New Content & Platform Update
New AI Security Lab - Claude Code: Abusing Trust Boundaries for RCE
Release date: August 28th, 2026
We are exiting to launch a new lab focused on Model Context Protocol (MCP) security risks in AI-assisted development environments, specifically targeting Claude Code. Claude Code is Anthropic's agentic coding tool, available as a command-line interface (CLI) and as extensions for Visual Studio Code (VS Code) and JetBrains integrated development environments (IDEs). MCP servers can be configured per project using a .mcp.json file committed directly to a repository. When a developer opens a project, Claude Code reads this file and automatically spawns configured commands to list tools, requiring no prompt, confirmation, or authenticated account.
In this lab, you'll step into the attacker's seat as an outside contributor to an open-source project. You'll craft a malicious .mcp.json file, deliver it through a pull request branch, and achieve remote code execution (RCE) on the maintainer's workstation the moment they open the branch for review. Once access is gained, you'll loot the developer's home directory for sensitive credentials and tokens. Because Anthropic assessed this behavior as working as designed, there is no Common Vulnerabilities and Exposures (CVE) identifier and no patch available.
Who are we doing it for
This lab is designed for penetration testers and red teamers assessing AI-assisted development environments, as well as platform, developer-tooling, and DevSecOps engineers who roll agentic coding tools out to their organizations. It's equally useful for open-source maintainers, anyone who reviews inbound pull requests, and defenders or detection engineers who want to see the technique executed before attempting to detect it. Any cybersecurity practitioner who wants to understand why agent-read configuration should be treated as executable code – and how a routine code review becomes an RCE primitive – will benefit from this content.
Why are we doing it now
Agentic coding tools have moved into everyday developer workflows faster than review practices have adapted, and MCP is now the standard way these tools reach external systems. Because this behavior is a design decision rather than a bug, there's no incoming patch and no CVE to track. The only available mitigations are the ones teams implement themselves. Delivering this lab now enables offensive teams to demonstrate the real impact of an agent trust grant in their own estates, while giving tooling engineers a concrete reason to inspect repository contents before an agent opens them.
Link to the lab.
New CTI lab - CVE-2026-19478 (GitLab GraphQL Flaw)
Release date: August 28th, 2026
We're releasing a new Cyber Threat Intelligence (CTI) lab, CTI: CVE-2026-19478 – GitLab GraphQL Flaw – Offensive.
GitLab is a widely deployed open-source DevOps platform combining source code management, continuous integration and continuous delivery (CI/CD) pipelines, and issue tracking into a single application. Tens of thousands of self-managed instances are accessible via the internet, storing sensitive source code, deployment credentials, pipeline configurations, and release processes.
A critical vulnerability with a Common Vulnerability Scoring System (CVSS) score of 9.4 was disclosed on August 17, 2026. The flaw affects all self-managed GitLab Community Edition (CE) and Enterprise Edition (EE) installations from version 18.2 through to 19.2.3. Due to two related issues in how GitLab handles an internal GraphQL directive, an unauthenticated attacker can remotely delete public projects with a single HTTP request. Additionally, an authenticated attacker can execute arbitrary GraphQL mutations without triggering audit log entries.
In this interactive lab, users take on the role of a penetration tester evaluating a vulnerable GitLab instance. They explore both attack vectors directly and observe how destructive write operations can masquerade as routine read queries in the audit trail.
Who are we doing it for
This lab is for penetration testers, red teamers, and security engineers who need hands-on experience exploiting modern web application vulnerabilities. It's also valuable for security analysts and incident responders looking to understand the mechanics behind both attack vectors so they can write effective detection rules and review their organization's GitLab deployments.
Why are we doing it now
GitLab sits at the core of many software delivery pipelines. A compromised instance allows an attacker to manipulate CI/CD workflows, inject malicious builds, or exfiltrate deployment secrets.
Attackers actively exploited CVE-2026-19478 in the wild before many organizations could patch, and the audit-log bypass means a significant number of attacks may go unnoticed.
We're releasing this lab now to give teams a safe environment to demonstrate the impact of this vulnerability, understand the complete exploit chain, and verify whether their detection and response capabilities would catch an active attack.
