Don't just learn.
Investigate.
Interactive cybersecurity challenges designed to make you think like an attacker, investigator and defender.
The Suspicious PowerShell
A workstation generated a PowerShell alert. Determine whether the activity should be investigated.
Impossible Travel
An identity alert shows two successful logins from geographically distant locations.
Ransomware Signals
Several endpoints suddenly show suspicious file activity.
These missions are just the beginning.
Practice is how you start. Real-world cybersecurity skills come from learning how to investigate, defend and respond to actual security scenarios.
The Suspicious PowerShell
A workstation generated a PowerShell alert. Determine whether the activity should be investigated.
Impossible Travel
An identity alert shows two successful logins from geographically distant locations.
Ransomware Signals
Several endpoints suddenly show suspicious file activity.
The Phishing Alert
An employee reported a suspicious email. Analyze the available evidence.
The Unsafe SQL Query
Review a small login function and identify the security weakness.
Secret in Source
A developer committed an API credential directly into application code.
The File Upload
Review an upload endpoint used by a profile-management application.
Password Storage
A legacy application stores user passwords in an unsafe format.
Search Box Trouble
A search page reflects user input directly into the response.
The One-Click Transfer
A banking application performs a state-changing action using a browser request.
Whose Profile Is This?
A profile endpoint uses an object ID supplied by the client.
The API That Trusted the Client
An API accepts an account identifier supplied by the frontend.
Too Much JSON
An API returns considerably more information than the frontend needs.
Unlimited Login Attempts
An authentication API accepts unlimited password attempts.
The Public Bucket
A cloud storage bucket containing internal documents is publicly accessible.
Too Much Power
A service account used by a small application has broad administrative permissions.
The Open Security Group
A cloud workload exposes an administrative service to the entire internet.
Find the Rare Process
You are hunting across endpoint telemetry for unusual process activity.
DNS Anomaly
A workstation is generating an unusual volume of DNS queries.
Unexpected Admin Rights
A standard user suddenly receives elevated privileges.
The MFA Storm
A user reports receiving repeated authentication prompts they did not initiate.
What Gets Fixed First?
Your vulnerability scanner reports hundreds of findings.
Is This Really Vulnerable?
A scanner reports a critical vulnerability, but the security team suspects a false positive.