Warming up the range…
Everything is still loading — the buttons unlock in a moment.
The hands-on cyber practice platform where individuals and teams learn, investigate, build, defend, and compete in realistic emulated environments. Pick your environment, choose a scenario, or talk it through with the range advisor — nothing here is a live machine.
Optional — pick a desktop
Guided practice, SOC investigations, live team incidents, detection and automation, competition, AI agent supervision and evaluation, executive crisis exercises, authorized pentesting, and your own estate — connected through one platform.
Cybrary Forge · Emulated environment · Your training estate, not production
Scenario library
Loading labs…
121 labs
The detection and response core: query telemetry, triage a queue, hunt a hypothesis, automate the response and prove the control fired.
Dispatch say the yard crawls and the cabling record is four years stale. Sit at the yard seat, ping each segment, walk the path hop by hop and read the physical layer off the kit: what each leg is made of, how far it runs and what it negotiated. Then say which of the two faults the yard actually feels.
The yard's handhelds keep dropping and a bigger access point will not fix it. Measure the cell in the wireless console: channel, noise floor, non-Wi-Fi energy on that channel, the cells sharing it, and the station at the bottom of the rate table eating the airtime. Then name the channel to move to.
Two hypervisor hosts arrived with nothing configured — no time sources, no lockdown, no log target, no failover, one path to the shared store and every guest powered off. Read the baseline score, bring the platform up to the written standard, power the guests on, and prove the score moved.
Everything runs on one host, every guest was sized by whoever asked loudest, and the archive store has a single path. The ticket says 'the virtual machines are slow' with no numbers attached. Measure the contention, name the cause, fix it, and measure again.
A healthy, hardened platform and permission to spoil it: pile on virtual cores and read the wait time, promise memory the host cannot back and watch it leave the guests, then pull a storage path and read the response time. Put every change back and prove the score returned.
One datastore has gone quiet and the guests on it hang rather than error. A machine carries delta files a failed backup never consolidated, and the gold store is fuller than its guests can account for. Tell a pause from a permanent loss, release the disk the backup holds, hand the space back, and prove the score moved.
Nobody can manage anything. A host has dropped out of the console with its guests still running, a certificate is days from lapsing, a clock is fifteen minutes out and the appliance stops its own services. Repair the management plane in the right order and prove it.
Live migrations start, sit at the same percentage and time out. One host was given jumbo frames by somebody testing storage, and one port group was set to bond its uplinks while the physical switch was never touched. Read the refusal, find both mismatches, and put each end back in agreement.
A failover agent that will not configure, a certificate renewal that fails, logs that stopped arriving and a clock that is out - all on one host. Find the one cause under all four, then bring the host back to its profile and put a stale gold image in order.
Two Windows Server nodes arrived with the Hyper-V role added and nothing else done: no time sources, no Credential Guard, live migration off, no quorum witness and one path to the volumes. Read the baseline score, bring the cluster to the written standard, and prove the score moved.
Everything runs on one node, every machine has static memory sized by whoever asked loudest, and the volumes have a single path. The ticket says 'the VMs are slow' with no numbers attached. Measure the contention, name the cause, fix it, and measure again.
You are handed a healthy, hardened cluster and permission to spoil it. Pile processors onto the machines on one node, promise memory the node cannot back, take a storage path away, remove the quorum witness, and try two changes the platform should refuse. Read the counters after each one, then put it all back.
Live migration onto the second node fails authentication, its events stopped arriving and its clock is out. Find the one cause under all three, then bring the node back to the cluster baseline and put a stale gold image in order.
Vet three sources reporting indicators for an active phishing wave against your sector. One has a two-year track record, one is a new community feed, one is an anonymous paste. The watchlist update is due in an hour. Grade each source, corroborate what you can, and admit only what earns its place.
Decide whether the intrusions hitting three of your suppliers are one campaign or copycats. The draft on your desk mixes corroborated facts with one analyst's guesses and quietly drops a dissenting report. Rebuild it so every sentence is labeled for what it is, and task collection for the gap that decides the question.
Write the one-page warning product your executives asked for. Reporting suggests a ransomware crew will move against organizations like yours over the holiday window. Resist the pressure to sound certain. State your confidence, name the alternatives, and tell the reader what would change the judgment.