Link to the lab: here
New Crisis Simulation: Post-Quantum Cryptography
Release date: August 26th, 2026
We’re releasing a new executive-level crisis simulation exercise centered on post-quantum cryptography (PQC). In this scenario, you join the security leadership team at Orchid Corp to navigate a strategic, slow-burn threat involving a historical data breach. You'll weigh complex decisions alongside executive peers—addressing "harvest now, decrypt later" risks, evaluating long-lived data retention, managing unprepared suppliers, and handling board disclosures. Grounded in real-world threat trends, the National Institute of Standards and Technology (NIST) PQC standards, and National Cyber Security Centre (NCSC) migration guidance, this exercise ensures your organization doesn't mistake basic readiness for true safety.
Who are we doing it for
This exercise is designed for cross-functional leadership teams, including Chief Information Security Officers (CISOs), Chief Executive Officers (CEOs), General Counsels, and board members who need to make high-level strategic decisions around long-term data security.
Why are we doing it now
"Harvest now, decrypt later" is an active threat turning historical data breaches into ticking time bombs, particularly for high-value data with a long shelf life like M&A records and identity data. With NIST finalizing its PQC standards in 2024 and NCSC migration guidance extending to 2035, executive teams must act immediately to build crypto-agility and prioritize risk by data shelf-life.
This simulation serves as the executive capstone to our overarching Quantum Readiness track. It expands upon the technical foundation laid in our recent "Preparing for Post-Quantum Cryptography" release and acts as the strategic companion to our "Post-Quantum Cryptography: Are We Ready?" simulation. Together, these releases provide a end-to-end training program that prepares your organization for PQC from hands-on technical execution to public board disclosures.
Link to the scenario: here
Nate: Available now to all customers with Crisis Sim Exercise access.
New CTI Lab - CVE-2026-64849 (MLflow SSRF)
Release date: August 25th, 2026
We're releasing a new Cyber Threat Intelligence (CTI) lab titled "Cyber Threat Intelligence: CVE-2026-64849 (MLflow SSRF) – Offensive".
In this lab, you step into the attacker’s seat as a penetration tester evaluating an target MLflow instance. MLflow is the largest open-source AI engineering platform, logging over 30 million downloads a month. It helps manage machine learning (ML) experiments, model versions, and Large Language Model (LLM) agent frameworks across Python, TypeScript, and Java environments. You'll exploit a critical unauthenticated server-side request forgery (SSRF) vulnerability that allows a remote attacker to bypass MLflow's URL validation. Using the provided infrastructure, you'll reach internal services, target instance metadata endpoints across Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure, and exfiltrate credentials from an isolated internal Application Programming Interface (API).
Who are we doing it for
This lab is designed for penetration testers and red teamers assessing artificial intelligence (AI) and ML infrastructure, as well as cloud, MLOps, and platform engineers responsible for hardening these environments. It’s also built for defenders and detection engineers who want to understand the mechanics of the attack before writing detection logic. Any cybersecurity practitioner interested in how AI/ML tooling is targeted and how a single unauthenticated endpoint can lead to cloud account takeover will gain valuable hands-on experience.
Why are we doing it now
The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-64849 to its Known Exploited Vulnerabilities (KEV) catalog on August 19, 2026, confirming active exploitation in the wild. Delivering this lab now ensures offensive teams can immediately demonstrate the real-world impact of an exposed MLflow server within their estates. By walking through the attack vector, security practitioners can show infrastructure owners exactly how an unauthenticated tracking server can hand internal cloud credentials directly to an attacker.
Link to the lab: here.
Feature Update - Threat Actor Insights - Executive Summaries and Key Gap Analysis
Release date: August 20th, 2026
Today we released AI-generated Executive Summaries and Key Gap Analysis for Threat Actor Insights. This update follows our recent release allowing you to filter threat actor data by Targeted Sector.
The new features synthesize complex team readiness metrics into clear, executive-ready narrative insights. They pinpoint critical skill gaps down to individual MITRE ATT&CK techniques, while targeted sector filtering surfaces the exact adversaries actively targeting your business vertical.
Who are we doing it for
This update is designed for security leaders, CISOs, and security operation managers using the Immersive One platform. It helps teams quickly understand, measure, and communicate their defensive readiness against active threats.
Why are we doing it now
Security leaders often struggle to translate raw technical metrics into concise narratives for executive stakeholders. At the same time, cyber threats continue to evolve rapidly.
By delivering AI summaries alongside industry-specific filtering, we enable you to:
Accelerate executive reporting: Instantly convert technical readiness data into high-level, actionable summaries.
Identify critical skill gaps: Pinpoint exact MITRE ATT&CK techniques where your team needs immediate upskilling.
Prioritize relevant threats: Filter out noise and focus resources on adversaries actively targeting your specific industry vertical.
