Platform Update

Dynamic AI Feed for Immersive One

What are we doing

We've introduced Dynamic AI Feed to the Immersive One platform as part of our AI-powered Crisis Simulation capability. This feature injects realism into cyber crisis exercises by delivering a stream of real–time emails, social media updates, and news alerts directly into the simulation. We've also added interactive AI personas—such as ransomware actors, journalists, and internal stakeholders—that respond to your inputs in real time. You now have granular control over the tempo, allowing you to calibrate the intensity of the "noise" to match your team’s maturity.

Who are we doing it for

This update is for any professional involved in a cyber crisis, from technical analysts and security managers to leadership, HR, and legal teams. It's designed for anyone who needs to practice triaging information under pressure while maintaining operational discipline. Whether you’re a junior responder or a senior executive, these tools help you identify exactly where communication and decision–making begin to fray during a high–velocity breach.

Why are we doing it now

In a real–world incident, crisis management doesn't happen in a sterile environment. Technical work often takes place while the CEO is demanding answers and leaked data is hitting social media. Typical simulations are often too quiet, giving participants a luxury of time they won't have during an actual attack. We're launching Dynamic AI Feed now to bridge the gap between simulation and reality, providing the data–backed evidence needed to prove your organization is ready to outmanoeuver the adversary.

New Contents

Building with AI: Gemini CLI Lab Series

As AI development tools move from experimental to essential, the biggest challenge for engineering teams is balancing speed with safety. We’ve heard your concerns about "vibe coding" leading to insecure deployments and the risks of leaking sensitive data to Large Language Models (LLMs).

To address this, we’ve launched a new collection Building with AI: Gemini CLI (Command Line Interface)

This collection of hands-on labs is designed to transform the Gemini CLI from a simple prompt tool into a secure, high-octane engine for your development lifecycle. Your team will learn how to automate specialized tasks using Agent Skills and fine-tune access control with the Policy Engine—all while keeping Personally Identifiable Information (PII) safe through advanced guardrail integration.

Key Lab Milestones

• Practical Application: Gain hands-on experience coding with the Gemini CLI through real-world examples.
• Code Reliability: Improve confidence and trust in generated code using specification and test-driven development (TDD) (using Google's own Conductor framework).
• Advanced Automation: Boost productivity by creating custom slash commands.
• Data Security: Protect sensitive information by implementing robust guardrails that restrict Gemini CLI's visibility into private data.
• Governance: Implement Gemini's CLIs policy engine to administer permitted tools

Whether your team is generating software, Infrastructure as Code (IaC), or Helm charts, these labs provide the practical experience needed to build faster and more securely.

OWASP Agentic Security 2026: The Complete Collection

We're excited to release a comprehensive new collection titled OWASP Agentic Security 2026. This collection features 11 labs that provide a deep dive into the security risks associated with autonomous AI agents. You’ll explore critical vulnerabilities like agent goal hijack, tool misuse, and rogue agents through detailed explanations and practical prevention strategies. The collection concludes with a final assessment lab, OWASP Agentic Security 2026: Demonstrate Your Knowledge, to validate your mastery of the curriculum.

Who are we doing it for

This collection is built for security professionals, AI developers, risk management teams, and IT administrators. We’ve designed the content at a beginner level to make it accessible for those just starting to secure agentic workflows. Whether you're building agents or defending against them, these labs give you the foundational knowledge needed to identify and mitigate modern AI threats.

Why are we doing it now

As organizations rapidly adopt autonomous agents, the attack surface for AI is expanding beyond traditional prompts. The Open Web Application Security Project (OWASP) recently released the top 10 vulnerabilities for agentic applications for 2026 to address these emerging threats. We're releasing this collection now to help you stay ahead of attackers who exploit cascading failures and inter-agent communication. By mastering these concepts today, you can build more resilient, secure systems before these vulnerabilities are exploited in the wild.

Introduction to Incident Response for OT

We’re releasing a new seven-lab collection titled “Introduction to Incident Response for OT”. This collection explores the specialized approaches required to handle cyber incidents within operational technology (OT) environments. You’ll learn how to recognize OT-specific incidents, validate alerts safely, and contain threats without disrupting critical operations. The labs also demonstrate how to coordinate effectively across security, engineering, and management teams.

