Contents:

• Platform Updates
  • GitHub Enterprise Server Integration
  • Updated MITRE ATT&CK Framework
  • REST API Enhancements
  • Leaderboard Enhancement
• New and Updated Content
  • Product: Immersive Labs
    • New AI Foundations Lab Collection
    • New Offensive Challenge Collection: The Maze
    • New Scattered Spider Labs
    • CVE-2025-53770 (ToolShell SharePoint RCE)
    • New Career Paths
  • Product: Immersive Cyber Range Exercises
    • Blossom — Go Range Exercise
  • Product: Immersive Crisis Simulations
    • Responding to a Scattered Spider Attack
  • Product: Immersive Workforce Exercises
    • Social Engineering Techniques Exercise

Platform Updates

GitHub Enterprise Server Integration

We're excited to announce that Immersive now supports integration with GitHub Enterprise Server 3.16.0. 

After installing this integration, you can link Immersive content assignments to your GitHub Enterprise Server repositories and include the assignment completion status for individual users in your GitHub Enterprise Server checks. You can use the Code access control toggle to configure these checks as required before merging any code changes. When this is turned on, teams must complete required secure coding and application security training before they can merge code changes to the selected source code repositories.

With the Content suggestion toggle, we also offer content suggestions for GitHub pull requests and issues based on Common Weakness Enumeration (CWE) references and common phrases associated with code vulnerabilities. The CWE content suggestion feature lets you seamlessly integrate Immersive into your CI/CD pipelines and vulnerability management programs. Labs are automatically recommended based on code findings, streamlining the remediation of vulnerabilities.

For further details, see GitHub Enterprise Server Integration Guide. 

Updated MITRE ATT&CK Framework

We're pleased to share that the version of the MITRE ATT&CK® Framework used by the Immersive platform has been updated to the latest version: v17.1.  

Released by MITRE in April 2025, this update includes new techniques and sub-techniques that appear on the heatmap view. You may notice slight changes to your coverage in the MITRE ATT&CK Dashboard due to these additions. 

For details regarding the improvements included in the latest version of the MITRE ATT&CK® Framework, see the MITRE April 2025 Release Notes. 

REST API Enhancements

We're excited to unveil the following enhancements to the Immersive REST API:

• We've added a new Attempts endpoint, which includes completion data for our labs.
• We added new functionality to the Assignment endpoint, which includes completion data for Immersive Crisis Simulations and Workforce exercises.

For further details, see our REST API documentation. 

Leaderboard Enhancement

In response to customer feedback, we've enabled Organization Admins to have access to the All Teams tab of the Leaderboard without needing to be part of a team. The benefit is that Organization Admins can now easily visualize the relative position of teams across the organization at a high level.

New Content

Product: Immersive Labs

AI Foundations Lab Collection

We're thrilled to share a new lab AI Foundations lab collection that covers the latest developments in AI, enabling customers to better navigate the fast-paced movement of Artificial Intelligence. The collection consists of seven labs explaining the core components of a modern AI implementation and illustrating how these components complement each other to provide powerful capabilities. You can safely explore AI within an isolated, sandboxed environment, which features user credentials that are locked to the lab environment and uses privacy-centric LLMs.

This lab collection provides practical environments with real and relevant AI systems, helping to keep security at the forefront throughout your AI adoption journey. Each of the labs builds upon each other, leading to an understanding of how all the AI concepts work with each other to provide a modern AI system:

• AI Foundations: Ep.1 – Artificial Intelligence: The artificial intelligence (AI) landscape is evolving at an unprecedented pace. Navigating the dozens of services, platforms, models, and supporting technologies can be overwhelming, especially when new products are constantly being released. This lab provides a high-level overview of AI and the current ecosystem, exploring how AI works, some of its limitations, and where it could go next.
• AI Foundations: Ep.2 – Core Components: This lab provides a high-level overview of the core components of modern AI systems. It covers the basics of machine learning models, AI applications, Retrieval Augmented Generation (RAG), Model Context Protocol (MCP), and AI agents. You’ll learn how these components complement each other to shape the modern AI ecosystem.
• AI Foundations: Ep.3 – Large Language Models (LLMs): Large language models (LLMs) are often considered the “brain” in most AI systems. This lab explores LLMs at a high level, explaining foundational models and their use in AI applications. It also explores important security and privacy considerations, providing a foundational understanding for implementing AI systems.
• AI Foundations: Ep.4 – Retrieval Augmented Generation (RAG): Retrieval Augmented Generation (RAG) is a mechanism for supercharging AI systems with your own data. This lab explores RAG’s components and security considerations. In it, you’ll walk through a real RAG-powered AI system within a safe sandbox environment.
• AI Foundations: Ep.5 – Model Context Protocol (MCP): The recent shift from AI systems knowing things to AI systems doing things is fueled by the ability to invoke tools. Writing tools from scratch can be complex and time-consuming, and, if not done correctly, can introduce even more security issues. Model Context Protocol (MCP) fixes this problem and has been adopted rapidly in the AI ecosystem. This lab explores MCP and how it works at a high level, providing a safe sandbox environment for you to gain hands-on experience with an MCP server.
• AI Foundations: Ep.6 – Agentic AI: Many experts are suggesting that the near future will see people moving from being AI users to AI operators. Agentic AI is at the forefront of this revolution – AI systems with some autonomy to make their own decisions. This lab explores AI Agents and provides access to an agent in a sandbox environment.
• AI Foundations: Ep.7 – Demonstrate Your Knowledge: In this lab, demonstrate the skills you've learned from the collection by completing a theory challenge. You'll evaluate your knowledge through an interactive quiz.

Aimed at a general audience, these labs serve as a guided walkthrough. Although technical details are included, anyone working with AI should be able to complete this collection.