Update: Building with AI: Claude Code
Release date: August 19th, 2026
We've updated our Building with AI: Claude Code collection to ensure practitioners are learning on the latest available tooling. This update includes a refresh across existing labs, an updated Claude Code build, and three brand-new labs:
Building with AI: Claude Code – Plan Mode & Rewind: Learn how to prompt Claude Code to propose a structured plan before modifying code, and safely roll back conversation states or changes when trying a new approach.
Building with AI: Claude Code – Building Custom Skills: Go beyond the fundamentals to build and package reusable, production-grade Claude Code Skills.
Building with AI: Claude Code – Background Automation: Use Claude Code as an autonomous background teammate to schedule recurring jobs, execute parallel tasks, and operate in isolated workspaces without losing context.
Additionally, an upcoming lab covering native sandboxing capabilities will be released soon to help you restrict agent blast radiuses during rogue actions.
You can access the updated collection at the Building with AI: Claude Code Collection.
Who are we doing it for
This update is designed for developers, security engineers, and technical teams who use Claude Code in their day-to-day workflows and want to build muscle memory in a realistic environment.
Why are we doing it now
Claude Code introduces new features and behavior updates rapidly. Training on outdated tools creates stale habits, so keeping our sandbox environments aligned with the latest software builds ensures your team learns modern, effective workflows.
Resilience Pathways Update
Release date: August 19th, 2026
We are releasing key enhancements to Resilience Pathways within the Immersive One platform to streamline your security training workflow:
Schedule program deployments: Set the exact date and time for a program to launch during configuration, letting you plan campaigns well in advance.
Adjust scheduled programs: Update deployment dates for scheduled programs directly from the interface if your timeline shifts.
Participant reminders: Send automated completion deadline reminders to participants, helping keep team learning on track without manual intervention.
Automatic draft goal clean-up: Automatically clear out unnecessary draft goals while providing prior notification to ensure your workspace stays organized.
Who are we doing it for
These updates are designed for cybersecurity administrators, program managers, and security leaders who oversee employee training initiatives on the Immersive One platform.
Why are we doing it now
Managing workforce cyber resilience requires precise timing and consistent participation. These features automate routine administrative tasks – like sending reminders and maintaining workspace hygiene – while giving you greater flexibility to align program rollouts with your organization's schedule. This ensures maximum participant engagement while saving your team valuable administrative time.
New Release: Optional AI Knowledge Pass
Release date: August 19th, 2026
We are updating AI Knowledge Pass to give you greater flexibility in how you manage access to Artificial Intelligence (AI) tools. Previously, access controls depended entirely on completing the AI Knowledge Pass program, which catered mainly to organizations in the early stages of AI tool adoption. With this release, you can choose between a training-first approach (upskilling teams without gating access), a skills-first approach (requiring proven skills before granting access), or a hybrid of both to fit your organization's specific needs.
Who are we doing it for
This update is for all Immersive One customers who are deploying AI tools across their workforce. Whether your organization wants to build AI capabilities without friction or enforce strict controls based on verified skills, this enhancement accommodates your specific stage of AI adoption.
Why are we doing it now
Every organization evolves at a different pace when adopting AI technology. We are releasing this update now so you can reduce friction for teams already using AI tools, strengthen access controls where security is paramount, and seamlessly adapt your security governance as your AI risk requirements mature.
New Feature: MITRE ATLAS Heatmap
Release date: August 19th, 2026
We are introducing real-time visibility into your defense capabilities across the entire MITRE ATLAS framework with our new interactive heatmap. This feature allows you to eliminate guesswork and immediately view your team's coverage across all 16 adversarial AI tactics.
To locate the heatmap, navigate to the Framework Tab and select MITRE ATLAS.
This feature is available to:
Immersive One Advanced Tier customers
Multi-module customers (available during a trial period)
Org admins
Team managers
Why are we doing it now
The AI security landscape is evolving at lightspeed, and regulators and auditors are increasingly demanding proof of robust AI infrastructure defense. This operationalized view gives leadership, admins, and managers the instant proof required to validate defense readiness today without waiting for quarterly reviews.
NEW DTR — Orchid Labs: Agentic Intrusion
Release date: August 17th, 2026
We are exciting to release a new Dynamic Threat Range titled "Orchid Labs: Agentic Intrusion – Threat Hunting". Recreating the aftermath of last month's OpenAI and Hugging Face incident, this range puts your team directly into a real-world scenario where an autonomous artificial intelligence (AI) agent executes a full-scale intrusion.
