Platform Update
Microsoft Sentinel has Landed
Release date: April, 22nd, 2026
Microsoft Sentinel is LIVE: You can now select Microsoft Sentinel as your SIEM within DTR scenarios. This is a huge step for us as it's our first cloud-native SIEM integration and sets the stage for more cloud-based tech coming your way soon.
Know Your Way Around:
- Participants: We've overhauled the participant joining experience. Users now get a full network diagram and enhanced exercise details the moment they jump in, so they spend less time figuring out the "where" and more time on the "how."
- Facilitators: We've revamped the monitoring experience to let users see infrastructure and performance separately. Track range health and attack execution in real-time through the dedicated Range tab with an interactive network diagram and attack execution visualisation, then switch to the Teams tab to dive into participant submissions, metrics, and activity logs. Each view purpose-built for its task.
NIST NICE - Explore by Teams & Individual Filtering
Release date: April, 22nd, 2026
We are introducing a new "Explore by Teams" dashboard that evolves our NIST NICE reporting from aggregate views to granular insights. While the initial heatmap provided a high-level overview of organizational coverage, this update allows managers to:
- Filter by Work Roles and Teams: Select specific NIST NICE work roles and organizational units to see exactly where capability sits.
- Granular Contribution Mapping: View the specific percentage of NIST coverage contributed by individual teams.
- Individual Drill-Down: Identify the specific individuals within those teams whose completed activities are driving the coverage, providing a clear link between personal effort and organizational readiness.
Why are we doing it now
Following the release of the Heat Map, we are addressing the "visibility gap" between seeing a coverage percentage and knowing how to improve it. We are releasing this now to:
- Drive Accountability: Move from "checkbox compliance" to a model where managers can verify which teams are meeting their capability benchmarks.
- Enable Targeted Intervention: By seeing exactly which individuals or teams are not yet contributing to NIST NICE coverage, leadership can make data-driven decisions on where to allocate training resources or recruitment efforts.
- Maximize Value: Provide immediate ROI on the NIST NICE Heat Map by giving managers the "drill-down" capability they need to act on the data they are seeing.
Who are we doing it for
This release is specifically designed for Managers and L&D Leads who need to move beyond "big picture" data to operationalize talent management:
- For Managers: It solves the challenge of "hidden" performance by allowing them to see which teams, and which specific people, are the Subject Matter Experts (SMEs) in certain NIST NICE Work Roles.
- For L&D Leads: It provides the evidence needed to map training to specific job roles, ensuring that capability uplift is happening in the right departments.
2 New Improvements to Programs
Release date: April, 29th, 2026
-> Exclude Past Progress
Who are we doing it for
Managers deploying a Program can now choose whether to include a Participant's completion history in their Deployment (the default setting), and auto-skip any steps or content they've already done. By default, Past Progress is included (which reflects the preferences expressed in Assignments since we introduced the same toggle a few quarters back) but can be excluded on a per-Deployment basis.
Why are we doing it now
This means Managers can choose whether to require re-completion of content, or only require completion of content that's new to a Participant, giving more flexibility in how Programs are deployed.
-> Open Enrolment
Who are we doing it for
Managers can now choose to make a Program Deployment available for Open Enrolment. Open Enrolment Programs can be opted-in-to by Participants, can be linked to from off-platform, and have a dedicated home on the platform.
Why are we doing it now
Programs can now support a middle-ground between entirely optional (and hard to track) self-directed activity, and required, assigned activity. Use cases include initiatives like "Vulnerability of the month", job-family-specific Programs and any other entry route where the participant will recognise something of interest. Participants' attention is drawn to Open Enrolment Programs (where they've been created) with a new "Recommended by <organisation>" entry on the launchpad.
