Cloud incident response, practised
The attacks moved to the cloud. Train where they are.
Most responders learned on Windows servers and network captures. Today the intrusion is a legacy protocol nobody disabled, an application permission nobody reviewed, and a mailbox rule nobody saw. Invictus Academy stages those incidents in Azure, Microsoft 365 and AWS, and puts you in front of the evidence they leave.
- Detection and response times, measured every run
- Every run leaves a sealed forensic case
What you work on
Three kinds of lab, one range
The kind decides what your afternoon looks like: reading captured evidence, querying a cloud workspace in the Azure portal, or answering for points.
Investigation
A staged incident, already captured. Read the sign-in logs, the audit trail and the mailbox records, decide what is the attack and what is a Tuesday, then contain it. Your time to detect and to respond is measured from the moment you start.
Cloud console
A staged incident's logs in a real Azure workspace. Open it in the Azure portal, query it with KQL and answer the lab's questions as you go. You read the data and change nothing.
Challenges
A set of questions with exact answers, over evidence you download or in a cloud console you open from the lab. Points per flag, a written finding at the end, and a scoreboard when a room runs it as a competition.
Before you start
Every lab tells you who you are up against
Not a difficulty pill and a duration. The adversary, and the tradecraft you will practise finding. This is a real entry from the catalogue.
Tenant takeover at Meridian Freight
An intruder with a valid password and a legacy protocol, inside a tenant that believed it had MFA
You will practise
- Legacy authentication defeating a second factor
- Application permissions that outlive a password reset
- Telling a mailbox reached from a mailbox read
- Lookalike domains and the mail rules that feed them
About 2 hours
That lab ships with four artefacts and 2,300 sign-in records, and the intrusion is buried in a fortnight of an ordinary company’s ordinary work. Fourteen questions, each answerable from the evidence and from nothing else.
What a lab teaches is written by its author, and deliberately kept apart from the answer key. Knowing you will practise spotting legacy authentication does not tell you which of two thousand sign-ins is the one.
While you work
Four things happen, every run
You detect
Find the incident in the evidence, and flag what is actually part of it.
You respond
Choose the containment a responder would choose, and write up what you found.
It is measured
Time to detect, time to respond, what you missed and what you flagged that was ordinary.
It is sealed
The evidence you worked is acquired into a forensic case with a hash-chained custody log you can export.
Why you can trust the numbers
Including where they stop
Content you can trace
A lab ships as one checksummed bundle, signed by its publisher. The platform verifies the signature on the way in and names who published it. A signature proves where content came from; it does not pretend to make it safe, and the sandbox is a separate guarantee.
Records anyone can check
Take part and you get a record you can hand to somebody. They can check it here, without an account, and see that we produced it and that nobody has edited it since.
Built in the EU, for the EU
Delivered by Invictus Incident Response in the Netherlands with Computer Forensics Lab in Ukraine, under an NL-UA cyber-security programme. Ranges run in EU regions.
Where they stop
- A facilitated exercise runs on one shared environment, so it produces no per-person measurement. We say so on the page rather than inventing one.
- Written findings are read by an instructor, never scored. A number on a piece of prose would be a number we made up.
- A forensic case is tamper-evident for training. It is not court-admissible, and we will not tell a customer that it is.
Built by responders who work these incidents for a living.
Invictus Incident Response, Amsterdam, with Computer Forensics Lab in Kyiv. A cyber range for the cloud attacks that are actually happening, delivered under an NL-UA cyber-security programme.
Put your team in front of it
Tell us how many responders you have and what they need to be better at, and we will come back with a plan and a price. If you already have an account, start where you left off.