New Content

New Crisis Simulation

Release date: July, 29th, 2026

We've released a new Crisis Sim scenario: Crisis Sim: Jadepuffer. This simulation places you inside Orchid Corporation, a fictional enterprise running 12 production, large language model-powered (LLM-powered) workflows that make thousands of outbound artificial intelligence application programming interface (AI API) calls daily. An attacker exploits a known vulnerability in the Langflow framework to deploy an autonomous, LLM-driven agent. Over eight hours, the agent independently harvests credentials, moves laterally across host systems over secure shell (SSH), and stages a ransomware attack on the core configuration database—all before the first alert triggers.

This single-track scenario guides you through a dual-perspective response:

Tactical triage: You start as the Security Operations Center (SOC) Lead, catching volume anomalies hidden in legitimate AI traffic and deciding how to contain an agent that continuously redirects its strategy using an LLM.
Executive leadership: As the incident escalates, you step into the Chief Technology Officer (CTO) role to weigh containment against Service Level Agreement (SLA) obligations, manage board expectations, and direct recovery efforts across both on-premises and cloud environments.

Who are we doing it for

This scenario is built for cross-functional alignment across technical and executive roles:

Tactical security professionals: SOC analysts, threat hunters, and incident responders can practice triage and containment in high-noise environments against adversaries that abuse valid tools and credentials at machine speed.
Technology and executive leaders: CTOs and IT leadership can test containment authority, evaluate business-impact trade-offs, and refine board communications when securing the estate requires pausing production AI services.
Cross-functional teams: Organizations can build alignment between technical defenders and executive decision-makers by having them navigate the exact same incident from initial alert through final recovery.

Why are we doing it now

Based on the real-world July 2026 incident documented by Sysdig, Jadepuffer represents the first confirmed case of a fully autonomous, agentic ransomware attack.

The threat actor's initial access relied on an exposed Langflow instance (CVE-2025-3248). Rather than bringing outside tools, the agent harvested existing credentials on the host—including API keys for OpenAI, Anthropic, DeepSeek, and Gemini—and used them to reason through next steps. It then exploited a Nacos configuration service flaw (CVE-2021-29441 and a default JSON Web Token [JWT] signing key) to encrypt 1,342 service configurations.

The speed of agentic attacks shifts how defenders must respond:

Machine-speed adaptation: Sysdig recorded the agent recovering from a failed database login with a multi-step fix in just 31 seconds.
Early containment: Traditional manual response times are too slow. Teams must practice identifying malicious activity hidden in valid AI traffic, cutting off agent LLM access, and applying overlapping security controls.

This scenario provides your team with a realistic environment to test and refine those response strategies before facing an autonomous threat in production.

Link to the Crisis Sim here.

Note: You must have Crisis Sim permissions to access the scenario.

New CTI Lab - CVE-2025-3248 (Langflow RCE)

Release date: July, 29th, 2026

We’re launching a new Cyber Threat Intelligence (CTI) lab titled “CTI: CVE-2025-3248 (Langflow RCE) – Defensive”.

Langflow is an open-source, Python-based visual framework used to build multi-agent artificial intelligence (AI) applications. It gives developers a drag-and-drop interface to chain together large language model (LLM) prompts, tools, and data sources into agentic workflows.

A critical unauthenticated remote code execution (RCE) vulnerability (CVE-2025-3248) scoring 9.8 on the Common Vulnerability Scoring System (CVSS) scale allows remote attackers to execute arbitrary Python code on a Langflow server through a single HTTP request. Added to CISA’s Known Exploited Vulnerabilities (KEV) catalog in May 2025, this vulnerability is actively exploited.

In this hands-on lab, you’ll:

Analyze the flaw: Examine how missing authentication and unsafe Python code evaluation allow unauthenticated remote code execution.
Study the attack chain: Walk through the full attack flow used by threat actor JADEPUFFER, from initial HTTP exploitation through container escape to ransomware execution.
Detect and mitigate: Learn how to spot indicators of compromise (IoCs) and implement defensive controls to protect your AI/ML environments.

Who are we doing it for

This lab is designed for security analysts, incident responders, and cloud and infrastructure security professionals responsible for protecting AI and machine learning (ML) environments.

It’s also valuable for any cybersecurity practitioner who wants to understand how vulnerabilities in AI tooling serve as an entry point into broader cloud infrastructure, and how specialized ransomware targets non-traditional assets like model weights and training data.

