New Content

AI Adaptive Assessment

Release date: June, 3rd, 2026

AI adoption is moving fast, and organizations need an immediate, scalable way to evaluate their team's readiness. Today, we are dropping a brand-new, standalone Adaptive Assessment covering AI literacy, security, and some best practices. Rather than aligning with a single specific learning path, this serves as a benchmark to establish a clear organizational capability baseline.

Learners should take the assessment to establish an initial baseline, dive into our various AI labs, and then retake the assessment to see a definitive, verifiable improvement in their score.

You can find the assessment in the Artificial Intelligence category.

New GRC Lab Releases: Payments, Healthcare, and Identity Compliance

Release date: June, 3rd, 2026

Today we’re dropping the next wave of our GRC catalogue refresh:

PCI DSS

What's new: A high-level, practical overview of the Payment Card Industry Data Security Standard (v4.0.1), focusing on what it actually takes to secure the global payment ecosystem.
Target Audience: Merchant staff, business owners, and non-technical managers who handle payment data day-to-day.
Why: With PCI DSS 4.0 enforcement fully live, organizations must shift their mindset from "point-in-time" audits to continuous, active security.

Healthcare Compliance

What's new: A foundational crash course on protecting patient data, covering the vital mechanics of HIPAA and how it applies specifically to health records.
Target Audience: Healthcare administrators, medical staff, and health-tech entrepreneurs.
Why: Healthcare is still the number one target for ransomware. Knowing these "rules of the road" is now a strict requirement for clinical safety, not just legal compliance.

ISO 22381 - Security and Resilience for Identification Systems

What's new: Modernized guidance zeroing in on interoperability, security measures, and anti-counterfeiting strategies for both physical and digital ID systems.
Target Audience: Government and industry stakeholders building the future of identity management.
Why: Essential for safeguarding the integrity and authenticity of global goods and systems in 2026.

Business Continuity Collection

Release date: June, 10th, 2026

We are releasing a new collection titled Business Continuity Strategy, which focuses on the practical application of business continuity tactics. This collection features 7 labs that guide you through implementing alternate sites and remote working, developing manual workarounds for degraded modes, and establishing robust cross-training and staffing strategies. You will also gain hands-on experience in building technology and data resilience, managing supplier and third-party continuity, and layering these strategies to achieve true organizational resilience.

Who are we doing it for?

This collection is designed for business continuity managers, operations leads, and IT disaster recovery (DR) specialists. It is also essential for supply chain managers and HR professionals who are responsible for ensuring personnel and third-party dependencies remain functional during a crisis.

Why are we doing it now?

Relying on a single recovery strategy is no longer sufficient in today’s complex threat landscape. We are providing this content now to give you the technical exercising capabilities to move beyond simple backups and develop a multi-layered defense. By mastering these resilience strategies today, you can ensure your organization maintains 100% operational capability, even when primary systems and vendors fail.

New CTI Collection - Hunting the Tools: Cobalt Strike

Release date: June, 10th, 2026

A new Cyber Threat Intelligence collection is now available in our portfolio: Hunting the Tools: Cobalt Strike

Cobalt Strike is the C2 framework most likely to show up in your incident response engagements. This collection equips blue teamers with the practical skills to identify, decode, and investigate Cobalt Strike activity across three analytical domains. Through these labs, users will learn how to:

Extract beacon intelligence: Pull configurations from static samples and memory dumps, and query thousands of real-world parsed beacons at scale.
Decode C2 traffic: Identify beacon sessions in PCAP, recover session keys from process memory, and decrypt operator commands and output.
Hunt in endpoint logs: Recognize sacrificial processes, PowerShell indicators, named pipes, and injection artifacts in Sysmon and Windows event logs.
Build attacker timelines: Reconstruct full kill chains by cross-referencing network and host evidence.

Who are we doing it for?

This collection is designed for junior to mid-level SOC analysts and threat hunters. These labs give defenders the practical skills to identify Cobalt Strike activity across beacons, network traffic, and endpoint telemetry — whether they have one data source or all three.

Why are we doing it now?

Cobalt Strike continues to dominate real-world incident data. It's used by APT groups, ransomware operators, and red teams alike. Despite being well-documented, many analysts have never had hands-on experience pulling apart a beacon, decrypting C2 traffic, or tracing its artifacts in logs. We're releasing this collection to close that gap with practical, tool-driven labs rather than theory.

