Skills portal

What you have proven, and what to do next

A technique counts here only when the run that carried it passed — opening a lab proves nothing. Everything below is derived from your graded attempts across the SOC, ransomware, governance and adversary tracks.

For the runs that fell short, the remediation plan reads each debrief and orders what to re-run.

Running an exercise for other people? Learn how to pause a run, throw an event in, and start the clock again.

Loading your record…SeatAll learning paths →

Pass rate by track

6 of 6 labs passed on the latest attempt (100%), best score 91%.

Ransomware resilience6/6 passed · 100% · best 91%

ATT&CK coverage

13 techniques proven by labs you passed.

T1003.003T1021T1078T1078.002T1136T1485T1486T1489T1490T1558.001T1562T1567T1657

NICE work-role coverage

Incident Response4/6 capabilities · 67%
Digital Forensics1/2 capabilities · 50%
Threat Analysis1/5 capabilities · 20%
Cybersecurity Policy and Planning1/5 capabilities · 20%
Security Control Assessment1/9 capabilities · 11%
Defensive Cybersecurity0/5 capabilities · 0%
Vulnerability Analysis0/5 capabilities · 0%
Systems Authorization0/1 capabilities · 0%

Where you are on each path

Ransomware resilience: detect, contain, recover — 6/21 steps (29%)
Currently in 0 · Basics (0/2). 660 minutes remaining.
Governance & audit: control, evidence, decision — 1/11 steps (9%)
Currently in 1 · Controls and evidence (0/3). 420 minutes remaining.
SOC analyst: query to automation to capstone — 0/15 steps (0%)
Currently in 1 · Query fluency (0/5). 695 minutes remaining.
Detection assurance and recovery — 0/6 steps (0%)
Currently in 1 · Pipeline foundations (0/3). 300 minutes remaining.
AI security: the agent inside your SOC — 0/30 steps (0%)
Currently in 1 · Basics: how an agent gets used against you (0/3). 1285 minutes remaining.
Generative attack: the shift an adversary writes for you — 0/23 steps (0%)
Currently in 1 · The queue turns hostile (0/3). 965 minutes remaining.
Cyber defense: the SOC an agent works in — 0/12 steps (0%)
Currently in 1 · Ground truth first (0/2). 540 minutes remaining.
Adversary craft & systems: the host under the detection — 0/9 steps (0%)
Currently in 1 · Ground truth on one host (0/2). 225 minutes remaining.
Protocol analysis: filters to the plant floor — 0/6 steps (0%)
Currently in 1 · Filters and streams (0/1). 215 minutes remaining.

Replay the SOC operations path

Plays every step of the path against the live telemetry ingest — hunt queries, SOAR playbooks and assurance checks — so you can see what a clean run looks like before you sit it.

Replay the generative-attack shift, phase by phase

The same phase runner the instructor console grades with. Play it yourself first: each phase boots its labs headlessly under the reference policy and reports whether the shift held.

Your study plan

qr-01-hunt-the-wireHunt: the wire25 minStart →
Next unlocked step on a path you are 29% through. Stage: 0 · Basics.
Newly proves: Telemetry querying.
sec-101The management port that came back40 minStart →
Next unlocked step on a path you are 9% through. Stage: 1 · Controls and evidence.
Newly proves: Audit and control evidence, Control assurance.
ag-tool-poisoningThe helpful new tool35 minStart →T1195.002 T1554
Opening step of a path you have not started yet. Stage: 1 · Basics: how an agent gets used against you.
Newly proves: AI and agent security, Control assurance.
dr-101Truth, reach and align30 minStart →
Opening step of a path you have not started yet. Stage: 1 · Pipeline foundations.
Newly proves: Control assurance.
lr-19-follow-the-packetsReps: Follow the Packets40 minStart →
Opening step of a path you have not started yet. Stage: 1 · Filters and streams.
Newly proves: Protocol analysis.
pl-101Baseline drift on the internal DNS resolver25 minStart →T1190 T1518 T1082
Opening step of a path you have not started yet. Stage: 1 · Ground truth on one host.
Newly proves: Vulnerability and patch assurance.