Contents:

• Platform updates
  • AI in-lab assistant chatbot
  • AI Lab Builder
  • Immersive Certifications
  • The Adaptive Assessment Manager Report
  • MITRE ATT&CK coverage
  • Limited release: Immersive Crisis Simulation & Workforce scenario builder redesign
• New content
  • Product: Immersive Labs
    • Trick or Treat on Specter Street 🎃
    • Event Tracing for Windows lab collection
    • Google SecOps Fundamentals lab collection
    • Java Spring Boot lab collection
    • Business Impact Analysis lab collection
  • Product: Immersive Operational technology labs
    • ISA/IEC 62443 Fundamentals
    • Intro to Rail OT
    • Hack Your First HMI
  • Product: Immersive Crisis Simulations
    • The Puppetmaster’s Trick or Treat 🎃

Platform updates

AI in-lab assistant chatbot

We're excited to introduce an AI chatbot, seamlessly integrated into the lab environment.

This custom-built tool provides instant, on-demand hints, tips, and directional guidance for lab questions and tasks. It's designed to build user confidence and facilitate progression by offering support without directly providing answers.

People learn best when they can explore, ask questions, and get real-time guidance in context. Unlike traditional hints and walkthrough guides, which break immersion and reduce the learning impact, the AI assistant is available within the lab and can be accessed with a single click.

AI Lab Builder

We’re thrilled to introduce AI Lab Builder, a conversational AI assistant built directly into Lab Builder to help authors in the lab creation process. This intelligent agent helps authors turn their ideas into fully structured labs by guiding content development, generating tasks, and applying our proven best practices for learning and style.

With its built-in research capability and ability to refine content based on feedback, AI Lab Builder accelerates lab creation, reduces effort, and acts as a creative partner throughout the build journey.

Whether you’re looking to quickly create an application security lab, generate a tailored threat briefing for your organization, or design a lab on any cyber topic to upskill your team, the AI assistant streamlines the process and helps you bring it to life.

Immersive Certifications

Now, you can download an Immersive Certification in PDF format when you complete one of our Immersive Certified career paths. 

Certificates provide a more formal mechanism of evidencing your achievements than badges alone. With a downloadable certificate, you can now track, share, and celebrate your professional development, proving your skills in a specific career path.

With nearly 40 career paths to choose from, ranging from threat hunter and SOC analyst to Python developer and incident responder, we’ve got you covered!

The Adaptive Assessment Manager Report

We’ve also launched the Adaptive Assessment Manager Report. This gives managers immediate, data-driven visibility into skill proficiency and training effectiveness across their organization.

This report transforms how you track talent development and measure competence, providing essential metrics to drive smarter decisions:

• An instant view of skill distribution across the organization, with users automatically broken down into beginner, intermediate, and expert proficiency levels
• Objective growth measurement by comparing the first and most recent attempt scores
• Real-time monitoring of assessment completion rates
• Individual score progression

Managers can use these metrics to focus development efforts and make objective, data-driven decisions about talent management.

MITRE ATT&CK coverage 

We know how important it is to understand your MITRE ATT&CK coverage and how it changes over time, so we’ve added a new element to the Metrics Tracker. 

This enables you to monitor changes in your coverage over time, benchmarked against best-in-class or specific sectors. Then, you can drill down into your organization’s strengths and capability gaps.

Limited release: Immersive Crisis Simulation & Workforce scenario builder redesign

We’ve redesigned our scenario builder for both Immersive Crisis Simulation and Immersive Workforce, to put user interaction at the forefront. It’s a more intuitive way of building the complex scenarios you need to exercise your teams and prove your readiness.

Being able to build large, complex scenarios is key to effectively exercising teams in your organization, so we want to make this as easy as possible. Among other enhancements, this month introduces:

• A helpful new scenario overview page
• Real-time editing
• Auto-save in tree view
• A global settings area

New content

Product: Immersive Labs

Trick or Treat on Specter Street 🎃

This year’s Halloween collection gives users the chance to test their skills across multiple levels and domains, in the case of the missing canine!

You’ve lost your Labrador, Bones. The trail leads you to Specter Street, a spooky row of haunted houses, ghoulish gates, and terrifying terraces. This isn't a simple stroll. Each house is a lab that contains a different challenge. Can you complete all the challenges and find your beloved dog?