New Crisis Simulation Scenario - Project Mythos

Release date: June, 10th, 2026

Hot on the tail of the Public Mythos / Fable update from Anthropic today, we're releasing a new crisis simulation to the catalogue Project Mythos – UK & Project Mythos – US.

The two variants follow the same story line however the Legal frameworks are adjusted to make them region specific.

Narrative
Mythos, a next-generation AI vulnerability scanner, has just gone on general release — and Orchid Bank, a tier-1 G-SIB processing over $6 trillion daily through its London payments engine, ran its first approved production scan over the weekend. Now the Security Engineering Lead is outside your office, and he says it's urgent.
Participants take on the role of the senior technology leadership team and must navigate a rapidly escalating incident while juggling a brutal set of competing priorities. Through the simulation, participants will exercise:

Incident triage under ambiguity: Making early decisions when it's unclear whether an AI tool found a problem — or caused one
Risk trade-offs: Balancing security response against regulatory deadlines, M&A timelines, and reputational exposure
Stakeholder management: Handling regulators, activist investors, the board, and the media as pressure mounts
AI governance in practice: Confronting the real-world consequences of adopting next-generation AI security tooling in a production environment

Who are we doing it for?

This simulation is designed for senior technology and security leadership teams — CISOs, CTOs, heads of engineering, and risk owners. It's equally valuable for aspiring leaders who want to experience the pressure of executive crisis decision-making in a safe environment.

Why are we doing it now?

AI-powered security tooling is being adopted faster than governance frameworks can keep up. Organisations are pointing increasingly autonomous tools at production systems, often without fully understanding the failure modes. This simulation puts leaders in the room when that gamble goes wrong — forcing the conversations about AI risk, operational resilience, and crisis communication that are better had in an exercise than in a real incident.

New Crisis Simulation Scenario - Shadow AI

Release date: June, 17th, 2026

As more organizations are embedding AI within their workflows, the threat landscape has changed. Business risk has pivoted from the threat caused by Shadow IT to a new and potentially more concerning threat of Shadow AI. Where Shadow IT often sits outside of core data processing flows, Shadow AI is often embedded within them, meaning the threats to customer data and commercial IP is a key concern to organizations. We have moved on from insider threat only being a malicious action to a place where unintentional actions by individuals using Shadow AI is a key business threat.

To help understand the threats related to Shadow AI today we're releasing a new crisis simulation to the catalogue Shadow AI.

The scenario takes place at Orchid Corp, which provides point-of-sale and e-commerce solutions to small businesses worldwide. The company has recently invested in AI capabilities, but has not yet established a formal AI acceptable use policy.

A routine alert in the SOC queue triggers an investigation that reveals something unexpected about AI tool adoption across the business. With limited resources and competing priorities, leadership must decide how to allocate its team – and those decisions will have consequences that compound as the day unfolds.

Through the simulation, participants will exercise:

Incident triage under ambiguity: with limited information, users will need to decide how to prioritize and allocate resources
Risk trade-offs: how do you manage potential threats versus actual regulatory risk
Stakeholder management: Users will need to manage the demands of both internal and external stakeholders, including customers, regulators, and the CEO.
AI governance in practice: Users will see how AI acceptable-use policies are crucial for managing the risks that come with adopting the innovative technology.

Who are we doing it for?

This simulation is designed for senior technology and security leadership teams — CISOs, CTOs, heads of engineering, and risk owners.

Why are we doing it now?

Shadow AI is a key concern for all organizations, AI Governance, including understanding where you have AI and managing it appropriately is a key business responsibility. This sim is to help practitioners understand the threats they face when Shadow AI begins to appear.

New Lab Collection: AI Blue Teaming : Initial Access

Release date: June, 17th, 2026

Building on our AI Blue Teaming: Reconnaissance collection, we are launching the second technical defensive collection in the series. This release mirrors our AI Red Teaming: Initial Access work, shifting the lens to the defender's side of the kill chain.

Reconnaissance is over. The adversary has mapped your AI infrastructure and now they're coming in. This collection is about making sure they don't get through the door, and that if they do, you know exactly when and how it happened.

What is this release?
This collection of 3 new labs walks defenders through detecting and investigating simulated initial access attempts against AI-powered applications. The attack scenario covers several of of MITRE ATLAS Initial Access techniques: supply chain compromise, credential abuse, prompt injection, and more. From theory to guided investigation to a full unguided campaign reconstruction, this collection builds the muscle memory your team needs before the incident happens.