New Content
IBM QRadar: Mastering SIEM Operations
Release date: April, 1st, 2026
We're launching a new collection of five labs designed to transform how you interact with IBM QRadar. This collection moves you from foundational theory to practical engineering, focusing on the "plumbing" of the Security Information and Event Management (SIEM) tool. You'll gain hands-on experience configuring Device Support Modules (DSMs), normalizing raw data, and querying logs with precision. The training path culminates in a cloud-based AWS threat investigation and a final capstone lab to test your skills under pressure.
Who are we doing it for
This collection is built for security analysts and engineers who want to move beyond passive dashboard monitoring. Whether you’re managing legacy on-premises servers or modern cloud environments, these labs are for you if you need the technical confidence to parse, query, and hunt down threats effectively.
Why are we doing it now
A SIEM is only as effective as the data it ingests and the person operating it. Many security teams rely too heavily on surface-level alerts and default settings, which can leave them "flying blind" if data isn't properly normalized. We're releasing this now to address the "garbage in, garbage out" flaw in SIEM operations. By mastering Log Sources and DSMs, you ensure your organization has visibility into the right data. As infrastructure shifts toward the cloud, we've integrated Amazon Web Services (AWS) scenarios to ensure your threat hunting skills remain up-to-date in any environment.
Note: Collection available subject to specific requirements - please speak to your customer success manager for more information.
Business Continuity Collections
Release date: April, 1st, 2026
We are establishing a comprehensive five-part workstream designed to operationalize Business Continuity Management (BCM) beyond simple paper-based compliance. This initiative translates technical disaster recovery and operational resilience into a structured management framework, ensuring the organization can absorb shocks and maintain critical functions during a crisis. Today, two out of the five collections were released:
Business Continuity: Exercising, Testing, and Assurance
The first collection provides a roadmap for validating Business Continuity Management (BCM) strategies. Users will explore various types of tests and exercises, learn to design effective, high-fidelity scenarios, and running both table-top and live technical exercises. The collection also focuses on the critical "after-action" phase—measuring success, capturing lessons identified, and ultimately embedding a culture of continuous exercising into organizational DNA.
Business Continuity Plan Development
The second collection features seven labs that covers foundational concepts and integration strategies. Users will explore the core components of a BCP, learn to design role-based and tiered plans, and utilize templates and playbooks to ensure usability under pressure. Additionally, the labs cover maintenance activities to ensure your strategies remain effective as the organization evolves.
Who are we doing it for
These collections are built for security leaders, risk managers, and operational leads who are responsible for maintaining essential functions during a crisis. It is also relevant for disaster recovery (DR) teams and business unit heads who need to understand their specific roles within a larger organizational resilience framework.
Why are we doing it now
In 2026, the definition of a "disaster" has expanded. It is no longer just fires and floods; it is systemic cloud outages, AI-driven ransomware, and global supply chain collapses. We are launching this now because a plan that hasn't been exercised is merely "shelfware." Organizations are increasingly being held to high resilience standards by ISO 22301 and the DORA (Digital Operational Resilience Act). This workstream ensures your leadership isn't trying to build a plan while the building is already on fire, but is instead executing a pre-validated strategy for survival.
New Secure AI Collections
Release date: April, 8th, 2026
What are we doing
We are releasing a comprehensive set of labs across two distinct areas: Model Evaluation and AI Agent Governance. These collections are designed to provide both the quantitative frameworks needed to justify model selection and the technical controls required to govern autonomous agents.
These labs help teams transition from experimental "chat" interfaces to production-ready "agentic" workflows where security and accuracy are non-negotiable.
Model Evaluation
This collection moves beyond simple performance metrics to provide a rigorous framework for assessing whether a model is fit for purpose.
- Benchmark Analysis: Building "Custom Evaluation Sets" tailored to specific corporate data.
- Detecting Model Drift: Monitoring performance over time to prevent "stale" or inaccurate outputs.
- Ground Truths: Establishing gold-standard datasets for LLM Judges to ensure objective analysis.
- Agent Efficiency: Measuring how correctly and efficiently an agent utilizes its available tools.
- Adversarial Evaluation: Integrating Red Teaming to identify biased or harmful content blind spots.
