Learn to read the traces. Practise catching the attacker. Measured, not assumed. Logs in the real formats your analysts will meet, exercises graded on what they find, bilingual Vietnamese and English, and an on-prem edition that runs with no internet connection.
Pilot for SOC teams, quoted per organisation. Fully simulated — it never touches a real system.
13 modules, 26 lessons, 44 graded hands-on tasks — about 11.5 hours. Each task passes only when the command runs and its output contains the evidence sought.
604 labs built from the CISA Known Exploited Vulnerabilities catalogue (release 2026.06.12, 604 of 1,619 entries mapped), plus a terminal that behaves like bash and PowerShell, with Tab completion.
13 exercise courses on your network map, an analyst console with filters and keyboard shortcuts, investigation questions, and an after-action report you can print.
A purple mode where a human red team chooses moves from 84 ATT&CK techniques and the blue team’s containment really blocks them. Team rosters and a live competition board for events.
Real log formats: sshd, Windows Security and System, Sysmon, Suricata, Squid, BIND, nginx, Fortinet and Cisco ASA. No line announces that it is suspicious — analysts have to read it.
The answer never leaks: not in the wording, not in the severity colour, not in the API. We measured it on 2,562 generated lines: judging by colour alone is right 85% of the time, while simply marking every line benign is right 86%.
Exercises run on the network map you draw. A step that no sensor sees is shown as a blind spot of the infrastructure, not counted against the team.
Ships as an add-on to the VCyber Twin installer: on-prem, offline, Vietnamese and English — for banks and agencies whose data cannot leave the building.
Not a library of real virtual machines, disk images or memory dumps. Evidence is simulated text in real formats.
No exploit code. Attacks are moves inside the model; what you see is what defensive sensors would record.
Smaller than the large online platforms. We are building depth on defence, starting with Windows, Active Directory and email.
The hosted edition for individual learners is not open yet. Today we run pilots with teams.
We set it up on your network map, run an exercise with your analysts, and hand you the after-action report. Write to support@atkvn.com.