· Cybersecurity Range marketplace · 41 scenarios

The Forge

The Forge is the marketplace for DecipherU cybersecurity Range scenarios. Browse the full catalog below and play any scenario your tier supports. Operator tier ($129/mo) plays scenarios beyond the 20-per-month base allowance from the Forge. Frontier tier ($299/mo) can also submit scenarios for editorial review against the public rubric and publication.

Defender

5 starter scenarios per month. Forge browse only above the cap.

Operator (recommended)

20 scenarios per month plus full Forge browse.

Frontier

Unlimited Range with AI adversary mode plus Forge contribute.

Compare cybersecurity tiers →

Real CVE + advisory refs

Each scenario is anchored on a real CVE, CISA advisory, or breach pattern. No abstract "hack the website" prompts.

Multi-phase response

Detection, containment, eradication, recovery, lessons learned, graded on each phase, not just whether you found the flag.

Career-mapped

Each scenario tags the cybersecurity role it most rewards: SOC, IR, threat hunter, GRC, AppSec. Your score becomes role-specific evidence.

AI adversary mode

Frontier tier scenarios run an LLM-driven adversary that adapts mid-incident. Closer to a real engagement than a static scoring rubric.

cybersecurity

beginner · incident response

Adversarial Examples: Image Classifier Under Attack

Contribute a scenario

Frontier tier subscribers can submit a Range scenario for editorial review against the public rubric. Approved scenarios publish under the contributor's byline with a Frontier credit and are added to the Forge for all tiers to play. The review window is 14 days; the bar is original writing, MITRE ATT&CK technique mapping, and a documented scoring rubric.

Email a scenario draft →

Self-serve contribution UI ships in a future Range release.

Last verified: April 2026?Report an inaccuracy

Get cybersecurity career insights delivered weekly

Join cybersecurity professionals receiving weekly intelligence on threats, job market trends, salary data, and career growth strategies.

By subscribing you agree to our privacy policy. Unsubscribe anytime.

cybersecurity

Triage the SOC: A Phishing-Borne Incident

Hunt the Beacon: Detect Cobalt Strike in Network Telemetry

Cloud Misconfiguration: An Exposed S3 Bucket

Reverse the Dropper: Static Analysis of a Loader

The 3am Page: Ransomware in Production

AI-Augmented SOC Triage: Twelve Morning Alerts

LLM-Assisted Incident Investigation: Multi-Stage Intrusion

AI Detection Rule Review: Ten ML Rules, Ship Iterate or Kill

AI SOAR Playbook Design: LLM-Driven Phishing Response

AI Security Copilot Selection: Pick Between Three Vendors

LLM-Assisted Threat Intel Correlation: Four Vendor Reports

AI-Assisted Phishing Triage: Six Reported Emails

Endpoint Anomaly Investigation: LLM Process-Tree Summarization

Credential Stuffing: ML Behavioral Model Tuning

Lateral Movement: AI-Powered Graph Analysis of Identity Logs

Privilege Escalation: AI Triage of Token-Theft Alerts

Data Exfiltration: AI Baseline Detection on Cloud Egress

Ransomware Indicator Clustering with an LLM

Threat Hunting: AI-Assisted Hypothesis Generation

Vulnerability Prioritization: EPSS Plus AI Context

Malware RE: AI Summarization of Decompiled Functions

Insider Threat: Behavioral Anomaly Review with AI

Compliance: AI Search for ISO 27001 Evidence Collection

Prompt Injection Detection: Classify Eight Inputs

AI Red Team Defense: Defend a Production LLM Under Attack

AI Eval Set Design: Catch Harmful Outputs Before Production

EU AI Act Applicability: Classify Five AI Deployments

AI Infrastructure Secret Protection: Diagnose Pipeline Leakage

AI Risk Assessment: Healthcare Diagnostic Model Sign-Off

Direct Prompt Injection: Build the Defense Stack

Indirect Prompt Injection: Document-Upload Attack Path

Insecure Output Handling: XSS via LLM Response

Training Data Poisoning: Detect and Mitigate

Model Denial of Service: Long-Context Resource Exhaustion

AI Supply Chain: Compromised Model from HuggingFace

Sensitive Disclosure: PII Leakage Through LLM Completion

Insecure Plugin Design: Agent Tool Authorization

Excessive Agency: Autonomous Agent Acts Without Authorization

Overreliance: Analyst Trusts AI Output Without Verification

Model Theft: Extraction Attack via Public API

Adversarial Examples: Image Classifier Under Attack

Contribute a scenario

Get cybersecurity career insights delivered weekly

cybersecurity

Triage the SOC: A Phishing-Borne Incident

Hunt the Beacon: Detect Cobalt Strike in Network Telemetry

Cloud Misconfiguration: An Exposed S3 Bucket

Reverse the Dropper: Static Analysis of a Loader

The 3am Page: Ransomware in Production

AI-Augmented SOC Triage: Twelve Morning Alerts

LLM-Assisted Incident Investigation: Multi-Stage Intrusion

AI Detection Rule Review: Ten ML Rules, Ship Iterate or Kill

AI SOAR Playbook Design: LLM-Driven Phishing Response

AI Security Copilot Selection: Pick Between Three Vendors

LLM-Assisted Threat Intel Correlation: Four Vendor Reports

AI-Assisted Phishing Triage: Six Reported Emails

Endpoint Anomaly Investigation: LLM Process-Tree Summarization

Credential Stuffing: ML Behavioral Model Tuning

Lateral Movement: AI-Powered Graph Analysis of Identity Logs

Privilege Escalation: AI Triage of Token-Theft Alerts

Data Exfiltration: AI Baseline Detection on Cloud Egress

Ransomware Indicator Clustering with an LLM

Threat Hunting: AI-Assisted Hypothesis Generation

Vulnerability Prioritization: EPSS Plus AI Context

Malware RE: AI Summarization of Decompiled Functions

Insider Threat: Behavioral Anomaly Review with AI

Compliance: AI Search for ISO 27001 Evidence Collection

Prompt Injection Detection: Classify Eight Inputs

AI Red Team Defense: Defend a Production LLM Under Attack

AI Eval Set Design: Catch Harmful Outputs Before Production

EU AI Act Applicability: Classify Five AI Deployments

AI Infrastructure Secret Protection: Diagnose Pipeline Leakage

AI Risk Assessment: Healthcare Diagnostic Model Sign-Off

Direct Prompt Injection: Build the Defense Stack

Indirect Prompt Injection: Document-Upload Attack Path

Insecure Output Handling: XSS via LLM Response

Training Data Poisoning: Detect and Mitigate

Model Denial of Service: Long-Context Resource Exhaustion

AI Supply Chain: Compromised Model from HuggingFace