Endpoint health is green across the fleet, yet a confirmed execution produced no searchable process events. Establish where the telemetry is being lost between the sensor and the index, and prove the gap is closed.
One log source went quiet at 02:00 and no detection content changed. Find out what stopped, work out which rules went blind with it, and restore the feed before the next shift trusts the silence.
A subnet of workstations has produced zero telemetry since it was built, and nobody noticed. Establish how far the blind spot reaches, bring the hosts into collection, and say what could have happened there unseen.
A documented, ATT&CK-mapped rule has never produced a single match. Determine whether it was ever enabled, get it running against real data, and prove the match with a test case.
The rule reports hundreds of matches and the analyst queue is empty. Trace where the matches stop becoming cases, and fix the path so a match reaches a person.
A parser upgrade shipped last week. The rule still runs clean and matches nothing, which is the most expensive kind of silence. Find the field the parser renamed and restore the detection without rewriting the logic.
Ingest volume is healthy and the events exist — just not where the rule looks. Work out which index they landed in, repoint the detection, and add the check that would have caught the move.
The detection fires for some hosts and not others, and the pattern looks random until you plot ingest lag. Measure the lag by source, and set a window the late hosts can actually meet.
A source's clock drifted an hour ahead and its events now land outside every window. Prove the drift from the data, correct the time handling, and re-run the detection over the period it missed.
A wildcard suppression added to quiet a backup job now hides the intrusion as well. Establish what the exception swallowed, narrow it to the job it was written for, and re-test the rule against both.
A brittle literal match passes its own test and misses every real-world variant, and a second source runs late underneath it. Rebuild the logic to catch the variants, and account for the lag rather than ignoring it.
Slow, deliberate activity never accumulates enough inside one evaluation window, and the parser drifted too. Redesign the window so patient behavior still adds up, and fix the field mapping it depends on.
Cases look worked and closed, but the containment automation has been failing silently for eleven days. Establish what was never actually contained, close the real exposure, and make the failure loud next time.
A schema change moved the field the containment playbook triggers on, and the retry policy now isolates the same workstation four times per case. Repair the binding, make the retry safe to repeat, and prove one case produces one isolation.
Production content no longer matches the approved version, validation is months stale, and two pipeline stages are broken underneath. Bring the running content back to something you can sign, and evidence each stage as you go.
An active intrusion, a tenant with three interacting misconfigurations, and an alert budget you are not allowed to blow. Decide what you fix first, and defend the order in writing when the intrusion does not wait.
Coverage looks healthy from headquarters, but every host outside the en-US estate stopped matching when a parser pack dropped its non-English field mappings. Restore the mappings, handle the full-width payload the matcher refuses to fold, and re-prove coverage per region.
Northwind Logistics is three days into recovery and the rebuilt hosts were never brought back into detection. The scope names the old asset group, the ransomware rule watches a path the new image lacks, and paging points at a destroyed gateway. Restore detection over the enclave and prove it works.
Everything after impact: trustworthy recovery points, isolated proof, forest recovery, staged reconnection and an after-action record that survives review.
Northwind wants to know whether its backups would survive the incident they are written for. Audit the backup estate before anything happens, and report which repositories an attacker with backup-admin rights could destroy and which destructive actions are actually blocked.
Order Intake is down. Work out what must come back before it can, including the dependency nobody wrote down, and record where the recovery order is forced rather than chosen.
Four copies of the order database survive. The newest one is not the answer. Work the catalog and the trust workbench until you can name a candidate and defend the choice in writing.
A recovery candidate has been chosen and nobody has proved it is clean or complete. Restore it into the isolated enclave, boot it, validate the application, get business acceptance, and only then promote it to the production estate.
The warehouse application server is not coming back by restore. Rebuild it from an image you can account for, patch it before it sees a network, and layer only proven data on top.
Identity is the hard dependency under everything else. Bring the forest back in an isolated recovery network, clean up what no longer exists, and make sure the attacker's tickets die with the old forest.
A clean estate handed back to a dirty network is not recovered. Rotate what the attacker held, gate every host, and let the business back on in waves you can defend.
One run, the whole chain. Prove a recovery point instead of promoting it, rebuild the warehouse host from a trusted image, recover the forest with krbtgt double-rotated, reconnect behind every gate, answer the room's injects, and publish the record that turns it into control uplift.
