in.
• Invited: The user has received an invitation, but they have not yet authenticated their account.
• Active: The user has an account and has successfully authenticated it.
• Deactivated: The user's account has been deactivated by a manager or Customer Support representative or has been systematically deactivated via SCIM or SSO. 

Note: If a user is listed as Unlicensed, that user has an account but has not been assigned any active licenses. 

In the Platform Settings > Users area:

• The Active and Pending tabs were replaced with a new Users tab, which allows you to view all users and filter by status. 
  An helpful alert appears at the top of the Users tab if there are any unlicensed users, notifying you that you need to assign them a license or deactivate their account. Both of these tasks can be performed directly on the same tab.
• A new Deactivated tab lets you monitor deactivated users and reactivate them, if desired. 

These changes:

• Make the status of each user more transparent to managers, eliminating ambiguity and reducing the time spent troubleshooting user access and state issues.
• Let you easily visualize the status of each user at a glance, allowing you to identify and fix cases when users are in the incorrect state.
• Support self-service of actions such as assigning missing licenses, deactivating a user who has left your organization, or reactivating a user if you made a mistake previously. 

For further details, see the following:

• User Management
• Troubleshooting User Access Issues

Improvements to Adaptive Assessments

This release features the expansion of adaptive assessments within the Immersive platform. Adaptive assessments adjust the difficulty of questions presented to a user based on their previous responses. They serve as a quick way for managers to baseline a user’s abilities in certain topics and make an informed decision on what content to assign next. For example, if a user achieves a skill level of intermediate in security operations, a manager can assign SOC (Security Operations Center) Analyst collections or career paths. 

Managers can now obtain a baseline for their team members by assigning adaptive assessments and viewing their scores as they complete their assessments. You can assign assessments as a standalone piece of content, or you can assign one of our new career paths, which feature assessments at the beginning and end to allow users to baseline their skills, upskill, and then reassess.

The following eight adaptive assessments are available in the Upskill section: 

• Under Offensive Cyber:
  • Offensive Security: Tests a wide range of skills, from foundational tasks like using Nmap to discover network services and identifying common OWASP Top 10 vulnerabilities to advanced applications such as escalating privileges in an Active Directory environment and bypassing modern endpoint security controls. It is aimed at ethical hackers and red team members responsible for simulating real-world attacks to identify and report critical security flaws.
  • Web Application Security: Tests a wide range of skills, from foundational tasks like mapping an application's attack surface with a proxy and identifying common OWASP Top 10 flaws like Cross-Site Scripting to advanced techniques such as bypassing complex authorization controls to access privileged data or chaining multiple vulnerabilities to achieve remote code execution. It is aimed at security specialists who focus exclusively on finding security flaws in web applications, services, and APIs.
  • Infrastructure Security: Tests a wide range of skills, from foundational tasks like external network reconnaissance and service enumeration to advanced attack chains such as moving laterally across a corporate network to achieve full Domain Admin compromise in an Active Directory environment. It is aimed at security consultants who specialize in identifying and exploiting vulnerabilities in on-premise, cloud, and hybrid network infrastructure.
• Under Fundamentals:
  • Cybersecurity: The Cybersecurity adaptive assessment for Cyber Professionals will test a wide range of skills from foundational concepts like applying core security principles and understanding data protection responsibilities under GDPR, to advanced applications such as developing a corporate security strategy and leading the technical response to a complex data breach. It is aimed at the broad spectrum of security practitioners, including analysts, engineers, and consultants, responsible for safeguarding an organization's digital assets and ensuring robust regulatory compliance.
  • IT Operations: The IT Operations adaptive assessment will test a wide range of skills from foundational tasks like managing user accounts in Active Directory and responding to system monitoring alerts to advanced responsibilities such as troubleshooting complex performance issues in a virtualized environment and executing a disaster recovery plan. It is aimed at systems administrators and infrastructure engineers responsible for the day-to-day health, performance, and availability of an organization's hybrid on-premise and cloud infrastructure.
• Under Application Security:
  • Application Security: Tests a wide range of skills, from foundational concepts like identifying common OWASP Top 10 vulnerabilities in code and interpreting SAST scan results to advanced applications such as remediating complex injection flaws and building automated security controls directly into a CI/CD pipeline. It is aimed at developers and security champions responsible for writing secure code, fixing vulnerabilities, and embedding security practices throughout the software development lifecycle.
• Under Defensive Cyber:
  • Operational Technology: Tests a wide range of skills, from foundational knowledge like terminology and reference architecture to analysis of fieldbus protocols in Wireshark and malware designed for OT environments. It is aimed at SOC / CIRT analysts working in a hybrid IT/OT/ICS environment.
  • Security Operations: Tests a wide range of skills, from foundational tasks like triaging alerts in a SIEM and identifying known indicators of compromise, to advanced techniques such as conducting hypothesis-driven threat hunts and performing host forensic analysis to determine the root cause of an incident. It is aimed at analysts who serve as the first line of cyber defense, responsible for monitoring, detecting, and responding to security threats within an enterprise IT environment.