What does the content include?

October isn’t just about Halloween – it’s also Cybersecurity Awareness Month. 

Trick or Treat on Specter Street features 13 labs that will be released throughout the month, and is full to the brim with offensive, defensive, and application security challenges:

• Trick or Trace: A runaway dog, a spooky house, and a candy bowl full of packets to analyze using Wireshark
• S.I.L.V.E.R.: Vampires, the dark web, and cyber threat intelligence used to stop an attack
• Ripper’s Riddle: A descendant of Jack the Ripper, a murder mystery, and cracking hashes with password cracking tools
• Ghost of the SOC: A host machine plagued by a spectral infection, log analysis with Elastic, and removing a persistent threat
• Cursed Canvas: Souls trapped in paintings by an evil wizard that can only be saved using steganography skills
• Widows’ Web: The widow and her swarm of spiders, web crawlers, log inspection, and a honeypot
• Manor of Madness: An abandoned manor full of twists and turns – escape is only possible via packet modification and NoSQL attacks
• Wizard’s Wicked Wish: Another evil wizard, this time with an aim to end the world, who can only be defeated by finding and exploiting a vulnerability on his machine using Metasploit
• Macro Polo: An ever-changing and shape-shifting house, and an escape that’s only possible with a knowledge of nim, macros, and abstract syntax trees
• Serpent Sanctum: A giant serpent, CLI-based challenges, and a Python jail escape
• Phantom Pages: A thrilling Boot2Root challenge inside a haunted home library
• Morphy’s Mansion: A game of chess against the ghost of renowned chess player Paul Morphy, who you can only beat by exploiting application logic
• Cryptographer’s Crypt: A hidden crypt and some cryptography challenges

Who is this content for?

These labs are built for everyone! They give learners the chance to prove and improve their skills across a variety of cybersecurity domains. Users can also identify potential growth areas after attempting each challenge.

Event Tracing for Windows lab collection

This collection introduces learners to Event Tracing for Windows (ETW), its internals, applications in detection engineering, and adversarial techniques such as ETW patching and telemetry evasion.

What does the content include?

The content is structured around hands-on labs, each including a scenario, step-by-step guidance, and a lab exercise.

Over the six labs in this collection, you’ll:

• Understand the structure and role of ETW in Windows telemetry
• Run and analyze ETW sessions
• Simulate ETW patching as an adversarial tactic
• Learn to detect ETW evasion
• Trace Windows event logs back to their ETW origins
• Identify suspicious security-relevant activity using ThreatIntel ETW

Who is this content for?

These labs are built for security engineers and analysts who want to gain practical skills in understanding and applying knowledge on ETW.

The exercises are primarily designed for security engineers, security analysts, and security architects who want to deepen their existing knowledge of Windows logging and how ETW can be used by defenders and attackers.

Google SecOps Fundamentals lab collection

We’re excited to launch the Google Security Operations (SecOps) Fundamentals collection, a hands-on learning path designed to give teams practical experience with one of the fastest-growing security operations platforms.

What does the content include?

Across eight labs, learners will explore the core capabilities of Google SecOps while progressively building their skills through guided, interactive practice. The collection covers:

• Unified Data Model (UDM)
• Event search
• YARA-L detection rules
• SOAR playbooks
• Managing detection rules
• Case management

Whether you’re new to the platform or looking to strengthen your skills in detection engineering, automation, and investigation, this collection provides a clear, practical foundation to build confidence in Google SecOps.

This structure ensures learners gain both conceptual understanding and in-console experience, flattening the learning curve and preparing analysts to work effectively in Google SecOps.

Who is this content for?

This collection is designed for practitioners who are adopting or evaluating Google Security Operations as their security operations platform. It’s particularly valuable for:

• SOC analysts looking to build confidence in detection and investigation workflows
• Incident responders who need to manage and investigate cases end-to-end
• Detection engineers developing and refining YARA-L rules
• Security automation specialists creating SOAR playbooks and workflows
• Cloud and security engineers working with log data and integrations
• MSSP analysts and architects supporting clients with Google SecOps deployments

This collection provides both newcomers and experienced practitioners with a structured, hands-on pathway to mastering the fundamentals.