Unlike traditional scenarios, there is no phishing email or zero-day exploit to hunt for. The agent is introduced as a legitimate tool operating with authorized credentials. Responders must trace roughly 17,600 automated actions over four and a half days across logs to reconstruct how an AI process escaped a sandboxed test environment and reached corporate infrastructure. By following a trail of valid passwords, over-permissioned service accounts, and exposed access keys, your team will learn how to detect machine-driven attacks that exploit identity gaps rather than software bugs.
Who are we doing it for
This lab is built for incident response (IR) and security operations center (SOC) teams who are expanding their scope to protect AI and cloud estates. It is equally valuable for:
Cloud and platform security teams: Protecting interconnected environments and service boundaries.
AI/Machine Learning (ML) engineering teams: Understanding the downstream security risks of agentic deployments.
Detection engineers: Learning how to identify automated, machine-speed anomalies in standard event logs.
DevSecOps and software delivery teams: Securing machine-to-machine secrets, access keys, and non-human identities.
Why are we doing it now
Organizations are rapidly deploying AI agents into internal environments and software pipelines far faster than they are building the capability to monitor them. The recent real-world incident demonstrated that machine-driven attacks move at a volume and pace impossible for humans to match, exploiting standard configuration gaps like unrotated passwords and excessive permissions.
Because AI platforms are often trusted by surrounding infrastructure yet lack mature security visibility, we are providing this live-environment practice now. This ensures your security teams can spot and trace agentic activity before encountering a non-human threat actor in production.
New CTI release: TeamPCP Supply Chain Programs
Release date: August 14th, 2026
We’re releasing two targeted, role-specific readiness tracks on the Immersive One platform to prepare your team against real-world supply chain threats:
TeamPCP: Supply Chain Compromise and Cloud Credential Response: Designed for incident responders to identify compromised dependencies, trace the blast radius of stolen cloud credentials, and evict attackers from affected environments.
TeamPCP-Inspired AI Supply Chain and CI/CD Risk for Developers and Cloud Engineers: Built for developers and cloud engineers to focus on secure pipeline design, token controls, and stopping malicious code from reaching production.
Who are we doing it for
These programs are available today to all customers with access to the Programs feature. They are specifically tailored for:
Incident responders and SOC analysts who need hands-on practice detecting hijacked dependencies, investigating compromised secrets, and responding to cloud breaches.
Developers, DevOps engineers, and cloud engineers responsible for securing continuous integration and continuous delivery (CI/CD) pipelines, managing software bill of materials (SBOMs), and preventing unauthorized code execution.
Why are we doing it now
The March 2026 TeamPCP attacks demonstrated how vulnerable conventional pipeline security is when attackers compromise trusted developer tools. By force-pushing mutable release tags into GitHub Actions—such as the Trivy scanner—attackers executed credential stealers before legitimate security tools even ran. This tactic allowed them to bypass secret masking and subvert SBOMs entirely, impacting over 2,500 companies.
Because standard security tooling isn’t enough to stop these techniques, your security and engineering teams need practical, hands-on experience to detect and mitigate these specific pipeline bypasses in a controlled environment.
New release: AI-Driven Incident Response (Hugging Face Crisis Sim)
Release date: August 13th, 2026
We are launching a new crisis simulation titled [Crisis Simulation]: Hugging Face – The Challenges of AI-Driven Incident Response.
In this exercise, players join the Orchid Corp incident response team on a Monday morning to handle an autonomous, artificial intelligence–driven (AI-driven) attacker that executed 17,400 actions over the weekend. When your team attempts to analyze the massive log volume using commercial SaaS AI models, standard Application Programming Interface (API) safety guardrails block the queries because the harvested credentials and exploit payloads contain live threat data.
Participants must navigatedefender asymmetry by making rapid, high-stakes decisions under pressure:
Deploy alternative tooling: Spin up self-hosted open-weight models to bypass commercial SaaS API lockouts.
Manage regulatory compliance: Navigate strict notification deadlines while technical analysis is stalled.
Execute incident command: Direct cross-functional containment and executive decision-logging without reliance on traditional SaaS forensics.
This exercise sets the stage for our upcoming OpenHug/Agent Intrusion Dynamic Threat Range (DTR) releasing later this week, which will give practitioners hands-on technical forensic experience with the same attack vector.
