Platform Update
Microsoft Teams: Immersive Integration – Training Notifications and Alerts
Release Date: March, 2nd, 2026
We’re launching the Microsoft Teams integration to help you manage training more effectively. Training notifications, assignment alerts, and completion reminders now arrive directly in your Microsoft Teams channels. This reaches your people where they already work instead of relying on email or platform logins. Admins install the Immersive bot from the Teams app catalog, configure which channels receive notifications, and their teams start getting nudges to complete assigned training without leaving the app.
To get started, a Microsoft tenant administrator must install the Immersive bot from the Teams app catalog and grant the required permissions as a one-time setup. Please note that user email addresses on the Microsoft tenant must exactly match their email addresses on the Immersive platform, as mismatched emails will prevent account synchronization. If you need to remove an existing integration setup, please contact support.
Who are we doing it for
Security managers and training leads: You get better visibility and completion rates because reminders land in channels your teams actively monitor, not buried in inboxes
Developers and security practitioners: Training assignments and deadlines surface alongside your day-to-day conversations, so nothing gets missed.
Why are we doing it now
Email-based training notifications have low engagement because they compete with everything else in the inbox and are easy to ignore. Microsoft Teams is where technical teams coordinate daily, and putting training prompts there removes a layer of friction. This is the first in a collection of collaboration tool integrations designed to meet your workforce where they are.
NIST NICE Heat Map is now available!
Release Date: March, 11th, 2026
Who are we doing it for
Why are we doing it now
New Feature: Warning Mode for GitHub Integration
Release Date: March, 11th, 2026
We’ve added a warning mode to the GitHub integration. When you open a pull request (PR) and have an overdue training assignment, a comment is automatically posted on the PR. This notifies both you and your reviewer. This feature is a softer alternative to commit blocking – it surfaces the training gap without stopping your work. The PR comment is updated in place if the assignment status changes, so there’s no comment spam.
Who are we doing it for
Security managers: You can run developer training programs with visibility into compliance without disrupting engineering velocity.
Engineering leads: You need your teams to stay on top of security training but don’t want hard blocks slowing down delivery.
Developers: You benefit from a timely nudge right before code is reviewed and merged.
Why are we doing it now
Commit blocking has been available since launch, but not every organization wants a hard stop on pull requests. Several customers told us they wanted a way to flag overdue training without blocking merges – especially during high-pressure release cycles. Warning mode gives security teams the compliance signal they need while keeping engineering workflows uninterrupted. You can toggle this per assignment group, so teams can run blocking for high-risk areas and warnings everywhere else.
Assignments added to REST API
Release date: March, 24th, 2026
The REST API now supports full management of content assignments through a new set of "exercises" endpoints. Customers can create assignment groups, assign content to individual accounts or teams in bulk, and track completion status - all programmatically, without using the UI.
What's new
- Exercises (assignment groups) -- create, list, view, update, and delete assignment groups via the API. The public-facing term "exercises" replaces the internal "assignment groups" concept.
- Account assignments -- assign content to individual accounts, with bulk support for up to 1,000 accounts per request. Bulk operations run asynchronously.
- Team assignments -- assign content to teams using the same bulk pattern, automatically assigning all team members.
- Completion and progress tracking -- retrieve assignment status across an entire exercise in a single request, or query individual accounts. See who has and hasn't completed their assigned training.
- Async task status -- bulk operations return a task ID that can be polled for progress. Task statuses: not started, in progress, finished.
- De-duplicated views -- when an account is assigned both directly and through a team, the API returns a single entry with "assigned through" details on the show endpoint.
Endpoint structure
| Method | Path | Description |
|---|---|---|
| GET/POST | /exercises | List and create exercises |
| GET/PATCH/DELETE | /exercises/:id | Manage an individual exercise |
| GET/POST | /exercises/:id/assignments/account-assignments | List and bulk-create account assignments |
| DELETE | /exercises/:id/assignments/account-assignments/:account_id | Unassign an account |
| GET/POST | /exercises/:id/assignments/team-assignments | List and bulk-create team assignments |
| GET | /exercises/:id/assignments/:id/content | Get assignment content |
| GET | /exercises/:id/bulk-tasks/:id | Check async task status |
How it works
Creating an exercise and assigning content:
- Create an exercise (synchronous) -- returns the exercise ID
- POST account or team assignments to the exercise (asynchronous) -- returns 202 Accepted with a Location header
- Poll the bulk task endpoint to check whether the operation has completed
- Bulk tasks process in batches of 25; a 409 Conflict is returned if a task is already running for that exercise
Tracking completion:
- GET the account assignments for an exercise to see all assigned accounts and their completion status
- Each entry includes whether the account was assigned directly or through a team (show endpoint only)
- Accounts assigned through multiple routes (direct + team) appear once, de-duplicated
Deleting an exercise:
- DELETE request marks the exercise as deleted (synchronous, returns 204)
- Background cleanup runs automatically
Who this is for
- Enterprise customers automating training workflows -- organisations managing large user bases who need to assign content based on external triggers (HR changes, compliance deadlines, security incidents) without manual UI work
- Integration partners -- teams building automated pipelines that connect scanning, assignment, and completion tracking end-to-end. Cisco's Command Centre team is already planning their integration around these endpoints.