Why are we doing it now

Organizations are deploying AI development platforms like Langflow at pace, frequently leaving them internet-facing with privileged access to internal databases and cloud environments. Threat actor JADEPUFFER is actively exploiting CVE-2025-3248 to deploy EncForge, a ransomware strain built specifically to encrypt AI model assets. Rebuilding or retraining a single compromised model can cost upwards of $500,000 in compute time alone.

We’re releasing this lab now to give your team the practical skills required to spot vulnerable AI tooling, recognize active threat patterns, and harden production AI infrastructure before it becomes a target.

Link to the collection here.

New Lab Collection: Building with AI — CodeGuard

Release date: July, 23rd, 2026

We're releasing a new collection of five hands-on labs focused on securing AI-assisted code generation using Project CodeGuard – an open-source framework managed by the Coalition for Secure AI (CoSAI). This collection forms part of our artificial intelligence (AI) security curriculum, designed to teach you how to embed secure-by-default guardrails directly into AI coding agents.

Throughout this collection, you'll work through the complete lifecycle of AI code security:

Install and configure plugins: Set up Project CodeGuard in Claude Code to establish active security guardrails.
Prevent real-time flaws: Stop Structured Query Language (SQL) injection vulnerabilities at the precise moment code is generated.
Enforce secure architecture: Implement secure authentication architecture before any code is written.
Audit legacy code: Identify Insecure Direct Object Reference (IDOR) and Role-Based Access Control (RBAC) vulnerabilities across existing codebases.
Customize security policy: Write custom organizational rules to strictly enforce container registry policies.

This content is available immediately to all customers with access to AI labs.

Who are we doing it for

This collection is built for developers, Application Security (AppSec) engineers, and security professionals who work with or evaluate AI coding assistants.

If you have a basic familiarity with Python and web application security concepts, this content will help you build practical skills in configuring, testing, and extending AI security guardrails in a real development environment.

Why are we doing it now

AI coding assistants are transforming how software gets built – but without guardrails, they'll happily generate insecure code at the speed of thought.

Project CodeGuard embeds security rules directly into the AI agent's decision-making process, effectively shifting security left of the developer – directly into the AI itself. As organizations rapidly adopt AI coding tools, your security and development teams need to understand how to govern what these agents produce, not just what humans write.

Link to the Collection: Building with AI: CodeGuard

New Crisis Simulation Content

Release date: July, 22nd, 2026

We are launching two new interconnected Crisis Simulations: PagoSol: Response and PagoSol: Command. Both simulations share a common narrative set within Orchid Bank (NYSE: ORC), a fictional, publicly traded, tier-1 financial institution headquartered in New York and operating under its London-based parent, Orchid Financial Services (OFS).

At the time of the attack, Orchid Bank is under intense pressure to complete the fragile Tier 1 integration of PagoSol, a recently acquired Brazilian "super app" that brings 40 million customers and the bank's expansion into South America. A state-aligned adversary exploits the noise of that integration, and the cover of a parallel geopolitical campaign, to run a quiet living-off-the-land intrusion toward the bank's core identity systems and the institutional clearing network beyond them.

PagoSol: Response: This is the tactical track, where you play as the on-call incident commander (IC) in Orchid Bank's Cyber Fusion Center (CFC). Buried in benign integration alerts, you must spot the quiet internal intrusion behind a loud external decoy, hunt an adversary abusing valid tools and credentials, and decide how aggressively to contain. Your task is to balance defense against the availability of a revenue-critical database migration, while a break-glass containment decision waits on an approver you can't reach.
PagoSol: Command: This is the strategic track. The tactical battle is over, the core identity database has been exfiltrated, and the crisis has reached the boardroom. As chair of the crisis management team (CMT), you must guide the strategic response as the adversary pivots toward the ApexClear clearinghouse, a poisoned artificial intelligence (AI) engine corrupts liquidity forecasting, and a false-flag media story drives investor panic. You'll balance systemic containment, colliding regulatory clocks across multiple jurisdictions, and a bet-the-company decision that threatens the bank's ability to settle.

Who are we doing it for

Tactical security professionals: Threat hunters and incident response leaders can practice high-pressure triage and containment decisions in a sea of noise, without halting revenue-critical operations.
Executive crisis managers: Cybersecurity leaders and board members can test their strategic response against systemic contagion, market pressure, and multi-jurisdiction regulatory deadlines.
Cross-functional teams: Organizations can use these scenarios to build alignment between technical defenders and corporate decision-makers responding to the same incident.

