Trainings
Hands-on practice ranges for people who learn by doing. Each one drops you into a broken environment, lets you change things and shows what an attacker does next. Every acronym explains itself as you go. Like the tools, they run entirely in your browser.
Cloud Security Sandbox
Learn cloud security by breaking it.
A practice range for the CCSP domains, built for people who learn by doing. Each mission puts you in a broken cloud environment: a misconfigured network, an exposed database, a risky pull request, a live incident, a contract decision. Change the settings, run the simulation, and see which attacks get through and what breaks for the business.
- ◇Shared responsibilityFill in who owns each layer across IaaS, PaaS and SaaS, and see what goes unprotected when the line is drawn wrong.
- ⚿Data and keysChoose encryption, key custody, tokenization and masking for a payments dataset without breaking billing or analytics.
- ◍Attack pathsLock down a three-tier app on a live network map: SSRF, exposed databases, lateral movement and ransomware against your backups.
- ⚑Code reviewFlag the hidden flaws in a Terraform and Flask pull request. False positives count against you.
- ▤Incident responseInvestigate a cloud audit log and trace the attacker from a leaked key through persistence to exfiltration.
- §Legal and complianceData transfers, the GDPR 72-hour clock, legal holds, SOC reports, SLA math and crypto-shredding. Every mission ends with a debrief mapped to the exam.
Cyber GRC Sandbox
Risk decisions and audit judgment, practiced.
Governance, risk and compliance built on CRISC and CISA concepts. Draw the lines of responsibility at a bank, untangle the risk vocabulary, score and treat a risk register on a live heat map, classify controls, test a real IT general control against evidence, and run an audit engagement from planning to follow-up.
- ▤Three lines modelPlace twelve activities with the board, management, risk and compliance, internal audit or external assurance.
- ◎Risk languageAppetite vs tolerance, inherent vs residual, KRIs vs KPIs, risk owners, scenarios and ALE.
- ▦Heat mapScore five risks against defined scales and appetite, then choose to accept, mitigate, transfer or avoid each one.
- ⛨Control typesPreventive, detective, corrective, deterrent, directive and compensating, with the edge cases.
- ⚲Audit the leaversTest an access-removal control against twenty records, count exceptions by business day, and escalate the one that matters.
- §Audit engagementRisk-based planning, independence, sampling, compliance vs substantive testing, reporting and follow-up.
Incident Response Sandbox
An incident is a business event. Run it like one.
Who leads what when ransomware hits: cyber, IT, legal, communications, executives, risk, internal audit, regulators, law enforcement and the insurer. Order the response lifecycle, design a tabletop exercise, then play one: nine timed injects where you decide who to bring in and what to do, with a facilitator debrief after every move.
- ◉Who leads this?Thirteen decisions and tasks, from declaring the incident to deciding on a ransom, each matched to its owner.
- ↻LifecyclePreparation, detection, containment, eradication, recovery and lessons learned, and why the order prevents reinfection.
- ✎Design a tabletopObjectives, participants, ground rules, well-written injects, facilitation and the after-action report.
- ⚑“Operation Low Tide”A full ransomware and data-theft tabletop across two weeks: media, SEC materiality, the FBI, the board and the hot wash.
- ◷Notification clocksGDPR, NIS2, SEC, NYDFS, HIPAA and DORA deadlines, and the moment each one starts.
Application Security Sandbox
Security at every stage, starting before the code.
Follow one product, a telehealth app, through the secure development lifecycle. Map security activities to each stage, learn threat modeling and apply STRIDE to a real data flow diagram at the concept stage, triage SAST findings while developing, configure DAST to verify, and harden the release pipeline against supply-chain attacks.
- ↦Lifecycle mapSixteen activities, from threat modeling and ASVS requirements to SBOMs, IAST and bug bounties, each placed at its stage.
- ◇Threat modeling 101The four questions, data flow diagrams, trust boundaries and STRIDE.
- ◍Threat model the appChoose a mitigation for every STRIDE threat on six diagram elements, and spot where a category doesn’t apply.
- ⚑SAST triageReal code, five findings: fix the true positives, suppress the noise, keep the gate trusted.
- ⌕DAST setupAuthenticated multi-role scans, API specs, safe environments and rules of engagement.
- ⛓Supply chainMFA, branch protection, ephemeral runners, signing and SLSA, scoped dependencies, SBOMs and admission control.
Data Protection Sandbox
Find the crown jewels, then protect them.
Classify an insurer’s data, learn how a high value asset (HVA) program works, rate a candidate inventory with a scoring rubric, then turn on encryption, access, monitoring, DLP and backup controls for a Tier 1 system. Finish by investigating a departing employee’s data theft across DAM, DLP, CASB and UEBA alerts, and managing data from collection to deletion.
- ▤ClassificationThirteen data types across Public, Internal, Confidential and Restricted, classified by harm.
- ◆HVA methodIdentify, categorize, assess and remediate, based on CISA’s HVA program and MITRE’s crown jewels analysis.
- ▦HVA inventoryRate six candidates on sensitivity, criticality and dependency on a live board. Identity and backups make Tier 1.
- ⚿Protection controlsTDE with customer-managed keys, TLS everywhere, PAM, least privilege, DAM, DLP, labels, masking and immutable backups.
- ⌕Data-loss alertsSeparate the insider from the nightly job, and find the channel that got through.
- ↻Privacy lifecycleMinimization, retention, DSARs, AI training, shadow data and data ownership.
OT Security Sandbox
Where cyber meets the physical world.
Operational technology across four sectors. Learn why OT isn’t IT, place systems on the Purdue model, then explore clickable network maps of a hospital, a refinery and pipeline, a power grid and a manufacturing plant. Click any component to see what it does, the risks at that point and a real incident, then choose the control that matters most.
- ⚠OT is not ITSafety first, passive monitoring, planned patching, zones and conduits, the air-gap myth and OT incident response.
- ▤Purdue modelFourteen components from sensors to ERP, each placed at its level.
- ✚HospitalEHR, HL7 integration, PACS, CT scanners, infusion pumps, patient monitoring and building systems.
- ⛽Oil and gasIT/OT DMZ, engineering workstations, the safety system, pipeline SCADA and remote RTUs.
- ⚡Power and utilitiesThe control center, NERC CIP remote access, substation protocols, protective relays and physical security.
- ⚙ManufacturingERP and MES, vendor access, IIoT gateways, PLC logic integrity and robot-cell safety.
How these are built
Each training follows one exam or discipline, so the missions map to what you would be tested on. The scenarios are designed with Claude, and the companies, keys, logs and sites are fictional, so you can break things without breaking anything real. Where a mission cites a real incident, it’s a public one, summarized for learning.
Your progress is saved in your own browser. Nothing connects to real systems or sends data anywhere. If there's a domain you'd like to see next, get in touch.