Offensive Challenge Collection: The Maze

Scattered Spider Labs

We're excited to announce the release of two labs tackling the Scattered Spider threat actor:

• Threat Actors: Scattered Spider: Develop the background that you need to protect your organization against Scattered Spider, a cybercriminal group that has been active since at least 2022, targeting customer relationship management and business process outsourcing (BPO) firms and telecommunications and technology companies. Gaining notoriety for hacking major casino and gambling companies, it engages in data theft extortion and uses various ransomware. The group is known for its expertise in social engineering and adaptability in criminal activities.
• Scattered Spider and Dragonforce: Campaign Analysis: Analyze the tactics, techniques, and procedures of two prolific threat actors (Scattered Spider and Dragonforce) in this campaign analysis. You'll investigate the social engineering tactics of Scattered Spider and explore how they gain access to networks by tricking users into giving credentials to their accounts and then logging in and dropping Dragonforce malware.

CVE-2025-53770 (ToolShell SharePoint RCE)

We're pleased to share the release of offensive and defensive labs dealing with CVE-2025-53770, a critical zero-day vulnerability affecting on-premise SharePoint servers. This vulnerability, which has been actively exploited in the wild, allows for unauthenticated remote code execution (RCE). Eye Security researchers detected the exploit chain on July 18, 2025 during an incident response engagement.

• In the CVE-2025-53770 (ToolShell SharePoint RCE): Offensive lab, you'll learn about the CVE-2025-53770 vulnerability and how to exploit it to gain remote code execution. This lab outlines how to perform an unauthorized deserialization attack and explains the impact of remote code execution vulnerabilities.
• In the CVE-2025-53770 (ToolShell SharePoint RCE): Defensive lab,  you'll learn about the CVE-2025-53770 vulnerability, how to patch it, and how to detect indicators of compromise (IoCs) relating to exploitation attempts. This lab outlines how attackers can bypass authentication using SignOut.aspx. You'll analyze logs to identify indicators of compromise to detect signs of exploitation.

Career Paths

We're excited to announce the release of eight new career paths, curated to showcase previously-released Immersive content and adaptive assessments. 

The following career paths with assessments have been released:

• The Penetration Tester: Prerequisites career path is designed to be taken before any of the other Penetration Tester career paths (for example, Infrastructure Pen Tester or Web App Pen Tester). It covers fundamental knowledge required in any of the offensive-leaning career paths. The Assessment: Offensive Security assessment in this career path covers a broad range of offensive security knowledge areas.
• The Penetration Tester: Advanced career path contains challenging content and is designed for penetration testers who have completed the intermediate or advanced roles. This career path includes both web app and infrastructure penetration testing skills and lets users apply their knowledge from other career paths. The Assessment: Offensive Security assessment in this career path covers a broad range of offensive security knowledge areas.
• The Systems Administrator: Beginner, Systems Administrator: Intermediate, and Systems Administrator: Advanced career paths are designed for systems administrators or users in the IT Operations domain. The Assessment: IT Operations assessment in these career paths covers a range of skills explored in the career paths.
• The Secure Developer: Prerequisites career path is designed for developers and serves as an introductory career path before the other Secure Developer career paths. The Assessment: Application Security assessment in this career path covers a range of foundational application security knowledge areas. Some knowledge of Java code may be required to complete some of the questions in the assessment.

The Range Exercise Prep: Op. Nimrod and Range Exercise Prep: Salt Typhoon career paths are preparation collections for the associated Cyber Range exercises. These career paths contain labs that our Cyber team recommends users complete before starting the exercises.

~-~

Product: Immersive Cyber Range Exercises

Blossom — Go Range Exercise

We're excited to offer a new Blossom AppSec range, Orchid Corp: Blossom — Go, intended for mixed-skill development teams seeking to enhance their secure coding skills and engineering managers aiming to facilitate team collaboration in vulnerability remediation. This cyber range exercise features a modern technology stack, providing hands-on experience with secure development practices throughout the SDLC. 

Orchid Corp: Blossom — Go is an Application Security Team Challenge that will put you in the shoes of a software engineer at Orchid Corp. After the recent release of Orchid's new HR platform, Blossom (which has a frontend that is built with React and a backend that is built with Go), users have reported a number of vulnerabilities in the application. Your team's job is to respond to the crisis by triaging the vulnerabilities, implementing fixes locally, and then pushing them live to save the company's reputation.

~-~

Product: Immersive Crisis Simulations

Responding to a Scattered Spider Attack

Explore a high-pressure identity-based cyber crisis based on the tactics of the Scattered Spider threat actor with our new Responding to a Scattered Spider Attack crisis simulation exercise. Participants take on the role of the incident response team to navigate and make decisions regarding a complex situation involving account takeover, data exfiltration, and extortion with significant legal, financial, ethical, and reputational implications for Orchid Global.

• Enhance your understanding of the leadership's role in a human-centric cyber crisis.
• Develop your skills in making strategic decisions under pressure.
• Challenge you to balance competing priorities and stakeholder interests during a data extortion event.
• Promote effective communication and collaboration across teams during a cybersecurity incident.

~-~

Product: Immersive Workforce Exercises

Social Engineering Techniques Exercise

Phishing and fraudulent communications (known as social engineering) remains one of the most successful ways for cybercriminals to gain access to organizations, with over 3.4 billion phishing emails sent everyday and 57% of organizations reporting that they deal with phishing on a weekly basis. Using methods such as emails encouraging you to click on links, download malicious attachments, or share information with people who are not who they claim to be, phishing represents one of the main ways that you may be targeted within your organization. 

Prepare to protect yourself and your organization with our new Social Engineering Techniques scenario. This scenario covers some of the newest phishing techniques used by hackers to encourage you to respond, download attachments, and/or perform tasks for them.