Why are we doing it now?
With AI embedded in business-critical workflows, initial access into AI systems is a live threat. We are shipping this collection now to help organizations to catch it early, train on real techniques, and build a team that speaks the same language. This is because supply chain compromise, credential abuse, and prompt injection are threats to organisations with AI enabled applications, and initial access is the point where you can still stop them.

Who is this content for?
This collection is built for defenders who need to go beyond perimeter security and get hands-on with AI-specific threat detection:

SOC Analysts & Incident Responders investigating multi-phase initial access campaigns across application, authentication, and LLM log sources in Elastic SIEM.
Application Security (AppSec) Engineers understanding how supply chain and prompt injection vectors create exploitable footholds in AI-powered applications.
Purple Team Analysts validating detection coverage across the MITRE ATLAS Initial Access tactic and its six mapped techniques.

New Crisis Simulation Scenario - Shai–Hulud Supply Chain Attack

Release date: June, 19th, 2026

We are releasing a new Cyber Threat Intelligence Crisis Simulation: Shai–Hulud Supply Chain Attack. This interactive simulation drops your leadership team into a realistic, high-stakes scenario featuring Meridian Digital, a mid-sized Software as a Service (SaaS) company. During the exercise, participants discover that widely used open-source npm packages have been compromised by the threat group TeamPCP.

The compromise involves a self-propagating worm that steals Continuous Integration/Continuous Delivery (CI/CD) credentials, cloud Application Programming Interface (API) keys, and GitHub tokens. It can even weaponize your own packages to infect downstream supply chains.

This simulation uses branching logic across exactly five decision points. Your choices dynamically alter the narrative: strong decisions lead to a controlled situation, while poor choices increase the difficulty. The exercise gives your team hands-on experience with:

Incident triage under ambiguity
Risk trade-offs
Stakeholder management
Artificial Intelligence (AI) governance in practice

For practitioners who want to dive deeper into the technical mechanics of this campaign, we also have an existing CTI lab focused on the attack here.

Who are we doing it for

This simulation is designed for senior technology and security leadership teams. This includes Chief Information Security Officers (CISOs), Chief Technology Officers (CTOs), heads of engineering, risk owners, and the broader organization.

Why are we doing it now

Supply chain attacks continue to be one of the top concerns that organizations face. This specific campaign has been highly active over the past 12 months, targeting the npm ecosystem and compromising automated pipelines across many high-profile organizations. Because this worm spreads automatically without user activity, understanding its downstream impact is critical for modern risk management.

New Crisis Simulation Scenario - Everyone's a Builder

Release date: June, 23rd, 2026

In this high-stakes scenario Everyone's a Builder you will navigate a security incident at Orchid Corp, a 1,000-person Software as a Service (SaaS) company. The timeline begins at 14:00 when a secret-scanning alert fires. A junior engineer has pushed an experimental, Artificial Intelligence (AI)-built Customer Relationship Management (CRM) agent to a public repository – with a live corporate Application Programming Interface (API) key inside it. As the on-call incident response team, your job is to contain the bleed in the right order. You must follow the trail to find out how far the exposure reaches and know the exact moment this stops being your call to make alone.

Who are we doing it for

This crisis sim is designed for incident response teams, security analysts, and security leaders. It’s built for organizations that encourage employees to innovate, solve problems, and build tools independently. If your company leverages modern AI tools, this simulation will help your team manage the expanded attack surface.

Why are we doing it now

Many modern organizations have embraced AI and encourage everyone to solve problems and innovate. While this drives productivity, it drastically increases your corporate attack surface and introduces severe security risks. The clock often starts hours before an alert pages your team. Immersive is releasing this sim now so you can practice containing fast-moving cloud leaks, tracing credential exposure, and making critical escalation decisions before a real breach occurs.

New GRC Lab Releases: FedRAMP Foundations

Release date: June, 23rd, 2026

Immersive is releasing a new collection of labs focused on the Federal Risk and Authorization Management Program (FedRAMP). This collection provides a clear, actionable breakdown of the standardized approach to security assessment and authorization required for cloud products used by the US Federal Government. You can access these new labs under the Fundamentals category within the Management, Risk, and Compliance collection on the platform.