Who are we doing it for
This simulation is built for cross-functional response teams, including:
Chief Information Security Officers (CISOs) and Incident Response (IR) leaders
Security Operations Center (SOC) managers and threat hunters
Legal, regulatory compliance, and communications stakeholders involved in crisis governance
Why are we doing it now
Autonomous, AI-driven offensive tooling operates at machine speed, generating massive noise to conceal data exfiltration. Based directly on Cyber Threat Intelligence (CTI) from the Hugging Face intrusion disclosed in July 2026, this scenario addresses a critical vulnerability: traditional commercial AI assistance can suddenly fail defenders when standard safety guardrails flag real attack payloads.
By participating in this exercise, your organization will:
Validate decision-making under non-standard conditions: Test how leadership and technical teams coordinate when primary forensic tools become unavailable.
Prepare for machine-speed threats: Build operational readiness against high-volume, automated attacks that overwhelm human log analysis.
Strengthen strategic alignment: Bridge the gap between executive command, legal notification timelines, and technical containment strategies before an actual crisis occurs.
Customer Availability
Live today and available to all customers with access to Crisis Sim.
Link: Hugging Face: The Challenges of AI-Driven Incident Response
Post-Quantum Cryptography for Managers (Crisis Simulation)
Release date: August, 6th, 2026
We are launching a new crisis simulation: Post-Quantum Cryptography for Managers.
In this exercise, you step onto the Security Council of Orchid Corp, a global conglomerate, to answer a direct question from the board: is your business ready for Post-Quantum Cryptography (PQC)? While replacement cryptographic standards already exist, the real challenge lies in driving organizational change across a complex enterprise before time runs out.
Stepping into the roles of the Chief Information Security Officer (CISO), Chief Executive Officer (CEO), Chief Financial Officer (CFO), and General Counsel (GC), you must locate critical cryptographic dependencies, prioritize what to protect first, and manage unprepared third-party suppliers. Every choice forces realistic trade-offs between time, cost, and risk – all framed in plain business language rather than deep technical detail.
This simulation builds directly on our Preparing for Post-Quantum Cryptography collection released earlier this week. While that collection grounds teams in theoretical risks and regulatory timelines, this exercise provides practical application. It bridges the communication gap between technical teams and executives, providing security, finance, and legal leaders a shared, low-stakes environment to align on strategy. Be sure to look out for a second PQC-focused simulation dropping in the coming weeks to build on this momentum.
Who are we doing it for
This feature is built for executive leaders, security directors, legal counsel, and financial officers who must evaluate business exposure and build a unified strategic response to quantum risk. It is live today for all customers with Crisis Sim access.
Why are we doing it now
The transition to PQC is no longer a fringe, academic worry – it's a concrete compliance reality. With the National Institute of Standards and Technology (NIST) finalizing replacement standards in 2024 and regulatory frameworks like the Payment Card Industry Data Security Standard (PCI DSS) and the Digital Operational Resilience Act (DORA) mandating PQC readiness, organizations must begin planning immediately.
Beyond regulatory pressure, businesses face an active threat from "harvest now, decrypt later" tactics. Threat actors are stealing long-lived, sensitive data today – such as defense intellectual property (IP), health records, and proprietary research – to decrypt once quantum computing matures. If your organization handles sensitive data with a long shelf life, post-quantum readiness is a problem you must address today.
NEW CTI Lab - CVE-2026-54121 (Certighost)
Release date: August, 5th, 2026
We're releasing a new hands-on lab titled Active Directory Certificate Services: Elastic – Detecting Certighost.
Active Directory Certificate Services (AD CS) is Microsoft’s built-in public key infrastructure (PKI), used across enterprise Windows environments to issue and manage the digital certificates that underpin authentication, encryption, and trust. Because these certificates can authenticate users and devices, misconfigurations in AD CS are frequently abused for privilege escalation.
This lab focuses on "Certighost," an improper authorization vulnerability (CVSS 3.1 8.8) affecting Windows Server 2012 through 2025. The flaw allows an authenticated network attacker to manipulate the certificate enrollment process to obtain a higher-privileged certificate, creating a path toward full domain compromise.
Instead of exploiting the flaw, you'll step into the defender's seat. Working in Elastic, you'll examine attack logs, identify Indicators of Compromise (IOCs), and learn how to build detections to defend your environment.
Who are we doing it for
This lab is designed for security analysts, incident responders, and threat hunters who monitor Active Directory environments, as well as SIEM detection engineers working in Elastic.
It’s also valuable for any cybersecurity practitioner who wants to understand why AD CS is a primary target and how certificate abuse can hide inside normal authentication traffic.