This collection focuses on extending the Principle of Least Privilege (PoLP) to the world of autonomous AI agents.
- Agent Identity Management: Treating AI as "non-human identities" with unique cryptographic credentials.
- The "Blast Radius" of Autonomy: Analyzing how over-privileged agents can escalate a simple prompt injection into a data catastrophe.
- Scoped Tool Access: Implementing functional restrictions to ensure an agent cannot exceed its intended purpose.
- Human-in-the-Loop (HITL) Triggers: Designing threshold-based approvals for high-privilege or "write" actions.
- Technical Leads: To provide the quantitative data needed to justify model selection for business-critical tasks.
- Product Owners & Mid-Level Managers: To define the security boundaries for the "digital coworkers" they deploy.
- Operations Leaders: To manage the integration of agents into ERP, CRM, and financial systems.
- Security Engineers: To mitigate the risks of cascading permissions and autonomous internal threats.
In 2026, the industry has shifted from "Generative AI" to "Agentic AI." With the marketplace flooded with thousands of models, "model fatigue" has become a genuine business risk. Selecting the wrong model for a regulated task—such as medical summarization or credit scoring—can lead to massive legal liabilities and operational failure.
Furthermore, as agents gain the ability to execute code and access databases, traditional RBAC is no longer enough. Without strict identity management and "emergency brake" triggers, a single compromised prompt can turn a productivity tool into an automated insider threat. We are empowering teams to stop "flying blind" and start securing the intelligent infrastructure of the future.
Advance OT Collection: ICS/SCADA Defensive and Offensive Strategies
Release date: April, 8th, 2026
This expansion dives into the high-stakes world of utilities and wide-area monitoring. You'll focus on the IEC-104 protocol and the deployment of sophisticated OT honeypots that mimic Programmable Logic Controllers (PLCs). It's a “Purple Team” approach that gives you the skills to both penetrate and protect critical infrastructure.
Who are we doing it for
This program is built for mid-to-senior level cybersecurity practitioners and Operational Technology (OT) engineers who manage or defend critical national infrastructure, including:
- Electrical grid operators and substation technicians.
- Water treatment and distribution security specialists.
- Oil and gas pipeline cybersecurity teams.
- Advanced penetration testers seeking to specialize in utility-grade protocols.
Why are we doing it now
The threat landscape for utilities has shifted. Attackers are no longer just targeting factory floors; they are targeting the geographically distributed assets that power cities.
- The Knowledge Gap: Traditional Modbus security knowledge does not translate to DNP3 environments.
- Architecture Differences: Utilities rely on master-outstation relationships across wide areas, introducing unique attack vectors like DNP3 replay attacks that our current portfolio does not cover.
Proactive Defense: Passive monitoring is no longer enough. There is an immediate market demand for "active" defense mechanisms, such as industrial honeypots, to detect reconnaissance before an impact occurs.
Note: Only holders of an OT licence are eligible to access this collection - please speak to your customer success manager for more information.
4 New Cyber Range Exercises
Release date: April, 8th, 2026
Today, we're excited to release four new Cyber Range Exercises (CREs). While we continue to invest heavily in our Dynamic Threat Range (DTR) technology, we recognize that many of your teams still rely on the specialized capabilities and structured format of our established CRE content.
Petal Fall - A Chrysalis Shattered
Starts the user from an initial compromise of notepad++ downloaded and installed from a website masquerading as legitimate.
The attack path emulates a campaign attributed to the Chinese APT group Lotus Blossom.
Difficulty: Intermediate
Mint Sandstorm: Sifting Through the Phosphorus Campaign
Starts the user from a suspicious email with IOCs outlined by a shared advisory.
Attack path shares TTPs from Mint Sandstorm, formerly tracked by Microsoft as PHOSPHORUS.
Difficulty: Intermediate
SharePoint Under Siege: Investigating a zero day compromise
Starts the user from potential webshell activity on the SharePoint server.
Exploits the Sharepoint deserialization vulnerability CVE-2025-53770.