Java Spring Boot lab collection

This collection provides hands-on experience with the Java Spring Boot framework. It's designed to build practical, real-world skills essential for modern back-end development.

By working through concrete examples, learners will gain the confidence and competence needed to build, secure, and deploy robust applications. This practical approach solidifies understanding and prepares developers for the challenges of enterprise-level application development.

What does the content include?

Across 10 comprehensive labs, you'll learn everything from foundational concepts to advanced application development, with each lab progressively building on the last.

Each lab includes detailed setup instructions, code snippets, challenge exercises, and complete solution files to guide your learning.

Who is this content for?

These labs are built for developers who want to gain practical, job-ready skills in the Spring Boot ecosystem.

These exercises are primarily designed for Java developers, software engineers, and backend developers who are new to Spring Boot or want to deepen their existing knowledge.

Business Impact Analysis lab collection

A Business Impact Analysis (BIA) is the foundation of every business continuity program. It identifies which processes matter most, how quickly they need to recover, and what resources they depend on.

This collection shows you how to conduct, interpret, and apply a BIA in real-world settings. By understanding true business priorities, organizations can design recovery strategies that are both effective and proportionate.

What does the content include?

This collection features labs that walk learners through the full BIA lifecycle, from scoping to results interpretation, including:

• What BIAs are and why they matter
• Identifying critical processes and dependencies
• RTOs, RPOs, and MAOs
• Impact interviews
• Uncovering technical dependencies
• Tracing internal and external dependencies
• Identifying minimum staffing and key skills
• Mapping BIA outputs to a continuity strategy

Each lab combines real examples, plain-language explanations, and interactive tasks designed to help learners confidently apply the BIA process to their own organization.

Who is this content for?

These labs are built for business continuity managers, resilience practitioners, and operational risk leads who are responsible for identifying and protecting critical processes. 

They’re also suitable for IT service continuity teams and departmental managers contributing to BIA workshops or interviews.

Before starting, learners should have a basic understanding of business continuity principles or have completed the Business Continuity 101 collection.

~-~

Product: Immersive Operational technology labs

ISA/IEC 62443 Fundamentals

Building secure industrial control systems requires a structured approach that addresses both technical and organizational challenges. 

The ISA/IEC 62443 Fundamentals collection provides a framework for securing industrial automation and control systems. These labs take you through the essential components, from understanding its core focus areas and structural framework to exploring how it integrates with other industry standards.

Who is this content for?

This collection will benefit OT cybersecurity leaders and CISOs in OT organizations, as well as anyone else interested in regulatory requirements in the OT sphere.

Intro to Rail OT

Railway operational technology presents unique cybersecurity challenges where safety and security intersect in critical ways. This collection explores the specialized world of rail OT systems, introducing the concept of security-informed safety and examining the evolving threat landscape targeting railway infrastructure. 

Who is this content for?

This collection is aimed at cybersecurity professionals and leaders who work in OT, as well as OT engineers. Anyone with an interest in rail sector security will find this collection worthwhile!

Hack Your First HMI

Human-machine interfaces are critical control points in industrial systems, making them high-value targets for attackers. This collection provides hands-on experience in HMI penetration testing, including discovering exposed interfaces on the internet and local networks.

Who is this content for?

This collection is for cybersecurity professionals and penetration testers in the OT sphere, or anyone looking to pivot into operational technology to explore new fields.

~-~

Product: Immersive Crisis Simulations 

The Puppetmaster’s Trick or Treat 🎃

The Puppetmaster is back with a coordinated attack on a critical national infrastructure organization.

Here’s the twist. Make the right decisions and be rewarded with a treat from the Puppetmaster. But make a wrong move, and the Puppetmaster has a dastardly trick up their sleeve…

Dare you play the Puppetmaster’s game? Will you survive, or will they finally get their revenge?

This Crisis Simulation includes…

• Tactical decision-making: Weigh the risks and rewards of each action as you navigate a high-stakes, real-time cyber crisis.
• A coordinated attack: Confront a multi-layered assault designed to test your technical skills and teamwork under pressure.
• Survival and strategy: Work with others to formulate a winning strategy against an elusive and unpredictable adversary.