Who are we doing it for

This content is tailored for cloud service providers (CSPs) aiming to successfully position their cloud products for government procurement. If you are responsible for navigating federal compliance workflows or shaping security strategy, these labs provide the essential roadmap your team needs.

Why are we doing it now

Recent FedRAMP Revitalization mandates have fundamentally changed how CSPs achieve and maintain their authorization. If you’re selling cloud services to the federal government in 2026, the old playbook no longer applies. Immersive is launching these labs now to ensure you have the practical knowledge to adapt to these regulatory updates immediately.

New Lab Collection: AI Knowledge Pass

Release date: June 24th, 2026

This is the first collection as part of our AI Knowledge Pass Goal — a DigComp 3.0-aligned AI literacy programme targeting the non-technical workforce. Using the AI Knowledge Pass Goal will be the way to prove their baseline AI literacy and unlock AI usage within their own organization.

What is this release
This collection of 8 labs takes learners from zero AI knowledge to confident, safe AI usage through hands-on chatbot interaction and structured theory content. Starting with what AI actually is, learners progress through understanding the tool landscape, writing effective prompts, spotting hallucinations, data safety legal obligations, recognising AI bias, and finally demonstrating their knowledge in a capstone assessment.

Why are we doing it now
Article 4 of the EU AI Act requires organisations to ensure AI literacy across their workforce — the deadline is approaching and most organisations haven't started. AI tools are already embedded in everyday work (Copilot, Gemini, ChatGPT) but most employees have had no structured training on how to use them safely. This collection gives organisations a practical, measurable way to meet their compliance obligation while genuinely upskilling their people.

Who is this content for
This collection is built for the general non-technical workforce that will be using the AI Knowledge Pass Goal as a way to prove their baseline AI literacy and unlock AI usage within their own organization.

Link to the Collection can be found here.

New Lab Collection: AI Red Teaming

Release date: June 24th, 2026

An AI agent is only as contained as the identity behind it. This collection of 3 new labs goes beyond attacks on a single assistant and shows how an attacker can turn one compromised agent into movement across systems, escalating access well beyond the agent's intended role.

MITRE ATLAS™ Techniques Covered:
AI Agent Tool Invocation (AML.T0053): Driving an AI agent to invoke the tools it is connected to, reaching data sources, applications, and actions the attacker could not access directly.
Use Alternate Authentication Material (AML.T0091): Using credential material recovered from a compromised system to authenticate as another identity and move laterally through an environment.

Who is this content for
Red Teamers focused on lateral movement and privilege escalation in AI-driven environments.

The labs can be found in both the Artificial Intelligence & the Offensive Security categories. Direct link to the collection can be found here.

New Crisis Simulation Scenario

Release date: June 25th, 2026

We are releasing a new crisis simulation Phantom Minutes focusing on artificial intelligence (AI) adoption. In this scenario, Cardinal Financial Group is responding to a data exposure incident at a document vendor, and it's now day three of the crisis.

Your teams meet on bridge calls throughout the day, and an AI assistant writes the minutes everyone works from. This afternoon, you're due to brief the board. As you build the update from the official record, you notice something in it doesn't match what you remember deciding. At first sight, it looks like the AI has hallucinated, and it's now being treated as truth!

You lead incident management, and the whole response has rested on that record. Now you have to find out whether you can trust it.

Who are we doing it for

This crisis simulation is for incident response teams, cybersecurity leaders, and organizational executives. It helps you evaluate how your team manages and utilizes automated tools during high-pressure situations.

Why are we doing it now

Businesses are keen to drive AI adoption to speed up and improve everyday processes. However, these implementations should be well-planned and carefully considered before being put into place.

We're releasing this scenario now to highlight the potential consequences of rushing into adopting AI tools. It demonstrates the critical value of verification, helping your organization balance rapid innovation with safe, trusted operations.

New CTI Lab

Release date: June 25th, 2026

We're releasing a new Cyber Threat Intelligence (CTI) lab titled “CVE-2026-25939 (FUXA Auth Bypass)”.

FUXA is an open-source, web-based supervisory control and data acquisition (SCADA) and human-machine interface (HMI) platform. It allows users to build dashboards and connect devices using industrial protocols like Modbus, OPC-UA, MQTT, and Siemens S7.
An authorization-bypass vulnerability has been reported that allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS environments to unintended or malicious action.

