Practice through safe, story-driven simulations — pick a Technical track challenge or a GRC track challenge below. Each one teaches skills professionals use daily.
Hands-on defense and attack-analysis skills — recon, phishing, passwords, and injection.
Great starting points with clear steps and quick wins.
Spot the red flags in a simulated email. Learn how to avoid falling for phishing scams.
Start ChallengeReturn-Path: <alerts@secure-notice.example.com>
Received: from mail.secure-notice.example.com (203.0.113.55)
DKIM-Signature: none
SPF: softfail (sending IP not permitted)
Reply-To: support@secure-notice.example.co
Link in email: http://example-secure-login.co/verify
Analyze a simulated nmap scan. Identify risky open ports and what they mean for defenders.
Start ChallengeDig deeper into techniques and thinking patterns used by pros.
See how weak passwords are cracked. Understand why strong passwords matter.
Start ChallengeUse public sources to gather information ethically. Learn the basics of Open-Source Intelligence.
Start ChallengeCloser to real attack/defense flows. Read carefully and think like a defender.
Test a static vulnerable login form. Learn why strong input validation stops injection attacks.
Start ChallengeGovernance, risk & compliance skills — risk registers, vendor risk, policy analysis, and audit evidence review. No coding required.
Score a real-world risk scenario and decide whether to accept, mitigate, or escalate it.
Start ChallengeReview a vendor's security questionnaire and spot the third-party risk red flags before onboarding.
Start ChallengeCompare a draft Access Control Policy against a baseline checklist and find what's missing.
Start ChallengeTest a control against real offboarding-log evidence, decide pass/fail, and assign a finding severity.
Start ChallengeWe’re expanding both tracks with advanced labs, interactive tools, and career-path challenges. Stay tuned.
Back Home