Why are we doing it now

Financial institutions are prime targets for sophisticated, state-sponsored adversaries, and a single intrusion can cascade from one compromised workstation into a systemic threat to the wider financial sector. Firms face an increasingly dense web of compliance demands: the Securities and Exchange Commission's (SEC) cyber-disclosure rules, the interagency 36-hour banking-notification rule, New York Department of Financial Services (NYDFS) requirements, and, for globally operating groups, overlapping obligations to the UK's Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA), the Information Commissioner's Office (ICO), and overseas regulators, each on its own clock.

At the same time, technical and executive teams often operate in silos during a breach. This lack of alignment can lead to costly operational fallout, mishandled disclosures, and decisions made without a shared understanding of the threat. By releasing these two Crisis Simulations together, alongside our existing Mustang Panda Dynamic Threat Range (DTR), we're giving organizations a unique way to bridge this gap. Your teams can practice both the tactical defense and the executive response to the same threat scenario.

You can drop your technical teams into the DTR for technical exercising, and test the decision-making ability of your cyber and executive leadership utilizing the crisis simulations. This delivers a joined-up readiness program that runs from the first alert to the boardroom, aligning technical responders and senior decision-makers around a single incident.

Link to the scenarios: PagoSol: Response & PagoSol: Command.

Note: Users must have Crisis Sim permissions to view the scenario link

New Lab Collection: OWASP AI Security Verification Standard (AISVS)

Release date: July, 20th, 2026

This collection forms part of our AI security curriculum — a structured collection covering the OWASP AI Security Verification Standard, a newly released and already adopted framework for securing AI-enabled systems.

This collection of 13 labs takes learners through the entire AISVS framework, from foundational concepts to deep dives into each of the 12 control families. Starting with the standard's structure and verification levels, learners progress through training data integrity, input validation, model lifecycle security, infrastructure hardening, access control, supply chain risks, output safety, memory and vector database security, agentic orchestration, MCP protocol security, adversarial robustness, and monitoring.

Why are we doing it now

AI systems are being deployed at pace across every industry, but security teams lack a structured, testable framework to assess them against. The OWASP AISVS provides that framework — the same way the ASVS did for web application security. With AI-specific threats like prompt injection, model extraction, training data poisoning, and agentic tool misuse already being exploited in the wild, organisations need their security professionals to understand these attack surfaces and the controls that mitigate them.

Who we are doing it for

This collection is built for security professionals, AppSec engineers, and technical teams responsible for assessing, building, or deploying AI-enabled systems. It assumes familiarity with general application security concepts and builds AI-specific security knowledge on top of that foundation.

Link to the labs: OWASP AISVS

Two New Crisis Simulations: Ember Forge

Release date: July, 14th, 2026

We're exited to release two new crisis simulations:

Ember Forge: Response (link)
Ember Forge: US Command (link)

Both simulations share a common narrative set within Orchid Energy Group (OEG), a fictional, publicly traded, multinational energy conglomerate operating critical infrastructure. At the time of the attack, OEG's autonomous subsidiary, Orchid Fusion, is under intense pressure to deliver its "Project Ember" smart grid initiative alongside its external engineering partner, Apex Grid Solutions.

Ember Forge: Response, is the tactical track where you play as the on-call incident commander (IC) at Orchid Fusion's Cyber Fusion Center (CFC). You must hunt a state-aligned adversary targeting research and development networks through valid remote access. Your task is to decide how aggressively to hunt and when to escalate. You'll need to balance defense with a $250,000-per-hour downtime penalty from an external engineering partner.

Ember Forge: US Command, is the strategic track. The tactical battle is over, and the adversary – has forged a "Golden Ticket," giving them full domain admin control of the Active Directory (AD) forest. As the chair of the crisis management team (CMT), you must guide the strategic recovery. You'll balance containment, regulatory deadlines, and active geopolitical threats.

Who we are doing it for?

Tactical security professionals: Threat hunters and incident response leaders can practice making high-pressure containment decisions without halting business operations.
Executive crisis managers: Cybersecurity leaders and board members can test their strategic response against complex regulatory timelines and geopolitical threats.
Cross-functional teams: Organizations can use these labs to build alignment between technical defenders and corporate decision-makers.