In the lab, users will explore this vulnerability and demonstrate how it can be exploited to perform unintended actions. They'll also learn how to detect and mitigate it in their environments.

Who are we doing it for
This lab is designed for security analysts, incident responders, and operational technology (OT) security professionals who safeguard industrial control systems (ICS).

It's also highly valuable for any cybersecurity practitioner who wants to understand how vulnerabilities in web-based management interfaces can directly impact physical infrastructure.

Why are we doing it now
Because FUXA is typically deployed in OT environments, its software connects directly to physical machinery. A compromised system poses immediate safety risks. An attacker manipulating schedules could alter valves, pumps, or chemical levels. This can cause severe hardware damage, pollute the local environment, and threaten plant personnel.

We're delivering this lab now to provide teams with the skills needed to detect, analyze, and mitigate this critical flaw before malicious actors can exploit it in production environments.

New Lab Release: Microsoft Entra ID

Release date: June, 29th, 2026

In 2026, identity has completely replaced the network firewall as the primary security boundary. Misconfigured cloud directories remain a premier entry point for corporate breaches, making active identity governance a core pillar of operational survival. This collection covers the fundamentals of Microsoft Entra ID.

Microsoft Entra ID
What's new: Microsoft Entra ID is how modern organizations manage cloud identity, from the tenants that house user directories to the policies that decide whether a sign-in should be trusted. This collection covers the platform across three labs: tenant structure and Zero Trust foundations, application identity and access governance, and the Conditional Access and ID Protection tools that detect and respond to compromised accounts.

All of these labs have been deployed to the Microsoft Azure subcategory, under Cloud Security, on the platform.

Customer Availability

This lab is live now and available to all customers across all tiers.

New Lab Release: Project Glasswing: Introduction to Mythos

Release date: June, 30th, 2026

Project Glasswing: Introduction to Mythos is a conceptual theory lab dedicated to understanding Anthropic's Claude Mythos model. Through a series of multiple-choice questions, learners will explore the fundamentals of the model, and the dual-use problem that Mythos introduces: what makes such a model powerful, why its power cuts both ways, and the safeguards built around it.

Who are we doing it for

Anyone. This lab serves as an introduction to the model, but doesn't require any knowledge of AI technologies.

Why are we doing it now

We're seeing a lot of demand for content around the Mythos model. Because we recently released a crisis simulation covering how an organization might react to a Mythos-style scenario, these two resources can serve as an excellent introduction to a "Mythos Readiness" program. Teams can easily expand on this foundation by adding other relevant modules, such as our Vulnerability Management collection. We recommend using the AI Program Builder to experiment with creating these types of programs!

Customer Availability

This lab is live now and available to all customers across all tiers.

New DTR Scenario: Cl0p Ransomware Intrusion

Release date: June, 30th, 2026

A brand-new Dynamic Threat Range (DTR) scenario simulating a sophisticated Cl0p ransomware intrusion against a financial services company. This hands-on lab walks learners through a highly technical, multi-stage attack lifecycle mimicking real-world Cl0p tradecraft. Security professionals will investigate and defend against:

Initial Access: File transfer application exploitation.
Privilege Escalation: Credential chaining through SQL Server linked servers and LSASS memory dumping via native Windows LOLBins.
Lateral Movement: WMI lateral movement to the domain controller.
Ransomware Propagation: Domain-wide distribution to remote hosts via SMB admin share mapping, extracted using native Windows utilities before executing encryption and clearing event logs across the entire domain.

Specializations & SIEM Support: Available for both Incident Response and Threat Hunting specializations across Elastic, Splunk, and Microsoft Sentinel SIEM platforms.

Why are we doing it now

Cl0p remains one of the most prolific and dangerous ransomware threats in the wild, known for targeting high-value financial entities and masterfully leveraging "Living off the Land" (LOLBins) techniques to evade traditional detection. This scenario gives Blue Teams critical, hands-on practice identifying the early, subtle indicators of a breach before the catastrophic encryption phase occurs. It is an excellent addition to any organization's advanced threat-hunting or incident-readiness program.

Availability: This scenario is live today and available to all customers with access to DTR.

Platform Update

Smarter Crisis Sims & Richer After Action Reports

Release date: June, 3rd, 2026

We have rolled out a small but powerful update to the Crisis Sim Builder to help our customers get the absolute most out of the After Action Report. To ensure every exercise delivers rich, meaningful and valuable insights we want to encourage the use of three key settings: Option Ranking, Response Confidence and Inject Tagging.