- Administrators tracking compliance at scale -- the completion status endpoint replaces manual reporting for large training programmes
Technical details
- Bulk request limit: 1,000 accounts or teams per request (CloudFront WAF constraint). Clients can batch multiple requests.
- Author ID is required when creating exercises. A system-level account option is planned for Q2.
- All timestamps use RFC 3339 format.
- Notifications are not sent for API-created assignments -- the bulk task endpoint serves as the feedback mechanism.
- Pre-canned error messages only -- no raw exceptions are exposed in API responses.
Known limitations
- Exercises currently support the same content types as assignment groups in the UI. Workforce and crisis content support is planned for a future release.
- No bulk unassign - accounts and teams must be unassigned individually.
- The 1,000 per-request limit cannot be increased at this time.
New Content
OT Advanced Incident Response Collection
Release Date: March, 4th, 2026
We are excited to announce the release of two specialized collections designed to move your security operations beyond the basics into proactive defense:
- OT Threat Hunting (seven labs): You’ll learn how to proactively search for threats in industrial environments using OT-specific telemetry and specialized hunting methodologies.
- OT Incident Detection (six labs): This collection focuses on identifying security events and anomalies. You'll learn to distinguish between standard operational issues and actual security incidents by understanding "normal" behavior in industrial systems.
Who are we doing it for
This training is built for cybersecurity professionals and incident commanders who've mastered the fundamentals. It’s specifically designed for those ready to conduct security operations and protect critical infrastructure within industrial environments.
Why are we doing it now
Proactive security in OT is fundamentally different because you’re often working with sparse telemetry and fragile, 20-year-old programmable logic controllers (PLCs). You can't run aggressive scans in these environments. These labs teach you to:
- Understand operational baselines: You need to think in terms of process behavior rather than just network traffic.
- Identify meaningful deviations: You'll learn to think about the difference between a pump cycling due to a maintenance change and actual adversary manipulation.
- Balance security with safety: Incidents in OT involves stakeholders like plant managers and safety engineers. You'll learn to make high-stakes decisions where the wrong call could shut down a water treatment plant or a manufacturing line potentially costing thousands of dollars per minute.
Dynamic Threat Range: Orchid Emporium – Lazarus Group Supply Chain Attack
Release Date: March, 25th, 2026
We’re releasing a new Dynamic Threat Range (DTR) that simulates a sophisticated supply chain attack by a DPRK-aligned threat actor, Lazarus Group. This lab recreates a high-stakes scenario where a retail ecommerce company's development infrastructure is compromised. You'll navigate a complex attack chain that begins with a trojanized npm package and scales through CI/CD pipeline exploitation, ultimately leading to the destruction of cloud data. The release includes two distinct paths:
• Threat Hunting Exercise: You’ll start with Indicators of Compromise (IOCs) like suspicious DNS domains to trace the full attack chain using SIEM data.
• Incident Response Exercise: You'll work from triggered alerts, such as anomalous port scanning and AWS CLI usage, to perform process ancestry analysis and reconstruct the attack timeline.
Who are we doing it for
This lab is designed for security operations center (SOC) analysts, threat hunters, and incident responders who need to defend against advanced persistent threats (APTs). It’s particularly valuable for teams managing software development lifecycles that rely on package registries and automated pipelines.
Why are we doing it now
Supply chain compromises are becoming more frequent and damaging, often bypassing traditional perimeter defenses. By providing hands-on experience with specific Lazarus Group TTPs—such as LD_PRELOAD injection and malicious pull requests—we're helping your team build the muscle memory needed to detect and stop these attacks before they reach production. This lab covers 13 different MITRE ATT&CK techniques, ensuring your training is aligned with the current threat landscape.
New AI collection: AI Governance - The "Value-First" Framework
Release Date: March, 25th, 2026
We’re launching a specialized governance collection focused on the discovery and validation phase of the artificial intelligence (AI) lifecycle. This curriculum moves governance "upstream," ensuring your business defines the guardrails for success, risk appetite, and measurable impact for new AI development.
Key focus areas include:
Use case pressure testing: Moving beyond "cool ideas" to identify high-value, low-risk entry points.
Objective quantification: Defining success beyond accuracy scores by establishing North Star metrics, such as hours reclaimed per sprint.
The ROI calculator: Building a realistic cost-benefit model that accounts for hidden AI expenses versus projected gains.
Feasibility vs. desirability: Assessing if you should build a project based on data availability and ethical alignment with the National Institute of Standards and Technology (NIST) and International Organization for Standardization (ISO) frameworks.
Who are we doing it for
This content is designed for executives, project managers, and business leaders. These are the stakeholders who must justify AI spend to the C-suite. You're responsible for ensuring that AI deployment budgets translate into tangible corporate value rather than expensive "shelf-ware".