Why are we doing it now
AD CS abuse has become a standard technique in real-world intrusions, and certificate-based privilege escalation is notoriously difficult to spot because it uses legitimate PKI machinery. Certighost adds another entry to the growing family of AD CS attacks that defenders must catch.
We’re delivering this lab now to give blue teams practical experience turning raw Elastic logs into actionable detections so you can stop a Certighost attack before an adversary achieves domain dominance.
New Content: CyberArk
Release date: August, 3rd, 2026
We're releasing three brand-new theory labs focused on Privileged Access Management (PAM) with CyberArk on the Immersive One platform. This collection complements the Identity and Access Management (IAM) with Microsoft Entra labs, giving your team a complete view of core identity controls. Rather than just showing you how to click through a user interface (UI), these labs walk you through how identity infrastructure operates under the hood so you can properly secure privileged accounts.
Who are we doing it for
This release is designed for security analysts, identity administrators, platform engineers, and security architecture teams who manage or monitor identity boundaries in their organization.
Why are we doing it now
Identity is now the primary security boundary in corporate architecture. Unsecured privileged accounts and misconfigured cloud directories remain top entry points for corporate breaches. To contain identity-based attacks, your teams must understand how privileged architecture functions under pressure, allowing you to proactively eliminate misconfigurations and block lateral movement.
Customer Availability: Live today and accessible to all customers across all tiers.
Preparing for Post-Quantum Cryptography
Release date: August, 3rd, 2026
We’ve launched Preparing for Post-Quantum Cryptography – a new theory collection designed to give security leaders a structured framework for post-quantum cryptography (PQC) migration.
Rather than focusing on theoretical algorithm design, this collection delivers actionable guidance to help you audit existing cryptographic assets, evaluate finalized National Institute of Standards and Technology (NIST) replacement standards, and build a resilient migration strategy.
Key topics covered in this collection include:
Assessing cryptographic footprints: Learn how to discover and catalog vulnerable asymmetric algorithms (such as RSA and ECC) across your infrastructure.
Evaluating finalized NIST standards: Understand the practical applications of Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM), Module-Lattice-Based Digital Signature Algorithm (ML-DSA), and Stateless Hash-Based Digital Signature Algorithm (SLH-DSA).
Building an enterprise migration roadmap: Formulate a step-by-step transition plan that addresses technical debt, vendor readiness, and cryptographic agility.
Who Are We Doing It For
This collection is built specifically for security leadership and governance teams, including:
Chief Information Security Officers (CISOs)
Risk managers
Compliance leads and auditors
Why Are We Doing It Now
The regulatory grace period for quantum readiness has officially ended. Threat actors are actively executing "Harvest Now, Decrypt Later" (HNDL) attacks – exfiltrating encrypted data today to decrypt it once quantum capability matures.
Additionally, regulators and standard-setting bodies now treat post-quantum readiness as an immediate audit requirement. Organizations must demonstrate actionable progress to auditors, procurement teams, and boards today to comply with:
NIST's published PQC standards: Finalized specifications for ML-KEM, ML-DSA, and SLH-DSA are live, establishing the baseline for modern encryption.
Digital Operational Resilience Act (DORA): Regulatory enforcement is now in effect, mandating strict ICT risk management and cryptographic oversight.
Payment Card Industry Data Security Standard (PCI DSS) v4.0.1: Requirement 12.3.3 is now mandatory, forcing organizations to document and manage targeted cryptographic inventories.
National Cyber Security Centre (NCSC) guidance: The NCSC has set a 2028 deadline for complete cryptographic discovery and initial migration planning.
Next Steps and Related Content
This theory collection serves as the strategic foundation for your PQC journey. To defend against the immediate data exfiltration phase of HNDL attacks, pair these concepts with our tactical incident response (IR) and threat hunting labs:
Orchid Corp: Akira: Identify credentials being exfiltrated to OneDrive via PowerShell.
Orchid Emporium: Lazarus Group: Investigate cloud-native Amazon Simple Storage Service (S3) to Command and Control (C2) exfiltration.
Note: While these threat hunting labs train defenders to stop active data exfiltration, they focus on general adversary tactics rather than PQC-specific algorithms.
For a broader conceptual foundation, explore our existing Quantum Computing Fundamentals collection. In the coming weeks, we’ll also expand this track with dedicated PQC crisis simulation scenarios to test executive decision-making under pressure.
Customer Availability: Live today and accessible to all customers across all tiers.