What we've changed:

Enabled by Default: These three settings are now turned on automatically whenever a new Crisis Sim is created.
Contextual Information Banner: A blue info banner informs users that these features are ON by default and notes that they enhance the insights available in the After Action Report.
Dynamic Warnings: If a user chooses to toggle any of these settings off, a specific warning message will appear to let them know exactly what data they'll miss out on (e.g. losing accuracy data, confidence data or Crisis Framework mapping in their AAR) (examples attached).

New Feature: Presentation Steps

Release date: June, 17th, 2026

We are thrilled to introduce Presentation Steps, a feature designed to give the Facilitator complete narrative control over the team's learning. Additional context drives engagement. When learners understand the 'why' behind their training, they finish faster. With Presentation Steps, you can now seamlessly embed custom instructions and corporate narrative directly into any program.

Why This Matters?

Previously, relying on internal emails to provide guidance created a disjointed experience that often hindered participant engagement. With Presentation Steps, customers can now bring all that communication directly into the platform.

Deliver Critical Context: Explain exactly why a program is being assigned (e.g., "This path prepares us for next month's cloud migration" or "This is key preparation for our upcoming internal audit").
Boost Engagement & Completion Rates: Keep participants motivated by adding tailored words of encouragement or specific milestones right when they need them most.
Keep Learning Centered: Eliminate the friction of jumping between emails and the platform, keeping your team focused entirely on building critical skills.

Key Capabilities

Native Program Integration: Insert custom pages at any point in a Program journey—whether as a kick-off introduction, a mid-point checkpoint, or a celebratory closing note.
Easy-to-Use Editor: Build formatted pages using an intuitive text editor. You can easily apply headers, bullet points, and text styling without needing any technical or coding knowledge.
Frictionless Participant Experience: Your users will encounter these custom pages natively as they progress through their assigned path, creating a cohesive, intentional learning experience.

Feature Availability

Available To: All customers
Who Can Create: Managers and Facilitators via the standard Program building workspace.
Who Sees It: All participants enrolled in a Program.
How to Access: Simply navigate to Programs, open your builder, and select Add Step to view the new Presentation option.

Individual Crisis Sim in Programs

Release date: June 19th, 2026

We are excited to introduce Single-Player Crisis Simulations in Programs, a feature designed to seamlessly unify experiential learning with your foundational training pathways. This new feature lets you embed active crisis scenarios directly into your training tracks. You can now add a simulation block at any point in the program builder, whether you want to use it as a mid-path checkpoint or a final capstone project. This creates a frictionless experience for your learners, allowing them to smoothly transition from foundational content into a high-stakes simulation without ever leaving the Immersive One platform.

Who are we doing it for?

This feature is available to all customers utilizing Programs. Managers and facilitators can build these embedded simulations directly through the standard Program workspace, and all enrolled participants will see them as part of their learning journey.

Why are we doing it now?

Previously, mixing traditional upskilling with crisis simulations required significant manual effort, forcing you to juggle separate invites, external links, and complex tracking spreadsheets. We are introducing this capability now to completely eliminate that administrative burden and automate the multi-modal learning experience. By unifying these workflows, you can immediately deliver standardized, individual baseline assessments and rigorously benchmark your organization's real-time readiness and capability.

Metrics Tracker OWASP Top10 update

Release date: June 24th, 2026

We've officially upgraded our tracking from the 2021 to the 2025 OWASP Top 10 Collection!
Here is how this update impacts two of our core features:

Metrics Tracker Updates

2025 Tracking: The Metrics Tracker OWASP Completion metric now fully tracks the 2025 collection.
Graph Timeline: We've placed a clear indicator on the graph so users can see exactly when the version changed from 2021 to 2025.

Resilience Score & Key Insights Updates

Score Realignment: The Resilience Score has been updated to reflect the 2025 OWASP completion data.
Clearer Breakdown: Key Insights have been redesigned to explicitly inform users which specific OWASP Collection is driving their score.
Terminology Clarity: We have also made it much clearer within the insights that "Threat Labs" means Threat Intelligence Labs so users understand how their contributions feed into and impact the overall Resilience Score.

Exercise Phases Now Live in Crisis Sim Overview

Release date: June 24th, 2026

We've just released an exciting update to the Crisis Sim Overview section that brings even more depth and clarity to our simulation experiences!