Why are we doing it now
In 2026, the honeymoon phase of AI experimentation is over. Organizations are facing "Proof of Concept (PoC) fatigue," where many agents are built but only 10% reach production due to a lack of clear return on investment (ROI). As compute costs and token usage scale, "vibe-based" development isn’t sustainable. We’re launching this now to provide a rigorous, repeatable understanding of the frameworks that filter out "noise" projects and fast-track high-impact, governable AI solutions.
New AI collection: Governance - Agentic Observability
Release Date: March, 25th, 2026
We are launching a specialized collection focused on agentic observability—the science of maintaining visibility into how artificial intelligence (AI) agents think, plan, and act. This curriculum moves beyond basic logging to provide managers and architects with the tools to "look under the hood" of autonomous loops. This ensures that when an agent makes a decision, you know exactly why it happened and what data influenced it.
Key focus areas include:
Traceability and lineage: Mapping the "reasoning chain" of an AI agent to see every step it took from the initial user prompt to the final action taken in a production system.
Anomaly detection in intent: Identifying when an agent’s behavior deviates from its intended role, such as a customer service agent suddenly attempting to access internal human resources (HR) databases.
Token and cost management: Monitoring the "metabolic rate" of your AI agents to prevent "recursive loops" where agents consume massive amounts of compute resources without producing a result.
Inter-agent communication monitoring: Overseeing "agent-to-agent" handoffs to ensure that instructions and security contexts aren't lost or corrupted as tasks move through a multi-agent ecosystem.
Who are we doing it for
This content is built for operations managers, AI product owners, and IT directors. It is specifically designed for leaders who are accountable for the performance and safety of autonomous workflows and need a "flight recorder" for their digital workforce to troubleshoot errors and justify AI return on investment (ROI).
Why are we doing it now
In 2026, the complexity of "agentic loops" has made traditional debugging obsolete. When an autonomous agent fails or behaves unexpectedly, it doesn't leave a standard error log; it leaves a trail of probabilistic decisions. We are launching this now because unobservable AI is unmanageable AI. Without a robust observability framework, your organization faces "silent failures" in which agents may provide incorrect data or execute unauthorized tasks for weeks before detection. Observability is the prerequisite for trust in any autonomous enterprise.
New AI collection: AI Data Protection
Release Date: March, 25th, 2026
We are launching a specialized strategic collection focused on data loss prevention (DLP) for artificial intelligence (AI). This curriculum moves beyond traditional file-scanning to address the unique ways sensitive information "leaks" through large language models (LLMs) and autonomous agents.
The collection focuses on securing the three primary leak points: the user prompt (input), the model training or fine-tuning process, and the generated response (output).
Key focus areas include:
Prompt filtering and PII redaction: Implementing real-time "cleaners" that intercept and scrub personally identifiable information (PII) or intellectual property (IP) before it ever reaches a third-party AI provider.
Context-aware data guardrails: Learning how to distinguish between "safe" data use and "hazardous" leakage, such as an employee asking an AI to “summarize this leaked board deck” versus “summarize this public press release.”
Shadow AI discovery: Identifying where employees are using unapproved, consumer-grade AI tools that lack enterprise privacy protections, creating "invisible" data exits.
Watermarking and output verification: Tracking AI-generated content to ensure that sensitive internal data hasn’t been "hallucinated" or inadvertently surfaced in public-facing AI responses.
Who are we doing it for
This content is built for mid-level managers, compliance officers, and privacy leads. It’s designed for those responsible for departmental data integrity who need to understand how to enable AI productivity without turning your corporate secrets into training data for the rest of the world.
Why are we doing it now
In 2026, "prompt leakage" has become the new "lost USB drive." As AI becomes the primary interface for work, sensitive data is being fed into models at an unprecedented scale. We are launching this now because traditional DLP tools – built to look for credit card numbers in emails – are often bypassed by the conversational, unstructured nature of AI interactions. Without AI-specific DLP, your organization risks losing its competitive advantage through "slow-motion" intellectual property theft, where proprietary code and strategy are leaked one prompt at a time.
Elasticsearch: AI for Defenders
Release Date: March, 25th, 2026
We're launching a three-lab collection that covers the end-to-end deployment and operational use of Elastic’s AI Assistant capabilities within Kibana. You’ll progress from the initial setup of Large Language Model (LLM) connectors, tools, and agents to a capstone exercise. This final lab allows you to demonstrate your competence in building and leveraging AI-powered security workflows in a practical environment.
Who are we doing it for
This collection is designed for Security Operations Center (SOC) managers, detection engineers, and security analysts. It’s built for teams that need to move beyond traditional Security Information and Event Management (SIEM) operations to master ReAct-style agent architecture. Whether you’re a team lead reviewing readiness or an engineer performing the configuration, these labs provide a structured path to expertise.
Why are we doing it now
As Elastic 8.x rolls out across enterprise deployments, security teams need to operationalize these features immediately to avoid poor or default configurations. We're solving the current lack of hands-on training for custom tool creation and prompt engineering. By providing this content now, we ensure you can reduce the trial-and-error cycle and achieve a faster time to value with your licensed Elastic features.
Licensing model: These labs use Live AI and so are only available in the Immersive Labs + AI License. They are not included in the Appsec License.