Controls, evidence and the paperwork an auditor will actually accept — assessed the way a real assessment runs, on artifacts rather than assertions.
An edge firewall change made during a Friday outage exposed RDP on the jump host to the internet, and the emergency rule was never reverted. Close the exposure without cutting off the administrators who are legitimately using it.
Four accounts in the domain admins group have no named owner, two of them have not authenticated in over a year, and one is a service account with a password older than the policy allows. Reduce the privileged population without breaking the job that depends on it.
The hardened workstation baseline is applied to 96% of the estate. The missing 4% is the finance team, exempted for a spreadsheet add-in two years ago. Bring them back to baseline without breaking month-end.
A marketing analytics vendor was given access to an object store six months ago, through a long-lived key pasted into a shared document. The bucket policy that was supposed to scope it allows list on the whole account. Cut the access back to what the contract actually needs, without breaking the reporting.
The building management controllers share a broadcast domain with the corporate print VLAN because of a cabling decision made during a fit-out. A commodity worm on a printer would reach the controllers directly. Segment it without a change window that finance will refuse.
A build pipeline prints its environment on failure, and three months of failed builds sit in a log store half of engineering can read. One printed value is a production database password that still works. Rotate what leaked, purge the logs, and stop the pipeline printing secrets.
A red team reached domain admin in nine hours from a standard laptop, using no exploit. Your job is not to argue with the report: it is to break the path in the fewest changes that survive contact with the business, and to prove the path is broken.
Securing the agents now sitting inside the SOC: prompt injection, poisoned tool catalogs, approval ceilings and the oversight boundary around autonomy.
A support-agent deployment is live and nobody has an inventory of it. Walk it end to end and record which model, whose prompt, which corpus and which tool token are in play, and where the trust boundaries actually sit.
A single agent run has been fully instrumented, start to finish. Follow one user sentence through policy, retrieval, the model call, the tool broker and the CRM write, and explain exactly why the agent did what it did.
A support bot can issue refunds, send email and read CRM records, and nobody has tested what that reach allows. Abuse it yourself, scope the permissions down, and prove the legitimate workflows still complete.
A returns PDF uploaded by a customer carries a hidden instruction. It is ingested, retrieved, and the support agent quietly exfiltrates a high-value customer record. Find the path, choose a remediation you can defend, and hold both security and utility scores.
One vector namespace serves many customers, and one filter is missing. Prove the leak, fix authorization at retrieval time rather than in the prompt, and re-run both the security and the utility suites.
The injection is not in the prompt or the corpus. It comes back in the response from an integration the agent trusts. Find where the agent stopped treating tool output as data, and make it stop obeying its own tools.
Containment looked complete, but the agent's long-term memory keeps re-arming the attack. Find the stored text that survives every reset, clear it without destroying legitimate history, and prove the attack no longer returns.
An agent is being given actions nobody has decided how to approve. Design the approval boundary yourself, naming which actions need sign-off, whose, what the timeout is, and what happens when a request is declined.
Two guardrail configurations are on the table and somebody has to choose. Run twenty trials against each with the same harness, then make a recommendation you can defend on both blocked attacks and broken legitimate work.
An agent loop is billing four figures an hour. Find it, cap it, and keep the product online.
The weights changed, the hash was never checked, and behavior drifted in exactly one dangerous direction. Find the drift, prove it with evidence rather than impression, and put a gate in front of the next swap.
A model endpoint is exposed to customers and extraction is a real risk. Quantify what an attacker recovers per thousand queries, then price each defense against the utility it costs.
A privacy complaint arrives. Establish whether the model actually memorised the record.
A fraud classifier is being walked past its own boundary. Harden it and measure the false-positive cost.
The copilot your analysts trust has been fed instructions through an alert body. Catch what it did on that instruction, contain the session, and rebuild the boundary that keeps alert text as data.
A confident summary cites an IP that appears in no source. Build the evidence gate that catches it.
An agent is about to be given a genuinely destructive button. Set its blast radius, its rollback path, its approval rule and its audit trail before it runs, and prove each one under a real case.
