Browse the full catalog of hands-on environments.
Attack a running workload, watch the default Falco rules miss part of it, then write and tune custom rules that catch the behaviour without burying you in noise.
Give each service a cryptographic identity, enforce mTLS between them, and confirm that an unidentified workload on the same network is refused rather than trusted.
Express your security standards as admission policies, test them against manifests that should pass and manifests that should not, and roll them out in audit mode before they start blocking deployments.
Escalate from a limited service account to cluster-admin through over-granted RBAC verbs, then rewrite the roles and prove the same path is closed.
Break out of a deliberately misconfigured container to reach the host, then apply the runtime and admission controls that make the same escape fail.