Why we are doing it now?
Critical infrastructure is under constant threat from sophisticated, state-sponsored adversaries. Organizations face increasingly complex compliance demands from agencies like the Cybersecurity and Infrastructure Security Agency (CISA), alongside strict international regulations like North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) standards and the EU's NIS2 directive.

At the same time, technical and executive teams often operate in silos during a breach. This lack of alignment can lead to costly downtime penalties and unmanaged regulatory fallout.

By releasing these two simulations together, we're giving organizations a unique way to bridge this gap. Your teams can practice both the tactical defense vs the executive response to the same threat scenario.

By launching Ember Forge, we are completing a full-spectrum organizational training journey. Customers can now start their technical teams on our APT33 labs to dissect the adversary's specific TTPs, drop them into the APT33-based DTRs for technical exercising, and finally bring executive leadership into the fold with the Ember Forge crisis sims. This gives organizations a cohesive, end-to-end readiness program that actively bridges the gap between hands-on-keyboard responders and boardroom decision-makers.

Note: Users must have Crisis Sim permissions to view the scenario link.

New Collection: AI Defense – Model Access (MITRE ATLAS)

Release date: July, 14th, 2026

We are excited to release the third installment of our specialized AI defense curriculum with a brand-new collection: Model Access. Following the launch of our Initial Access collection on June 17th, this new release introduces three hand-crafted labs designed to shift defenders from basic entry-point security to active model protection.

AI Blue Teaming: Model Access – Introduction
AI Blue Teaming: Model Access – Detection
AI Blue Teaming: Model Access – Demonstrate Your Skills

Why are we doing it now

Once an adversary gets inside an AI-integrated environment, their next move is almost always to map the model itself. By querying APIs, analyzing inputs and outputs, and performing functional reverse engineering, attackers try to extract the model's structure, steal valuable intellectual property, or find blind spots to craft undetectable prompt injections. To stop them, security teams must know how to spot this reconnaissance phase. This collection equips defenders with the precise preventive mitigations and identification techniques needed to catch adversaries probing the model before they can poison or exploit it.
This collection is the perfect logical "Next Chapter" for teams who have completed June's Initial Access training. Together, they form a formidable, sequential training path mapped to the MITRE ATLAS framework. It provides a highly practical, technical deep-dive that perfectly complements any enterprise program focused on AI governance, secure AppSec design, or modern SOC readiness.

Availability: The new collection and all three labs are live today and available to all customers with access to generative AI labs.

Link: AI Blue Teaming: Model Access

New Crisis Simulation: PCI DSS Compromise

Release date: July, 8th, 2026

What's new

We have released a new Crisis Simulation focused on handling a catastrophic PCI DSS breach. The scenario places participants at the helm of "Nextugo," an online marketplace processing millions of payment transactions. Leadership receives a sudden notification from a cybersecurity firm: 17 million customer records, including credit card numbers, are currently for sale on the dark web. Aimed entirely at non-technical leadership and crisis management practitioners, this exercise tests judgment, escalation protocols, and cross-functional coordination as teams navigate data protection failures, third-party gaps, insider threats, and intense media fallout.

Why are we doing it now

PCI DSS alignment is a fundamental requirement for any organization handling payment data, yet executive teams rarely get the chance to practice their response to a full-scale payment data breach. We built this simulation to fill that specific readiness gap. It allows leadership to pressure-test business decisions and compliance obligations under fire, ensuring they are prepared long before a real-world incident or audit occurs.
Combined with the recently released PCI DSS lab collection and the Nebula Banking: Event Horizon DTR, customers can now run a complete, top-to-bottom PCI Readiness Program. They can use the Labs to train the technical team, deploy the DTR to test the blue team's detection and response, and run this new Crisis Sim to validate executive decision-making against the exact same threat profile.

Availability: This simulation is live today and available to all customers with access to Crisis Sim.

Link to the Simulation here. Note: Users must have Crisis Sim permissions to view the scenario link.

New Crisis Simulation Releases

Release date: July, 6th, 2026

Two new scenarios have been released:

What’s new

These new micro exercises designed for SOC analysts examine judgement and playbook alignment. These exercises are 3 to 4 injects long, simulate playbooks for common SIEM alerts and end with a relevant lab recommendation tied to the exercise.