A customer has asked for an AI red-team engagement, not a list of clever prompts. Plan the objectives, run the suite, discard the findings you cannot reproduce, and write the report they can act on.
An AI system failure becomes a full incident with five roles to fill and a regulator clock running. Command the room through adaptive injects and simulated stakeholders, and defend every call you make on the record.
Autonomous agents compete on the range instead of people. Connect through the participant API, work tasks under fixed tools, budgets and safety boundaries, and be scored on machine-verifiable outcomes as well as cost and latency.
This is the control case for the whole suite, run with no inference at all. Work the lab on authored dialog and deterministic evidence rules, and prove it is complete and assessable before any model is added.
The browser's built-in model summarizes, translates and drafts on your own hardware while the server keeps scoring from tenant events. Work the case on-device, and finish it on a machine that has no local model at all.
You bring your own model to a much noisier version of the incident. Work it under a session-only credential lease and a hard spend ceiling, watch every prompt your key paid for, and get your proposals authorized by the range coordinator.
Every job an agent handles carries a different risk, and one router decides where it runs. Classify jobs as personal, advisory, proposed-action or authoritative, pin the authoritative ones server-side, keep restricted data off the public fallback, and degrade a feature rather than the lab.
A marketplace MCP server joins the fleet with instructions for the model hidden in its tool description. Review the catalog entry before the agent acts on it, name the injected instruction, and decide whether the server is admitted, restricted or refused.
A community server publishes wazuh.get_alerts and quietly wins the name the fleet already resolves. Work out which server the agent actually called, and restore a naming rule that cannot be won by whoever registers first.
The intruder writes an injection into a log field they control, and your own pipeline delivers it to the triage agent. Trace the text from the raw record to the agent's plan, and draw the boundary that keeps alert content as data.
The injection is not trying to act tonight. It is writing itself into the agent's stored notes so it is still there tomorrow. Find the poisoned memory, prove what it would have changed, and clear it without losing the legitimate case history.
The response agent proposes isolating 1,284 hosts to contain one brute-force case. Decide what containment the evidence actually supports, and set the bound that stops a single case from taking out the estate.
The triage agent reaches for a detection change using the gateway's shared credential, which is far stronger than the analyst who asked. Establish whose authority the call ran under, and rebuild the permission model so it runs under the requester's.
A retry loop becomes a paid indicator sweep and nothing in the architecture bounds it. Work out where the spend went, cap it without blinding the fleet, and say which work you are willing to lose first.
The in-house alert reader no longer matches the digest the SOC pinned, and nobody re-reviewed it. Establish what changed, what the new build can reach, and whether it may keep running while you find out.
A rebound name reaches the loopback-bound MCP server, and the Origin header claims to be the gateway. Show how the request got in, and fix the server so a name it does not control cannot speak for the fleet.
One shift brings a squatted namespace, an injected report, a persistent note and a site-wide isolation. Work all four, decide which agent actions stand, and file the shift record that says what you allowed and why.
You are building rather than supervising. Author a read-only lookup tool, write its manifest, and run the adversarial suite against your own work until it holds.
You are handed the manifest with instructions hidden in its description and told to make it shippable. Remove what makes it unsafe, keep the capability the SOC asked for, and prove the difference with the suite.
A tool has to fetch remote content, which means an attacker gets to choose part of its input. Build it so it still cannot be steered at the range's own network, and show the test that would have caught you.
The fleet holds a single user token minted for the SIEM, and every other resource accepts it too. Establish what that one token can reach, and rebuild the issuance so a token is only good where it was meant to go.
Metadata discovery for a newly announced MCP server redirects twice and lands on the cloud metadata address. Follow the redirects, say what was exposed, and constrain discovery so it cannot be pointed inward.
The notes server treats a sequential case id as a capability, and the neighboring tenant's case is one decrement away. Prove the exposure, size what was read, and fix the authorization rather than the numbering.
An executive brief is drafted from the raw case file and posted to a third-party summarizer, canary token and all. Establish exactly what left, who it reached, and what the agent should have been allowed to send.
The auto-summary asserts lateral movement, the chain behind it has a hop nobody can name, and the response agent is sizing containment on that claim. Find the missing hop and decide what the evidence really supports.
A third-party server raises a prompt claiming to be the in-house SIEM and asks the analyst for a password and an MFA code. Catch it in the moment, then remove the path that let an outside server speak in your own product's voice.
