Simulators SOC, phishing and attack simulation training: Ten minutes a day, on decisions that actually cost something.
Three simulators, a fresh set every night. Triage an alert, call a verdict on a message, and place an attacker's move on the kill chain. Nothing is multiple choice for its own sake, and a confident wrong answer costs you points.
Repetition is the point. So is the scoring.
Analysts do not get better by reading more; they get better by making the same class of decision often enough that the pattern becomes obvious. The simulators exist to give you those repetitions without needing a real incident, and the rules are built so guessing is not a strategy.
A new set every night
The board resets at midnight. What you did not solve carries over, and only as many new items arrive as you cleared.
Wrong answers cost you
Each simulator awards up to ten points a day. A wrong call subtracts, with zero as the floor, so caution is worth something.
One is enough
Finishing any single simulator keeps your streak alive. Finishing all three in a day earns a bonus on top.
The set is fixed once you start
Questions do not shuffle underneath you. Start when you are ready, and the day's set stays as it was.
SOC Simulator
An alert lands. You decide what it is worth: report it, dismiss it as a false positive, or close it. The decision most analysts get wrong is not the scary one, it is the boring alert that turns out to matter.
- Reporting is only right if it is a real threat and the severity is right. Flagging everything as critical scores the same as missing it.
- False positive is only right when it genuinely is one. Dismissing a live threat is the most expensive mistake in the set.
- Closing is never right. There is always a call to make, and refusing to make it is itself an answer.
Phishing Simulator
A message in front of you, and one question: is this phishing or is it legitimate? Headers, sender behaviour, link structure and pretext all point somewhere, and plenty of legitimate mail looks alarming at first glance.
- The verdict is what counts. Only your call is scored, so you cannot earn points by listing indicators without committing.
- Extraction is still practice. Pulling out the indicators trains the habit even though it does not move your score.
- Legitimate messages are in the set. If everything looked like phishing, the exercise would teach you nothing.
Attack Investigation Simulator
A scenario unfolds one step at a time. For each observed move you name the kill-chain phase and the MITRE ATT&CK technique behind it. This is the language every report you will ever write is expected to use.
- Both halves have to be right. The phase alone or the technique alone does not score. Getting one and guessing the other is still a miss.
- Scenarios run in sequence. Steps belong to a campaign, so the earlier moves inform how you read the later ones.
- Framework fluency, not memorisation. The aim is recognising behaviour and reaching for the right technique, the way you would mid-incident.
Where the simulators fit
Learning paths build the knowledge, labs give you the long-form investigation, and the simulators keep the reflexes sharp in between.
You keep the reps up
Ten minutes before standup is enough to keep triage and attribution instincts from going stale.
You see the pattern
Points and streaks show which class of decision you keep getting wrong, not just how much you played.
You use it under pressure
The same judgment carries into missions and Arena duels.
Questions
How long does a day take?
Around ten minutes for one simulator. The daily set size is tuned so it fits into a coffee break rather than an evening.
What happens if I miss a day?
Nothing is lost. Unsolved items carry over instead of disappearing, and your banked points stay yours. Only the streak resets.
Do I need to be working in security already?
No. Free accounts get daily simulator runs, and the learning paths that explain triage, phishing analysis and ATT&CK sit alongside them.
Why do wrong answers subtract points?
Because in the job they do. Scoring that only rewards correct answers teaches you to guess; scoring that punishes a confident mistake teaches you to check.
Start today's set.
Create an account and run your first day. The simulators are part of the free tier, so there is nothing to decide before you try them.