Who are we doing it for

This collection is designed for two primary groups:
• OT engineers: This helps you understand the formal incident response (IR) process and how to shift your mindset when dealing with an active cyberattack.
• IT cybersecurity professionals: If you’re coming from a traditional IT background, these labs teach you how priorities change when you work in an OT environment—specifically focusing on safety and process stability.

Why are we doing it now

Responding to cyber incidents in industrial settings requires different methods than traditional IT response. It’s vital to protect physical safety and system availability while managing a threat. We’re providing this content now to ensure your teams have the specialized knowledge to manage risks and respond to alerts without causing accidental operational downtime.

Note: These labs are available to all users with an OT License and can be found in the OT Category

Orchid Fusion - APT33 Collection

• DFIR (Incident Response): An alert-driven investigation. Participants respond to triggered alerts and trace the attacker's path chronologically through the kill chain.
• Threat Hunting: An intel-driven exercise. Participants start from APT33 threat intelligence and proactively hunt for indicators of compromise across the environment, testing hypotheses against live telemetry.

Who are we doing it for

These exercises are suitable for orgs looking to exercise their:

• SOC Analysts
• DFIR Analysts & Incident Responders
• Threat Hunters

Why is this critical for you and your team?

APT33 is a well-documented Iranian state-sponsored threat group known for targeting financial services, energy, and government sectors. Defenders need hands-on experience investigating the techniques these actors actually use - not just reading about them. This exercise puts analysts inside a compromised enterprise network with real logs, real tooling, and real attack artifacts to investigate.

The attack chain covers 8 phases across 17 MITRE ATT&CK techniques, including:

• Initial Access: Stolen VPN credentials used to enter the network
• Credential Attacks: SSH brute-forcing, Kerberos ticket theft, LSASS memory dumping with Mimikatz
• Lateral Movement: Pass-the-Ticket, PsExec service deployment, WMI-based pivoting
• Persistence & Exploitation: SQL Server xp_cmdshell abuse via linked servers, protocol tunnelling with socat
• Data Exfiltration: Sensitive corporate documents stolen via cloud storage APIs

LLM Guardrails: Securing Enterprise AI Adoption

Orchid Corp: Mustang Panda – Dynamic Threat Range

Immersive is releasing a new Dynamic Threat Range (DTR) that simulates a full Mustang Panda intrusion against a fictional organization, Orchid Corp. This is a multi-stage, end-to-end attack chain running across a live enterprise environment, including an Active Directory domain, SQL database, Windows workstations, and a mail server.
 

What are we doing

We are providing an on-demand, realistic breach simulation that allows you to investigate an attack from initial spearphishing through to domain compromise and NTDS.dit extraction. You can conduct your investigation using either Splunk or Elastic as your Security Information and Event Management (SIEM).

The exercise includes two specializations, each containing 19 guided tasks:
• Digital Forensics and Incident Response (DFIR): An alert-driven investigation where you respond to triggered alerts and trace the attacker's path
• Threat Hunting: An intel-driven exercise where you start from Mustang Panda threat intelligence to proactively hunt for indicators of compromise (IOC)

The attack chain covers eight phases across 20+ MITRE ATT&CK techniques, such as:
• Initial Access: Spearphishing via a malicious ZIP containing a DLL side-loading payload
• Execution and Evasion: Process injection into wmiprvse.exe and unmanaged PowerShell execution
• Credential Access: LSASS memory dumping and NTDS.dit extraction via Volume Shadow Copy
• Lateral Movement: WMI-based pivoting from workstations to the domain controller
• Defense Evasion: Event log clearing across Security, System, and WMI logs
 

Who are we doing it for

This collection is designed for specialized security roles looking to test their skills in a live telemetry environment. It’s particularly suited for:
• Security Operations Center (SOC) analysts
• DFIR analysts and incident responders
• Threat hunters

Why are we doing it now

Mustang Panda is an active Chinese state-sponsored threat group known for targeting government organizations and NGOs. They specialize in disguising malicious software inside legitimate applications, a technique that's difficult to spot without practice. By dropping your analysts into a fully compromised network with real logs and attack artifacts, they can build the expertise to detect these intrusions before they face one for real.