Why are we doing it now

While our crisis sim catalogue has several executive level simulations, there has been a gap for front line technical pros. These simulations aimed at Tier 1 and 2 SOC analysts make crisis simulations accessible for a new audience in support of our Immersive One platform strategy. These exercises provide a direct linkage to labs, further aligning platform features. SOCs frequently run micro-exercises - now Immersive One can be a part of that cadence.

Availability: This simulation is live today and available to all customers with access to Crisis Sim.

New Crisis Simulation Content

Release date: July, 2nd, 2026

Immersive has released a new mini crisis simulation: Faulty Baseline.

This is the first of 3 new mini crisis sims being released over the next few days, these exercises are designed for SOC analysts examine judgement and playbook alignment. The exercises are 3 to 4 injects long and simulate playbooks for common SIEM alerts and end with a relevant lab recommendation tied to the exercise.

In this exercise analysts must choose whether to act on guidance generated by an AI agent used within the SOC. Subsequent decisions include access privilege changes and post-incident corrective actions.

Why are we doing it now

Note: Users must have Crisis Sim permissions to view the scenario link.

New DTR Scenario: Cl0p Ransomware - AI Autonomous Agent (Anthesis)

Release date: July, 1st, 2026

A cutting-edge Dynamic Threat Range (DTR) scenario exploring the terrifying next frontier of cyber warfare: a full ransomware campaign executed entirely by an autonomous AI agent framework against financial services infrastructure. Threat intelligence links this activity to an AI-driven operation (codename: Anthesis) capable of exploiting applications, chaining credentials, moving laterally, and propagating Cl0p ransomware across an entire domain—completely free of human operator involvement.

Specializations & SIEM Support: Available for the Incident Response specialization across Elastic, Splunk, and Microsoft Sentinel SIEM platforms.

Why are we doing it now

With AI adoption accelerating, defending against AI-driven threats is no longer a future problem. Because this DTR scenario directly leverages a technical vulnerability exploited autonomously, it serves as the perfect practical, technical exercise to complement our high-level Mythos crisis simulation. It bridges the gap between corporate crisis response and hands-on technical defense, making it an essential addition to any AI readiness programs.

Availability: This scenario is live today and available to all customers with access to DTR.

Platform Update

Discover Page

Release date: July, 30th, 2026

We're launching the Discover page in the Immersive One platform, alongside an updated Launchpad banner.

The Discover page provides a single, curated view of our best and most relevant activities across all Immersive modules – including content outside your current licensing or permission levels. This allows you to explore our full suite of capabilities and see how Immersive can support your organization's security challenges.

Additionally, we've updated the Launchpad banner to help you navigate directly to key features like Discover, Goals, Threat Actor Insights, and AI Program Builder.

This feature is available to all Immersive One customers and platform users, regardless of your current licensing tier or permission level.

Why are we doing it now:

Many security teams aren't aware of the full range of activities and modules available within the Immersive One platform. By making our complete library of capabilities visible in a single location, we're helping you identify the right tools faster, address emerging threats more effectively, and get the maximum value out of your cybersecurity program.

Custom Goals – Build learning journeys that match your organisation's needs

Release date: July, 29th, 2026

We are excited to launch Custom Goals on the Immersive One platform. This feature gives you the flexibility to build, customize, and deploy learning journeys tailored directly to your cybersecurity and artificial intelligence (AI) priorities.

Instead of relying solely on pre-built content or manual setup, managers can now build and launch customized resilience journeys in minutes. You can start from scratch, adapt expert-built templates, or use our AI Builders to generate new programs and Crisis Simulations. Additionally, you can combine existing programs and Team Exercises into a unified goal and track learner progress starting on day one.

Who are we doing it for

This feature is available to all Core and Advanced customers. It is designed specifically for security managers, team leads, and administrators who need to build tailored learning pathways and track progress across their teams.

Why are we doing it now

Every organization faces unique learning priorities, but creating tailored programs has historically been a slow, manual process that could take weeks. By introducing self-service customization and AI-driven program generation, we are enabling you to:

Reduce setup time: Cut program creation time down from weeks to minutes.
Scale with ease: Drive consistent learning across teams while reducing administrative overhead through self-service tools.
Adapt quickly: Align your training with changing business goals and evolving cyber threats.
Demonstrate value sooner: Gain immediate visibility into learner progress and measure organizational readiness from the moment a goal is launched.