A community enrichment server refuses the sandbox, asks for the whole filesystem, and starts a shell to do its lookups. Decide whether it runs at all, and write the confinement the next server has to accept.
Nobody edited the registry entry. The vendor promoted an unsigned release candidate underneath it and it picked up a new capability on the way. Establish what is running, what it can now do, and how the change got past review.
Someone stood up an MCP endpoint on the collector host, it answers discovery, and the fleet starts using it because it is faster. Find every agent that adopted it, and make discovery something the SOC grants rather than something a host claims.
Both chairs in one sitting. Ship a containment tool that survives the adversarial suite, then run a full shift with that tool live in the fleet and answer for what it does.
A server raises a sampling request under a trusted server's name, asks the analyst for a model key, and carries secret case content out with the completion. Stop it, then rebuild the sampling path so neither the key nor the case can travel.
A new enrichment agent is being stood up by copying an existing agent's role. You decide what it may hold, prove it at least privilege, and certify it — or refuse it.
Two configurations of the same agent work the same alerts. One is visibly faster. You measure both properly and recommend one.
An agent has written a detection rule and wants to push it, and the diff reads like every other diff. One version of it takes the estate off the network. Review the change and decide, on the diff alone, whether it ships.
Three analysts work a live queue while four agents run unattended behind them, and one agent does something nobody asked for. Run the shift, catch it before it lands, and account for every automated action at the end.
A case of the class you have been supervising arrives with the agent taken away. Nothing summarizes the alert and nothing recommends an action, so you work it unaided and are graded on the same rubric.
The same build problem as the tool-safety track, with no assistant writing the spec for you. Author the tool, its manifest and its tests unaided, and hold the same bar the supervised version was held to.
The search index is behind the live estate, so every answer the agent reads describes a world that has already moved on. Spot the staleness from the evidence itself, and decide what can still be concluded from it.
A downstream credential expired overnight, and the tool now answers with an authorization error. Work out whether that means quiet or blind, and decide what the run is allowed to conclude while the tool is down.
The third-party intelligence provider returns server errors for the whole shift, and half the usual workflow depends on it. Keep the queue moving, and mark clearly which calls rest on evidence you could not get.
The account hits its per-minute ceiling partway through the shift, after several calls have already succeeded. Recognize the partial picture for what it is, and choose which remaining calls are worth the budget.
A policy published mid-shift now requires approval for a call the agent has been making all night. Catch the change, decide what happens to the actions taken before it, and bring the run back inside the rules.
Another analyst edited the same case while the agent was working it, and the write comes back as a conflict. Reconcile the two versions without losing either analyst's finding, and say which facts the case now rests on.
A tool server runs without a sandbox and quietly acquires reach it was never granted, while the policy under it changes mid-case. Contain it, then separate what the agent found legitimately from what it should never have seen.
A read comes back carrying a second tenant's records, at the same time as a credential in the chain stops working. Stop the case, size the exposure, and report it before you resume any analysis.
An agent loop burns through the month's spend ceiling in an hour, and the answers it is paying for keep coming back truncated. Cut the spend, and decide which of the conclusions already drawn on truncated output still stand.
Host-level ground truth: patch state, exploitation preconditions and the machine behavior every detection above it depends on.
The resolver ns1 was excluded from the last two maintenance windows. Establish what is actually installed, what the sources offer, and bring the affected component to the fixed version without taking name resolution down.
A previous engineer pinned a package during an outage and never released it. The weekly upgrade job reports success every week while the advisory stays open. Explain the gap and close it.
app2 has reported 'no updates available' for six weeks. The advisory for its TLS library is still open. Work out why the machine cannot see the fix, restore a working source, and remediate.
ns2 was upgraded during the window and name resolution stopped. The change is correct. The configuration is not. Complete the patch and get the service healthy again without rolling back.
srv-legacy still runs Debian 11. The weekly job reports no upgrades for the resolver even though the advisory is open, because the mirror it points at was retired and the LTS security source was never enabled. Get the resolver to the fixed revision.
ns3 is a RHEL 9 resolver with an open advisory. An earlier attempt left an SELinux denial in the audit log and a suggestion in the ticket to just set SELinux permissive. Patch it properly instead.
