Lab Catalog
Hands-on environments you can spin up on demand. Browse freely; sign in when you want to start one.
21 labs
Search and filter
60m
Admission Policy as Code
Express your security standards as admission policies, test them against manifests that should pass and manifests that should not, and roll them out in audit mode before they start blocking deployments.
45m
Answering a Zero-Day with an SBOM
Generate SBOMs for a set of build artifacts and use them to answer, in minutes rather than days, which deployed services contain a newly disclosed vulnerable component.
45m
Catching Infrastructure Misconfiguration Before Apply
Scan Terraform for the misconfigurations that become public buckets and open security groups, fix them, and wire the scan into the plan stage where it blocks a merge.
60m
Container Escape and the Controls That Stop It
Break out of a deliberately misconfigured container to reach the host, then apply the runtime and admission controls that make the same escape fail.
60m
Custom SAST Rules That Catch What Defaults Miss
Write, test and tune your own static analysis rules against a vulnerable codebase, then judge them on false positives as well as on what they catch.
60m
Cutting Cloud IAM Down to Least Privilege
Find the over-permissioned roles in a cloud account, use access data to derive the permissions actually in use, and tighten the policies without breaking the workloads.
60m
DAST Against an Ephemeral Environment
Stand up a per-merge-request environment, run an authenticated dynamic scan against the running application, and turn the results into a pipeline gate that does not flake.
60m
Detection as Code with Grafana
Define alert rules and dashboards as version-controlled code, test them against replayed attack telemetry, and ship them through a pipeline like any other artifact.
90m
DevSecOps Incident Response Game Day
Run a live compromise of a pipeline and cluster end to end: detect it, contain it, evict the attacker, and produce the timeline and control changes that come out of it.
60m
Exfiltrating Secrets from a CI Pipeline
Run a malicious merge request that steals the pipeline's deploy token, then scope the secret to protected refs so an untrusted pipeline receives nothing while real deploys still work.
45m
Gating Builds on Vulnerable Dependencies
Add a dependency scan that fails a build on exploitable CVEs, then work through the upgrades, exceptions and expiry dates that keep the gate from being quietly switched off.
45m
Hardening a Container Image
Take a bloated application image that runs as root and rebuild it as a minimal, non-root, reproducible image, measuring the vulnerability count at every step.
60m
Kubernetes RBAC Privilege Escalation
Escalate from a limited service account to cluster-admin through over-granted RBAC verbs, then rewrite the roles and prove the same path is closed.
60m
Leaked Credential, End to End
A developer committed AWS credentials to the `payments-api` repository four commits ago, and the file is still tracked on the team's Git server. Detect the exposure with gitleaks, revoke the credential, purge it from every commit with `git filter-repo`, and discover that the remote is still dirty the moment that separates fixing your copy from fixing the exposure. You will finish by adding a pre-commit hook and a CI gate, then proving they work by trying to reintroduce a credential.
45m
Risk-Based Vulnerability Prioritization
Reduce thousands of raw scanner findings to the handful that matter, using exploitability, reachability and real exposure rather than CVSS score alone.
60m
Runtime Secrets Management
Move hardcoded application secrets into a managed secret store issuing short-lived dynamic credentials, and confirm that a stolen credential expires before it is useful.
60m
Runtime Threat Detection with Falco
Attack a running workload, watch the default Falco rules miss part of it, then write and tune custom rules that catch the behaviour without burying you in noise.
45m
Shift-Left Security Scanning with Trivy
Find hardcoded credentials, vulnerable dependencies and insecure infrastructure code in a real repository before any of it reaches production.
60m
Signing and Verifying Build Artifacts
Sign container images and provenance attestations in the pipeline, then enforce verification at deploy time so an unsigned or tampered artifact cannot run.
60m
Testing API Authorization
Exploit broken object-level and function-level authorization in a running API, fix the checks, and add the automated tests that keep the fixes honest.
60m
Workload Identity and Mutual TLS
Give each service a cryptographic identity, enforce mTLS between them, and confirm that an unidentified workload on the same network is refused rather than trusted.