Contents:

• Platform Updates
  • Adaptive assessment reporting in Manager Assignment Report
  • MITRE ATT&CK metric and framework update: Team-based view
• New Content
  • Tuoni 102 lab collection
  • C# Blossom: AppSec Cyber Range Exercise
  • Operation Skylock

Platform updates

Adaptive assessment reporting in Manager Assignment Report

The Manager Assignment Report for Adaptive Assessments now has extra data to give managers a better view of users' capabilities.

As part of the Assignment Report, managers can now view the results of their users’ adaptive assessments, showing their scores and skill level, and the difference between a user's two most recent attempts.

MITRE ATT&CK metric and framework update: Team-based view

You can now view MITRE ATT&CK framework coverage for specific teams. This will sit alongside the existing Organizational and Personal MITRE ATT&CK views under Team MITRE ATT&CK.

If you have teams set up within your organization, this new feature allows you to view the framework coverage of a specific team, sub-team, or combination of teams. You can only see coverage for teams that you manage. 

It works similarly to other team settings in the platform, such as assignments, where all sub-teams are included by default when an overarching team is selected (unless specific sub-teams are explicitly deselected).

What if I don’t have any teams set up within my organization?

Setting up teams in the platform is a great way to filter and administer assignments more effectively by focusing on meaningful groups rather than individual users – especially if you have a lot of users!

If you don’t have any teams set up, you’ll still be able to see the Team MITRE ATT&CK tab, but you’ll instead be prompted to set up a team to see the coverage.

Will there be any differences in what I can see on the platform?

Previously, team managers, organizational admins, and license managers could all access the Organizational view. However, team managers could only see the combined information for the teams they manage under Organizational MITRE ATT&CK, rather than the entire organization, which was confusing. 

To address this, we’ve made the following changes:

Organization admins and license managers will be able to see:

• Organization MITRE ATT&CK: This view will remain as it currently is and display information from all users, including those who are in a team and those who aren’t. This view doesn’t have the ability to filter by users or teams.
• Personal MITRE ATT&CK: This will remain as it currently is and display an individual user's personal coverage and relative progress.
• Team MITRE ATT&CK: In this view, you can filter by specific teams, combinations of teams, or all teams that you manage. You don’t need to be in a team yourself to access this view, but data will only be displayed if you have teams set up within the platform.

Team managers will be able to see:

• Team MITRE ATT&CK: In this view, you can filter by specific teams, combinations of teams, or all teams that you manage.
• Personal MITRE ATT&CK: This will remain as it currently is and display an individual user's personal coverage.

Note: Team managers can no longer access the Organization MITRE ATT&CK. Since previous access to this view displayed coverage information related only to the teams that they managed, this is now provided in the new Team MITRE ATT&CK.

New Content

Product: Immersive Labs

Tuoni 102 lab collection

Our second collection on the red teaming framework, Tuoni, will be released this month.

Tuoni 102 is a more advanced collection that dives deeper into domain-focused attacks by looking at operational security (OpSec) techniques, credential access, lateral movement, and evasion techniques.

This new instalment gives intermediate red teamers the tools and knowledge to operate more stealthily and effectively in adversary simulation engagements. It's designed to bridge the gap between beginner-level red teaming and full-scale adversary emulation.

What does the content include?

Tuoni 102 consists of seven hands-on labs that walk learners through real-world scenarios using the Tuoni command and control (C2) framework. The labs are structured to simulate an end-to-end engagement within an Active Directory environment – from setting up redirectors and gathering domain intel to deploying persistence, evading detection, and cleaning up post-operation.

Along the way, users will also learn to integrate powerful third-party tools like SharpHound and Seatbelt, and bypass common defenses like AMSI and AppLocker. Each lab builds on the last, culminating in a final challenge in which users apply everything they’ve learned in the collection to compromise a domain and exfiltrate data while staying under the radar.

Who is this content for?

These labs are built for red teamers, penetration testers, and advanced SOC analysts looking to deepen their offensive security skills in Windows domain environments. Learners should be familiar with basic C2 operations (covered in the Tuoni 101 collection) and have a working knowledge of Active Directory. Tuoni 102 is ideal for those aiming to level up their tradecraft and OpSec awareness in simulated engagements.

~-~

Product: Immersive Cyber Range Exercises

C# Blossom: AppSec Exercise

We're continuing the AppSec Range Exercises offering throughout 2025. This month, it's the return of Blossom – this time in C#!

Blossom is an immersive, practical exercise designed to enhance your organization’s application security skills.

• Practical exercises: We identified a need for practical, repeatable application security exercises that go beyond standard upskilling labs, addressing the gap in accessible, real-world training.
• Team collaboration: Existing training often lacks multi-user scenarios. Our exercises are built to be collaborative, mirroring real-world teamwork between development and security teams.
• Holistic security view: We aim to demonstrate comprehensive security practices throughout the entire software development life cycle (SDLC), moving beyond just fixing code vulnerabilities.  

What does the content include?

Our AppSec Range Exercises provide a simulated environment where teams tackle real-world security challenges. Key components include:

• Scenario-based learning: Exercises like Blossom present realistic scenarios, such as patching vulnerabilities found in a penetration test of an HR application.
• Real-world tooling: Participants use familiar tools like Kanban boards (similar to JIRA) for managing vulnerability tickets, version control systems (GitLab) for code management and CI/CD, and automated verification servers to test patches.
• Modern technology stack: The Blossom exercise features a common enterprise setup. This edition has a C# backend, microservices architecture, and Docker/GitLab infrastructure.
• Hands-on tasks: Users are tasked with identifying vulnerability locations, implementing patches locally, and deploying the fixes.

Who is this content for?

These exercises are primarily designed for:

• Development teams to gain practical, hands-on experience in identifying and remediating security vulnerabilities, directly enhancing their secure coding skills.

• Engineering managers to facilitate team collaboration, triage vulnerabilities, and track progress using integrated tools like Kanban boards.

   

~-~

Product: Immersive Crisis Simulations and Cyber Range Exercises

Operation Skylock

Operation Skylock is a fast-paced, one-hour drill that combines a technical Cyber Range Exercise with a Crisis Simulation.

What does the content include?

The scenario centers on a compromised web application in AWS that escalates to a full account takeover, culminating in a ransomware attack.

This drill challenges both technical responders and crisis teams to coordinate under pressure during a high-impact cloud breach.

Who is this content for?

The range exercise is designed for a SOC or incident response team, while the Crisis Sim is designed for security managers who manage incidents. 

To access both elements of this drill, you’ll need a Cyber Range Exercising license and a Crisis Simulation license.