Adaptive assessments have been incorporated in career paths, allowing learners to track their growth as they progress through the path. Users now take an adaptive assessment at the start of a career path, and then reassess at the end after upskilling to see how their skills have improved. 

The following career paths now include adaptive assessments:

• SOC Analyst (Beginner, Intermediate, Advanced)
• Infrastructure Pen Tester  (Beginner, Intermediate, Advanced)
• Web App Pen Tester  (Beginner, Intermediate)
• Technical Fundamentals
• Secure Java Developer (Beginner, Intermediate)

For further details, see: 

• Adaptive Assessments Manager Overview
• Adaptive Assessments User Overview

In-Platform Benchmarking & Metrics Tracker - BETA

We've released a new Metrics Tracker dashboard, providing granular metrics at the organization-wide level with an expanded list of sectors that can be used for benchmark comparisons. The Metrics Tracker represents a new approach to how we build and display report information. This dashboard is perfect for senior managers who want to:

• Monitor performance and demonstrate return on investment across their organization in different areas, understanding change over time and comparison to industry benchmarks.
• Identify gaps, strategic priorities, and next steps across the organization, drilling down into teams and individuals where needed.

After clicking Reports > Metrics Tracker, Organization Administrators and team managers can view the following metrics:

• Upskilling Engagement: Tracks platform usage (excluding cyber ranges) by cyber professionals with an Immersive Labs license.
• Threat Response: Tracks engagement with cyber threat intelligence labs published in the last six months.
• OWASP Completion: Tracks engagement with the OWASP Top 10 lab collection by each software developer.
• Coding Language Skills: Tracks developers' progress in their primary programming languages.

This new self-service report allows you to conveniently download a CSV file with your results for each metric and filter metrics by month and year.

Note: This feature is marked as beta. If you have any feedback on the current report, please contact your Customer Success Manager.

For further details, see Metrics Tracker. 

Unified Search within the Community 

We're excited to announce that the Human Connection Community now includes a unified search experience powered by a powerful AI-driven tool. When you search within the Community, all Help Center and Community content (including forum discussions, events, blogs, and challenges) is consolidated in a single location in your search results. You can now easily access all the information and guidance that you need to succeed in one place.

The advanced search functionality and search filters were also improved, allowing you to: 

• Quickly increase the accuracy of your search results.
• Filter by source of content, category, and/or keywords.
• Sort by popularity, relevance, or date created.

For more information, see Searching within the Community. 

New Content

Immersive Labs

Google Cloud Basics Lab Collection

We're thrilled to announce our first-ever lab collection for Google Cloud. In these labs, you'll explore key topics such as fundamental concepts for Google Cloud, an introduction to the Google Cloud console, Identify and Access (IAM) management and permissions, storage accounts, virtual networks, and virtual machines.

The labs included in Google Cloud Basics offer a comprehensive exploration of core concepts and services within the Google Cloud platform:

• Google Cloud Basics: Ep.1 – Fundamental Concepts: In this theory lab, you'll be introduced to the core concepts of Google Cloud. You'll learn what services are available, how they are organized, and what global infrastructure is available to you via Google Cloud.
• Google Cloud Basics: Ep.2 – Introduction to the Console: The Google Cloud console is a user interface for accessing Google Cloud. The visual, browser-based tool allows users to easily create and manage Google Cloud resources such as storage buckets, virtual machine instances, or Cloud Run functions. In this practical introduction to Google Cloud, you'll learn how to log in, navigate to different services, and interact with resources in your Google Cloud project.
• Google Cloud Basics: Ep.3 – Identity and Access Management (IAM): Identity and access management (IAM) is important in any cloud environment, and Google Cloud is no different. Users and non-human workloads can authenticate to Google Cloud as a range of identity types. Once authenticated, Google Cloud IAM controls authorization to access resources in the cloud. In this lab, you’ll learn the basics of IAM in Google Cloud and discover some useful security features.
• Google Cloud Basics: Ep.4 – Cloud Storage: Google Cloud Storage provides scalable and durable object storage for your data. Understanding its configuration options is essential for managing data effectively, ensuring security, controlling accessibility, and optimizing costs. In this lab, you'll gain practical experience by creating a Cloud Storage bucket, modifying its settings, and uploading data, all using the Google Cloud console.
• Google Cloud Basics: Ep.5 – VPC Networks: Virtual Private Cloud (VPC) networking in Google Cloud lets you set up a private, isolated network for your Google Cloud resources. In this lab, you'll find out how VPC networking operates in Google Cloud and learn about VPC networks and subnets. You'll also explore Cloud NAT, a network address translation feature for internet access from private instances, and firewall rules for network security.
• Google Cloud Basics: Ep.6 – Compute Engine: Virtual machines (VMs) are a core service within cloud computing that can run various applications. In Google Cloud, the Compute Engine service provides VMs. In this lab, you’ll explore the fundamentals of Google Cloud VMs using the Compute Engine service. You’ll gain hands-on experience in creating, configuring, and connecting to a Linux VM, managing its identity and permissions, and performing key lifecycle operations. This lab will reinforce your understanding of core VM concepts, machine types, storage, and networking within Google Cloud.
• Google Cloud Basics: Ep.7 – Demonstrate Your Skills: Google Cloud is a leading public cloud provider that offers a wide range of managed services for computing, storage, networking, and identity and access management (IAM). In this Demonstrate lab, you'll practice the skills you've developed throughout the Google Cloud Basics series. You'll prove your ability to configure virtual networks and compute instances, manage storage and IAM resources, and secure infrastructure using best practices across core Google Cloud services.

