Cyber labs
Training environments built for your security team
We design and run isolated lab networks where your team practices defense and response on realistic infrastructure, then reset them to a clean state for the next session.
DMZ
- Web services
- Public APIs
Internal network
- Servers
- Workstations
Monitoring
- SIEM
- Network capture
All activity logged · resets to a clean state after the session
Inside a lab
A realistic network, completely separated from yours
Each lab mirrors the shape of a real company network: a perimeter, a DMZ, an internal network and monitoring. It runs in isolation, so your team can practice without touching live systems.
- Designed around your own architecture and tools
- Separate environments for each team or participant
- Runs on InfraLedger, on our hardware or on yours
Lab types
Start from a template, or build something custom
Every lab is tailored to your team's level and the skills you want to build.
Perimeter defense
Practice firewall rules, network segmentation and VPN access on a realistic company network.
Web application protection
Configure and tune a web application firewall against realistic traffic, without risk to live services.
Red team vs. blue team
One team works within an agreed scope while the other detects and responds, with a debrief at the end.
Detection engineering
Build and test SIEM detections and dashboards on telemetry generated inside the lab.
Incident response drills
Run a timed scenario from first alert to containment, and review how the team handled it.
Training events
Capture-the-flag style challenges for training days, onboarding or recruiting.
How it works
From first call to a clean reset
- 01
Scope
We agree on goals, participants, skills to practice and rules of engagement.
- 02
Build
We build the lab network, services and scenarios to match your environment.
- 03
Run
Your team connects over VPN. Every action in the lab is logged.
- 04
Reset and report
The lab is rebuilt to a clean state, and you receive a session report.
After every session
A report your team can learn from
What happened, when it was caught, what went well and what to practice next. The lab is then reset to a clean state.
Web application protection, Team Blue
Timeline
- 09:00Briefing and rules of engagement
- 09:30Scenario starts on the lab network
- 10:12First detection: injection attempts on /login
- 10:40WAF rule tested, then deployed
- 11:40Incident contained and documented
- 12:00Debrief, then the lab is reset
Went well
- Detection 42 minutes after the scenario started
- WAF rule tested before going live
To practice
- Escalation path to the on-call lead
- Collecting logs from every server
Safety
Safe by design
Labs are built for authorized training only, with safeguards at every layer.
Fully isolated
Each lab runs on its own network with no route to the internet or your production systems.
Controlled access
Participants connect with individual VPN credentials that expire when the session ends.
Everything recorded
Activity in the lab is logged, so sessions can be reviewed and debriefed.
Written scope
Every engagement has an agreed scope and rules of engagement before anyone connects.
Clean resets
Labs are rebuilt from a known state between sessions, so every team starts the same.
Torn down after
When the engagement ends, the lab and its data are removed.
Plan a lab for your team
Tell us who will train and what they should practice, and we'll propose a lab.