EXERCISE 01 / 8 MIN
The impossible sign-in
A new device, an unfamiliar network, and a successful login. Decide what the evidence supports before you act.
Evidence-based triageOpen the case ↗
✳ Hands-on / Browser-based / No setup
Make the call.
Then inspect the why.
Work with synthetic evidence, weigh the tradeoffs, and practice a defender’s next decision. No cloud account, terminal, or real targets required.
Open the case ↗
EXERCISE 02 / 7 MIN
Patch the right thing first
Three findings, a short maintenance window, and conflicting scores. Prioritize by exposure and consequence.
Risk prioritizationOpen the case ↗
EXERCISE 03 / 8 MIN
A smaller blast radius
A report service needs one narrow capability. Design permissions that still work when a component fails or is misused.
Permission designOpen the case ↗
THE NEXT EXPERIMENT
From a case to
a governed system.
Explore how a small Agentic SOC reference handles duplicate signals, missing evidence, human approval, and verification.
Try the IRIS starter ↗SIGNAL RECEIVED
EVIDENCE REQUIRED
APPROVAL BOUND TO ACTION
OUTCOME VERIFIED