We have officially integrated Crisis Exercise Phases (Inject Tags) directly into the overview. This means users can now see exactly which phases of our crisis exercise framework are being tested in any given scenario, offering vastly superior insights before they even hit start.

This update compliments the recent work we shipped in the After Action Report, creating a much more cohesive end-to-end experience for our users.

What's Next? To make navigating our content even easier, coming soon we will be releasing the ability to filter by phase within the catalog.

AI Program Builder

Release date: June 24th, 2026

We are launching AI Program Builder, a new artificial intelligence (AI) capability that allows you to create end-to-end programs at speed and scale. Powered by a fully agentic conversational AI assistant, this tool takes your natural language requirements to understand your needs and automatically build a tailored program flow.

The AI assistant acts as a program and catalog subject matter expert (SME). It understands our content taxonomy, stays completely up to date, and searches our entire catalog—including your custom content—to provide the best recommendations. You can use the assistant 24/7 to guide you through the initial build or to make follow-up changes to your programs.

Who are we doing it for

This feature is available to organization managers using the following licenses:

Immersive One: Core and Advanced
Legacy Multi-Module: This includes existing customers who have access to all three core capabilities: Labs, Cyber Range Exercising, and Crisis Sims.

Why are we doing it now

Every organization and team has unique training needs based on their specific tools, threats, and technologies. While we have previously offered features like custom collections, manually building an entire program from our vast catalog can be time-consuming and overwhelming.

AI Program Builder solves this frustration by removing the guesswork. You no longer need to spend hours searching for relevant content. This shifting of our platform toward a true self-service software as a service (SaaS) model ensures you can address your security challenges with ease, bridging the gap between your analytics reports and actionable training pathways.

Export Raw Data from Metrics Tracker

Release date: June 24th, 2026

We have expanded the export capabilities of the Metrics Tracker. Instead of being limited to summary scores, you can now download full raw CSV (Comma-Separated Values) data across all areas of the tool.

What's new?

Full Tracker Coverage: you can now download full raw data across ALL sections of the Metrics Tracker.
Granular Focus: Easily export the comprehensive data for Recommended Focus Areas as well as the User/Coverage Breakdown.
Custom Analysis Ready: No more manual copying or restricted views. Pull the raw data directly into Excel, BI tools or internal reports to manipulate and analyze the data exactly how your organisation requires.

Introducing Guided Goals & Programs: Expert Pathways to Faster Cyber Outcomes

Release date: June 25th, 2026

We're excited to introduce Customer Early Code Access for Guided Goals & Programs, a new capability designed to help organizations move from planning to measurable cyber readiness faster than ever.
Building an effective cybersecurity upskilling program often starts with a blank page. Teams must determine which skills to develop, which exercises to assign, how to sequence learning, and how to connect those activities to meaningful business outcomes.

Guided Goals & Programs removes that complexity by providing expert curated, outcome aligned pathways built directly into the platform.

What’s New?

Expert-Curated Programs - Choose from a growing library of predefined goals and programs designed by cybersecurity practitioners. Each pathway is structured to help teams build capabilities in areas that matter most to today's organizations.
Outcome-Aligned Learning - Every Guided Goal is tied to a specific business outcome, helping managers and security leaders ensure training efforts support organizational priorities.
Single source of truth - Goals automatically leverage Immersive One's extensive cyber readiness content, including hands-on labs, simulations, assessments, and programs, removing the need to manually build learning pathways from scratch.
Faster Time to Value - Spend less time planning and more time improving readiness. Guided Goals & Programs provide a clear roadmap that enables teams to launch quickly and progress with confidence.

We are introducing a robust lineup of prepackaged pathways designed for modern threats. Here is a look at a few of the goals your customers will be able to deploy now:

Enterprise-Wide AI Literacy & Governance: Aligning the organization on safe, compliant AI adoption.
Detect and Respond to Incidents in AWS: Targeted cloud security readiness.
Build AI-First Developers: Securing the modern development lifecycle from the ground up.
Improve Endpoint and DFIR (Digital Forensics and Incident Response) Capability: Sharpening the technical edge where attacks hit hardest.

For security managers and CISOs, Guided Goals serves as your native blueprint. It paves a consistent, predictable road to security agility, ensuring a smoother, faster onboarding experience for your entire team.