The practical skills that you'll learn in this lab collection will enable you to develop a foundation in Google Cloud Platform (GCP), one of the "big three" public cloud providers. This lab collection will benefit anyone who works within the GCP ecosystem, providing a helpful starting point for both those who are new to GCP and users hoping to hone their existing skillset. 

Google Cloud Challenge: Traflytics at Metrolio – Offensive

We're pleased to offer a new Google Cloud Challenges collection, which contains the Google Cloud Challenge: Traflytics at Metrolio – Offensive lab. In this lab, you've joined Metrolio as a cloud security engineer and have been asked to assess the security of the newly launched Traflytics site, built by a third-party contractor and deployed on Google Cloud. Your task is to identify any vulnerabilities and determine if they could be used to access Metrolio’s internal Google Cloud infrastructure.

Operational Technology (OT) Collections

We're proud to announce the release of two new OT Collections: Hack your first PLC (Programmable Logic Controller) and OT Challenges. With many ICS (Incident Command System) providers embarking upon digital transformation and the increasing interconnection between OT and IT networks, this set of offensive content across the Immersive Labs platform aims to provide existing IT security professionals with the tools and skills to protect ICS assets.

Hack your First PLC (Programmable Logic Controller)

Designed for beginners and intermediate users, the Hack your first PLC (Programmable Logic Controller) collection provides an introduction to hacking PLCs. This collection includes the following seven labs:

• Hack Your First PLC: Ep.1 – Introduction: If you've ever been curious about the security of industrial systems, you're in the right place. This lab collection demonstrates the foundational techniques used when penetration testing programmable logic controllers (PLCs), the digital brains behind many industrial processes. You won't need a hard hat for these labs, but you will develop a new perspective on these critical devices. You'll define basic penetration testing concepts in the context of PLCs, recognize the phases involved in assessing PLC security, and identify key considerations when approaching a PLC penetration test.
• Hack Your First PLC: Ep.2 — Discovering Internet Accessible PLCs with Shodan: In this lab, you'll learn the art of passive reconnaissance. You'll discover how to use Shodan to find internet-accessible PLCs without alerting any security systems. You'll learn to search for specific protocols, identify exposed industrial systems, and understand what valuable intelligence attackers can gather before launching targeted attacks against critical infrastructure.
• Hack Your First PLC: Ep.3 – Discovering PLCs Using Wireshark: Analyzing network traffic plays an important role when targeting PLCs, as it allows you to learn key information about the target infrastructure without direct interaction, which could be detected or cause a denial of service (DoS). In this lab, you’ll learn how to use Wireshark to identify PLCs using the Modbus protocol and how to make sense of the communication taking place.
• Hack Your First PLC: Ep.4 – Tools for Active PLC Discovery: After passively discovering a target network and devices, the next logical step is active scanning, where you directly probe the target using tools such as Nmap. The goal of active scanning is to uncover as much detail as possible, such as which hosts are live, what ports are open, and what services are running. In this lab, you’ll be introduced to some of the tools and scripts for probing OT devices, including PLCs.
• Hack Your First PLC: Ep.5 – PLC Process Manipulation with Modbus: After discovering PLCs, you'll now interact directly using Modbus. This lab demonstrates using Modbus read and write operations to understand and then manipulate PLC-controlled processes from the network. While Modbus is simple and common in industry, its openness can mean security weaknesses. You'll explore this safely in a simulation, learning offensive methods to ultimately improve your defenses.
• Hack Your First PLC: Ep.6 – Manipulating Ladder Logic: After interacting with PLCs over the network, you'll now directly interact with the logic running on them. You'll learn how this logic can be investigated, modified to alter industrial processes, and uploaded back to the PLC. You'll also discover the significant impact of these changes and the critical safety measures involved when manipulating a PLC's fundamental programming.
• Hack Your First PLC: Ep.7 – Demonstrate Your Skills: In this lab, you’ll have the opportunity to put into practice what you’ve covered throughout this collection, including scanning for Modbus devices, manipulating processes, and modifying ladder logic.

