RolesRole: security analyst
Practise triaging a security alert, start to finish
Is the alert real? What's affected? What do you contain first, and what evidence must you keep? Practise the analyst's calls in a simulated company.
- Runs in
- A web browser, 3D included
- One exercise
- 20 to 55 minutes
- Practice levels
- Six, from worked example to exam
- Working tools
- 2 used in these exercises
A real exercise
The pager fires: a finance laptop is talking to a suspicious server, and a shared account has odd sign-ins. You take ownership, disable the account, isolate the laptop and block the address, without touching the healthy systems, then report to the security lead.
How it works
Every exercise follows the same rhythm as the real job: a problem arrives, you investigate, you act, and the simulated company responds.
- 01
An alert arrives
Among the noise, one looks serious.
- 02
Triage
Check the details, the context and the affected systems.
- 03
Contain
Isolate what's affected while keeping the evidence.
- 04
Report
Explain what happened and what you did.
What you practise
Concrete tasks taken from the exercises on this page. Each one is done with real data, under real constraints, inside the same simulated company.
- T01
Alert triage
Separate real threats from false alarms.
- T02
Containment
Stop the spread without destroying evidence.
- T03
Clear reporting
Updates the rest of the company can act on.
What you get
Experience you can point to.
- 01
Practical security skills
Hands-on practice to go with certifications and coursework.
- 02
Sound judgement
When to act fast and when to look closer.
The tools you work with
Working tools, not screenshots. They read the same live data as the rest of the simulated company, and what you change in one shows up in the others.
- 01
Security alerts
Alerts, accounts, endpoints and signs of compromise in one view.
- 02
Incident console
The live state of services and hosts during an outage, with the runbook actions.
Six levels, one exercise
Start by watching it done, then take the hints away one step at a time until you can do it alone.
- L1
Watch it done
The exercise solved step by step, with what each step changed.
- Hints
- Read only
- Graded
- No
- L2
Step by step
The next move is pointed out, every hint is open, goals update as you work.
- Hints
- All hints
- Graded
- Yes
- L3
With hints
Every hint is open, but finding the next step is up to you.
- Hints
- All hints
- Graded
- Yes
- L4
On your own
Hints stop short of the worked answer. Goals still update as you go.
- Hints
- Some hints
- Graded
- Yes
- L5
Exam
No hints and no AI helper. Results appear only after you submit.
- Hints
- None
- Graded
- Yes
- L6
Free play
An open what-if sandbox. Try anything; nothing counts towards a grade.
- Hints
- All hints
- Graded
- No
A debrief after every attempt
You see what went well, what did not, and what a stronger approach looks like, based on what you actually did.
Every action, in order
What was checked, who was asked, what was changed and when. Nothing is overwritten.
Scores by skill
Each exercise scores the skills it was built to test, from what was actually done.
Weak habits, flagged
Poor patterns in how the work was done are flagged, not only wrong final answers.
A replay of the attempt
Step through the session as it happened, with typed personal details masked.
- An alert arrives
- Triage
- Contain
- Report
Is this a hacking lab?
No. It practises the defender's job: reading alerts, making decisions and containing incidents, not attacking systems.
Who is it for?
Students of cybersecurity and IT, and people moving into a security operations role.
Related
Ready to try it?
Create an account and start your first exercise. It runs in your browser.