Data Explorer - DTR Explore: Column Name Updates

Release date: July, 29th, 2026

We updated column names within the DTR Data Explorer to align with our other Explores, including Agent Tuning and Offensive & Developer AI Ranges. The updated mapping includes:

EXERCISE_NAME is now EXERCISE_TITLE
RANGE_NAME is now RANGE_TITLE
STATUS is now EXERCISE_STATUS
TEAM_NAME is now EXERCISE_TEAM_NAME
TOTAL_ACTIVITIES is now TOTAL_TASKS
ACTIVITIES_COMPLETED is now TASKS_COMPLETED

Programs data is now available in Data Explorer

Release date: July, 29th, 2026

We've brought Programs data directly into Data Explorer, eliminating the need for manual reporting and spreadsheet wrangling. You can now gain instant access to insights on:

Programs
Activities
Progress
Participants

Spend less time building reports and more time uncovering insights that matter!

Threat Actor Insights

Release date: July, 8th, 2026

Traditional threat intelligence feeds excel at telling your security team who is targeting you, but they leave senior leadership completely blind to whether internal defenders possess the technical skills required to mitigate those specific adversaries.

Threat Actor Insights bridges the gap between intelligence and operational training readiness by mapping live threat profiles directly onto verified, rolling platform performance data. Instantly surfacing your organizational training coverage gaps and providing the relevant platform learning pathways needed to close them.

What’s New

Live Readiness Mapping: Overlays active attacker tactics onto live team performance data to instantly identify training coverage gaps against specific adversary groups.
Visualizing Defensive Blind Spots: Providing interactive Radar Charts and Scatterplots that overlay attacker tactics against your current platform coverage and proficiency scores.
Streamlined Remediation Mapping: Speeds up skills development via direct, built-in program builder shortcuts that allow managers to instantly deploy targeted training protocols to close identified technical gaps.

Who are we doing it for

CISOs and Security Executives: Providing an automated, executive-ready view of organizational training resilience without the burden of manual data aggregation.
Security Operations & Training Managers: Helping them quickly isolate sector-specific threats to prioritize hands-on upskilling where engagement has been limited.

Why are we doing it now

Security leaders have access to threat actor information, but it is often disconnected from their organisation's actual readiness. They need a clear way to visualize actor-to-technique mapping, understand their team’s current platform training coverage, and determine where to focus platform engagement next. Threat Actor Insights enables organizations to:

Eliminate Manual Noise: Replacing the time-consuming burden of slicing spreadsheets and analyzing dense, static threat feeds.
Drive Real-Time Risk Reduction: Helping you shift your strategy from passive compliance tracking to dynamic data-driven training metrics against the exact adversaries targeting you right now.
Shift from Passive to Proactive: Move beyond passive threat feeds to answer the critical question executive leadership asks "How extensively have our teams validated their skills against the specific framework techniques used by the specific adversaries targeting us right now?"

Want a live look at your readiness

Navigate to Threat Actor Insights from the Reports menu to view your teams’ training performance baseline against the specific adversaries targeting you right now.

New DTR Capability: User Noise

Release date: July, 2nd, 2026

DTR exercises now run with User Noise, realistic always-on background activity from simulated employees going about their day (browsing, editing documents, launching apps, downloading files). Crucially, this benign activity lands on the same user accounts the attacker compromises, so malicious events are now buried in a convincing sea of everyday behaviour instead of standing alone.

Why are we doing it now

This is one of our most-requested capabilities, and it meaningfully raises the bar for learners:

No more shortcuts. Previously a learner (or an AI assistant) could filter the SIEM by a single username and surface a large portion of the attack in one click. With background activity on those same accounts, that shortcut is gone. Triage now demands real discrimination between benign and malicious behaviour.
Much harder to auto-solve. Because the signal is embedded in plausible noise rather than sitting in isolation, exercises can no longer be trivially completed by pointing an AI at the event log. Learners have to actually investigate.
Greater realism. The telemetry now looks like a living enterprise, the way a real SOC console does, making every investigation a truer reflection of the job.

How it works

Simulated users generate a steady stream of ordinary activity on the accounts under attack throughout the exercise, so the malicious needle is always surrounded by a realistic haystack.

Availability: Live today across our defensive DTR scenarios. The Mustang Panda / Threat Hunting benchmark exercise is deliberately kept noise-free to preserve comparable benchmarking. This work also lays the foundations for user-configurable noise controls in the future.