OT Challenges Collection

Our new OT Challenges lab collection offers a number of practical labs, covering a range of different cyber techniques. The collection includes the following scenario-driven labs, aimed at an audience of beginners and intermediate users:

• OT Challenges: Offensive - Modding the MODBUS: Your target in this challenge is a Modbus-enabled Programmable Logic Controller (PLC) running a simplified program that controls a small number of inputs and outputs. Your task is to connect to the target substation and review the state of the PLC.
• OT Challenges: Offensive - Code Cracker: Users need to guess four digits between 1 and 9. PLC checks with a hardcoded value that is not readable over Modbus. When a digit is guessed correctly, a coil goes on and can be seen on the PLC. Once all four digits are guessed, the lab automatically completes.
• OT Challenges: Offensive - Shutdown The Grid: This is a Challenge lab, so you’ll have minimal guidance to help you. Your target is an IEC104-enabled remote terminal unit (RTU) running a simple power substation that allows a remote SCADA system to log current and voltage values and control the state of the switchgear.
• OT Challenges: Tic-Tac-Toe: In this challenge, you need to play Tic Tac Toe by writing to holding registers on a Modbus Server. Beat the machine to complete the challenge. 

Licensing

OT Labs are available as an add-on for existing Immersive Labs (formerly Cyber Pro) customers. Please contact your Customer Success Manager for more details.

Immersive Labs Application Security

Blossom: Java Application Security Range Exercise

In our new Blossom: Java Application Security Range Exercise, you'll have the opportunity to get hands-on experience testing your skills at identifying and resolving deliberate vulnerabilities in high-quality applications. Mixed-skill teams will appreciate this fun and engaging experience. 

Written in Java and Springboot, this exercise puts you in the shoes of a software engineer at Orchid Corp. Users have reported a number of vulnerabilities after the recent release of Orchid's new HR platform, Blossom. You're part of a team responding to the crisis by triaging the vulnerabilities, implementing fixes locally, and then pushing them live to limit damage to the company's reputation. 

Python Expert Challenge Lab Collection

Enhance your cyber resilience with our new Python Expert Challenge Labs. This collection features a series of five highly difficult "demonstrate" labs focused on application security for Python-based applications. 

• Python: Expert Challenge 1
• Python: Expert Challenge 2
• Python: Expert Challenge 3
• Python: Expert Challenge 4
• Python: Expert Challenge 5

In all five labs, you'll demonstrate how to identify vulnerabilities in code and fix vulnerabilities in Python applications. based on limited information. Targeted at customers who find our existing platform content too easy, these labs will provide valuable, challenging content. Our aim is to level up the application security standards for Python applications by offering a secure coding challenge lab with multiple tasks for advanced developers. If you're a developer, security engineer, or application security professional and want to enhance your skills in securing Python applications, this collection is for you! 

Immersive Cyber Range Exercises

Salt Typhoon Cyber Range Exercise

We're pleased to announce the release of a new Salt Typhoon Defensive Cyber Range Exercise. Explore the tactics, techniques, and activities of Salt Typhoon, an advanced persistent threat actor known for high-profile cyber espionage campaigns. 

In the Salt Typhoon Cyber Range Exercise, Orchid Communications, a subsidiary of Orchid Corporation, operates telecommunications infrastructure in the US and Europe, providing broadband services and cellular infrastructure for retail and commercial customers. You've received threat advisories from the US CISA and the UK NCSC about activity associated with the threat actor Salt Typhoon in a recent uptick of attacks targeting the sector. A new variant of the SparrowDoor malware was used to gain an initial foothold in impacted networks. 

Salt Typhoon is believed to be directed by the intelligence collection requirements of China’s Ministry of State Security (MSS) and its associated foreign intelligence activities. The group targets critical national infrastructure (CNI) for intelligence collection and to pre-position and maintain access in the event of escalating tensions between the US and China. 

As a member of the security team, you’ll need to use Orchid's security stack and the information provided in the exercise to detect Salt Typhoon in a branch of the Orchid Communications network. You'll investigate the actions performed by this attacker using defensive tools such as Splunk and Velociraptor. Created with a telecommunications audience in mind, this intermediate exercise is a great fit for technical users.