Difficulty: Intermediate.
Project Blackstart: Dissecting the Relay Suppression
Starts the user from a malicious MS Teams binary downloaded.
Follows the intrusion from Enterprise IT systems into the OT systems.
An OT range based on a generator compromise.
Difficulty: Intermediate
Who are we doing it for
Whether you're an incident responder or a threat hunter, these labs offer intermediate-level challenges to sharpen your skills in detecting and neutralizing sophisticated threats.
AI Red Teaming Foundations
Release date: April, 15th, 2026
We are establishing the foundational mindset and vocabulary for AI Red Teaming. This lab introduces learners to the unique challenges of attacking AI-integrated systems, contrasting traditional security testing with adversarial machine learning and setting the stage for the MITRE ATLAS framework. This release will be a single lab.
Why are we doing it now
You cannot exploit what you do not understand. As enterprises rush to deploy AI, security teams need an immediate entry point to understand the "new rules" of engagement before moving into technical exploitation.
Who are we doing it for
Traditional Red Teamers and Security Researchers who are experts in network/web security but need to translate those skills into the AI domain.
AI Red Teaming Reconnaissance
Release date: April, 22nd, 2026
We are teaching the first technical phase of an AI engagement: mapping the attack surface. In the Reconnaissance phase, the adversary is trying to gather information about the AI system they can use to plan future operations.
From the ATLAS framework:
Reconnaissance consists of techniques that involve adversaries actively or passively gathering information that can be used to support targeting. Such information may include details of the victim organizations' AI capabilities and research efforts. This information can be leveraged by the adversary to aid in other phases of the adversary lifecycle, such as using gathered information to obtain relevant AI artifacts, targeting AI capabilities used by the victim, tailoring attacks to the particular models used by the victim, or to drive and lead further Reconnaissance efforts.
This collection covers 4 techniques from the Reconnaissance tactic:
This will be a release of 3 labs that you can find here.
Why are we doing it now
Reconnaissance is about intelligence gathering. By identifying the specific AI capabilities and research efforts of a target, a Red Teamer can plan more sophisticated attacks. Mapping the surface now ensures no "low-hanging fruit" is missed before moving into exploitation.
Who are we doing it for
- Red Teamers pivoting into AI security.
- Adversarial Researchers needing to identify AI footprints in a target environment.
- Penetration Testers moving from traditional discovery to AI-specific reconnaissance.
OT Threat Analysis and Recovery
Release date: April, 22nd, 2026
Immersive is expanding its Operational Technology (OT) catalogue with two new collections and a standalone lab:
- Sandworm Team Industroyer Campaign (OT APT Investigation)
- OT System Recovery
- OT Industroyer Reverse Analysis (standalone lab)
What's in it
The OT APT Investigation collection uses Sandworm's tradecraft as the backbone for a realistic investigation. Practitioners follow the full campaign lifecycle, from initial access through IT-side persistence and lateral movement into OT, culminating in the deployment of Industroyer2 against energy infrastructure. At each phase, they reconstruct timelines, identify TTPs, and analyze the indicators that distinguish deliberate OT targeting from routine IT compromise.
The OT Industroyer Reverse Analysis lab complements the collection by focusing on reverse-engineering the original Industroyer malware from the 2016 Ukraine attack. Practitioners pull apart the binary to understand how it interacts with industrial protocols and what it was designed to accomplish in physical terms. Together with the collection's coverage of Industroyer2, this gives users visibility into how Sandworm's tooling evolved between campaigns.
The OT System Recovery collection covers what happens after the incident. Recovering OT systems isn't the same as reimaging a laptop. Practitioners work through blast radius assessment, safe isolation procedures, firmware validation, PLC logic verification, and post-incident review, all grounded in the safety-first mindset that makes OT recovery a distinct discipline.