A Windows file server shows the fixed build in the console, yet the scanner still reports it vulnerable. Determine which version is actually loaded and finish the job properly.
The inventory agent on WKS-114 must move to the 5.x branch. The 5.x installer is a major upgrade with a new ProductCode, and the previous engineer's habit of uninstalling first loses the agent configuration. Do it properly.
The reader on WKS-207 needs its security update. Two sources offer something called Lumen PDF Reader, and only one of them is the product this machine actually has installed. Patch the real one.
Range Guide
Ask or talk about the labs — I'll suggest where to start.
Tell me your experience level and what you want to get better at — brute force triage, beaconing, lateral movement, exfil — and I'll pick a lab and launch it for you.
Human-in-the-loop oversight of AI security agents — catch hallucinated evidence, scope drift, bias and prompt injection, then hold the line with a moody virtual team.
Ten short agent outputs, each carrying one classic failure artifact, from hallucination and drift to bias, scope error, blast radius and injection, plus one that is simply correct. Build the vocabulary the rest of the Optiv path assumes.
You join the day shift of an MSSP tenant mid-stream. A triage agent fleet closed 30 cases overnight and the client reads them this morning. Some of those closes will not survive contact with the evidence. Nobody will tell you how many.
Sixteen overnight cases, four of them wrong, and the reason they are wrong is the same reason: each inherited the conclusion of the one before it. Find the origin and unwind the chain.
An adversary is writing to your triage agent, not to you. Instructions embedded in log fields and file metadata are closing true positives, and a decoy flood is eating the review budget. Recognize it, halt it at the right scope, and scope the campaign.
A tuning agent opened a pull request against three detection rules and the auto-merge agent approved it. You own the merge gate: read the diffs, replay the suite on main and staging, resist the bypass, and write the gate finding.
Twelve runs of one enrichment → containment → remediation workflow. Most are healthy. Find the race, the lost context and the bypassable checkpoint from the traces, including one run where two defects interact, then rewrite the handoff contract and arbitration rule.
Three quarters of agent actions, three executives who want different things, and one artifact to produce. Build the authority matrix that says which actions an agent may take alone, which need approval, and what evidence threshold each one carries.
The regulator wants an account of every autonomous action taken on 21 August. You have the fleet's own action log, a second dataset from the identity platform, and a fleet self-review that finds nothing wrong.
At 10:41 the fleet isolated a payments gateway and card transactions stopped for nineteen minutes. Counsel, the client's risk officer and your own team are in the room. You run it.
A planted intel advisory taught the enrichment agent that an attacker's range was a friendly scanner. For nine days the fleet closed its alerts as benign. You command the response with the team room.
File servers at fourteen branches encrypted overnight and the recovery agent is already restoring from last night's backup. You command the response with a five-seat team: recover safely, rule on the ransom and tell the right people.
Six thousand alerts, two analysts, an agent fleet with degraded confidence, and an executive who wants a number. You will not review everything. You are graded on how you choose what not to review — and on whether the real incident hiding in the flood gets found.
A relationship manager who resigned yesterday synced 3,900 client files to a personal drive and printed the contact sheets after hours. You lead a four-seat team with HR, legal and forensics: preserve the evidence, act proportionately and keep the process fair.
A trusted vendor's signed update for the branch queue software carried a backdoor, and the patch agent has already installed it at eleven branches. You command a four-seat team: stop the spread, cut the vendor's access and work out who else is hit.
A developer's cloud key sat in a public code repository for four days before someone used it to launch mining servers and read customer statements. You command a three-seat team: cut off the key, keep the evidence and decide who must be told.
You are on oversight duty for three agents at once, across triage, enrichment and response, with time to review about half their output. Decide where the review hours go, work the cases you chose, and defend the rotation you set.
The client has been told the triage fleet is accurate and wants that number defended before renewal. You label a sample of last month's closed cases as analyst ground truth, design the test set the sample belongs to, and report what the measurement actually supports.
An intrusion is live, you are the only analyst on shift, and the fleet is capacity you have to spend. What you task it with, how tightly you bound each task, and what you keep for yourself decides how much of the next hour you get back.
Optiv custom scenario · delivered on the Cybrary Range Engine
CYBRARY