Train cyber operations
in a fully simulated environment

You start with one address and nothing else. scan shows which hosts answer, nmap which services listen and in what version. From there you look for the weak spot: an outdated service, a password in a config file, a key left in shell history.

Every action leaves a mark. Scanning raises trace a little, a failed login more, a deleted log most of all. At 100% the identity burns: active contracts fail and you continue with a new one.

It is not a game of luck. Whether an exploit lands depends on the match between tool and vulnerability, on your skill level, and on the target's controls.

The other side of the same network. Attack events land in the SIEM as records, and correlation rules turn them into weighted alerts.

You get a real SOC's actions: isolate a host, block an address, kill a process, reset a password, close a port. Each has a cost — isolate the wrong host and you stop the business.

The debrief follows: a full timeline of who did what, when the alert fired, and how long the response took.

The competitive mode. Every participant gets structurally identical infrastructure in their own subnet — same services, same vulnerabilities, different passwords and addresses.

The first thirty minutes are for hardening only. Foreign infrastructure is untouchable. You patch what you find, rotate passwords, close ports.

Then attacks open. The map shows only addresses; the rest you work out yourself. Downing a service pays credits, downing all of an opponent's services eliminates them. While you attack, your own systems mail you about what is happening on your ground.

AI writes the prose, not the rules. Briefings, organisation and employee names, emails and incident write-ups are generated so no two playthroughs read the same.

Game logic stays entirely in the backend and is deterministic: the same seed gives the same world, the same vulnerability behaves the same way, trace is a formula.

The provider is swappable — OpenAI, Anthropic or a local Ollama. It can also be switched off entirely, and the text comes from a written set instead.

Each of the 37 skills has five levels. Every level is a lesson, exam questions and a lab in the platform's own terminal — solved with real commands against a simulated network. The path runs from the basics (networking, operating systems, databases, web protocols, cloud, scripting) through Red and Blue Team to specialisations.

Topics include Active Directory & Identity (domain, groups, Kerberos, GPO), Detection Engineering (Sigma and YARA rules, SIEM queries), Windows, containers and cloud, OT/ICS, reverse engineering and AI & LLM Security — prompt injection and assistant hardening in a simulated environment, with no real model.

The skills come with more than 90 short video lessons in Bulgarian and English: the terminal in the video shows real output from the simulation, and each ends with a question and a lab task. Certificates are issued once a level and its practice are complete; the higher levels sit in the higher plans.

The terminal is a custom interpreter. It hands nothing to an operating system, opens no socket, and resolves no name outside the generated networks.

Every virtual host has its own filesystem with permissions, its own users, processes and logs. cat /etc/passwd returns that host's file, not the file of the server the platform runs on.

The network is just as real on paper: subnets, routes, ACL rules, firewalls. Whether you reach DB01 depends on which host you pivot through and what the rule between them allows.

The trail is always somewhere. auth.log remembers failed logins, access.log the requests, firewall.log the blocked packets.

The task is to rebuild the chain: which address appeared first, which password worked, where it pivoted next, what it took out.

Deleting a log does not clear the trail — it leaves one of its own. A missing stretch of time is evidence in itself.