Who are we doing it for
This content is built for mid-to-senior level cybersecurity practitioners who investigate, respond to, or recover from incidents in industrial environments, including:
SOC analysts and incident responders working in or alongside OT environments
- Threat intelligence analysts covering critical infrastructure threats
- OT security engineers responsible for recovery and restoration
- ICS/SCADA security specialists building defensive and investigative capability
State-sponsored campaigns against critical infrastructure aren't slowing down, and Sandworm remains one of the most active and capable threat actors in this space. Defenders need to understand how these campaigns unfold, how OT-specific malware works, and how to recover safely when physical consequences are on the line. This release connects those three disciplines into a coherent learning path that moves from investigation through to recovery.
Which customers is this available to?
- Core
- Advanced
- Existing OT license holders
New GRC Lab Collections: Navigating the AI Frontier
Release date: April, 22nd, 2026
MITRE ATLAS
This collection explains the "Adversarial Threat Landscape for Artificial-Intelligence Systems" (ATLAS). It provides a comprehensive view of how attackers actually "break" models, moving beyond theory into the practical understanding of AI-specific attack vectors.
- Who is it for? Security awareness teams and managers overseeing AI-driven products.
- Why now? As enterprises deploy LLMs at scale, teams must understand the real-world threats to these systems to build effective defenses.
What is this about? A deep dive into NIST’s flexible framework for managing the unique risks associated with generative and predictive AI. This collection focuses on a non-regulatory, "best-practice" approach to handling AI-specific challenges like bias, hallucinations, and prompt injection.
- Who is it for? Risk managers and business leaders seeking a practical roadmap for AI safety.
- Why now? AI risks require a fundamentally different management style than traditional software; the NIST RMF provides the necessary structure.
What is this about? An introduction to the world’s first certifiable AI management system standard. This collection focuses on how to govern AI ethically and securely, establishing a baseline for responsible AI use within an organization.
- Who is it for? AI project leads, compliance officers, and department heads.
- Why now? In 2026, ISO 42001 has become the global benchmark. Organizations need to understand these requirements now to lead in responsible AI adoption.
Cyber Crisis Management Collection
Release date: April, 29th, 2026
We are developing a collection on OT (Operational Technology) Cybersecurity Crisis Management for Executives. This collection is designed to move beyond technical response and focus on the organizational leadership required during an industrial cyber incident.
OT Crisis Management for Executives: Training on incident command structures, IT/OT/Operations integration, and navigating regulatory and strategic landscapes.
Who are we doing it for
This experience is tailored specifically for managers, executives, and senior leadership within organizations that rely on industrial operations.
It targets those who must bridge the gap between technical security teams and the rest of the business, including:
Cybersecurity Managers needing to refine team dynamics and detection-to-decision workflows.
Executive Leadership who must make high-stakes "go/no-go" decisions regarding plant shutdowns and safety.
Cross-functional Leads from operations, maintenance, and safety engineering who must coordinate during a crisis.
Why are we doing it now
The complexity of OT environments means that traditional IT disaster recovery strategies are often insufficient. We are implementing this training now to address several critical gaps:
Unique Stakeholder Dynamics: Unlike IT-only incidents, OT crises involve plant operators and safety engineers. Coordination must be practiced before a real-world event occurs to prevent communication breakdowns.
High-Stakes Decision Making: Executives currently face pressure to balance security with production and safety without always having the necessary technical context. This training provides that context in a safe environment.
Operational Limitations: Because you cannot simply "failover" a physical plant to a backup data center, organizations need to mature their manual operation procedures and recovery prioritization immediately.
Risk Mitigation: Simulations reveal existing bottlenecks in decision-making and legal/regulatory exposure, allowing the organization to refine procedures before they are tested by a real threat.
- Core
- Advanced
- Ultimate
- Existing OT license holders
AI Model Access Collection
Release date: April, 29th, 2026
MITRE ATLAS Techniques Covered:
- AML.T0014: Discover AI Model Family
- AML.T0069: Discover LLM System Information
- AML.T0084: Discover AI Agent Configuration
- AML.T0040: AI Model Inference API Access