Training
Step-by-step learning with theory, hints and hands-on practice in the environment. For employees and junior specialists.
IT-HUNTER's own platform
Cyber Range
Find out whether your team is ready for a cyberattack before one happens. Employees and specialists practice against real attacks in a safe copy of your company, and you get an objective assessment of how ready they are.
- workstations on site
- 30–40workstations on site
- ready-made attack scenarios
- 20+ready-made attack scenarios
- modes, from training to testing
- 4modes, from training to testing
- risk to your live systems
- 0risk to your live systems
What a cyber range is, in plain words
Pilots practice engine failures in a flight simulator, and firefighters practice in drills. A cyber range does the same for cybersecurity: we build a copy of your company and launch a real attack inside it. The team learns what to do, mistakes cost nothing, and management sees who handled it and how.
Knowing ≠ doing
A lecture shows what a person knows. An exercise shows what they will do when an attack is already under way.
Safe
Everything happens in an isolated copy. Real systems and data are not affected.
Measurable
Scores are based on what participants actually do, not on an instructor's opinion.
A copy of your infrastructure
The environment reproduces a typical organization, from the perimeter to the servers and the monitoring center. For custom exercises, we replicate your own infrastructure.
Internet
- Attacker
- Phishing domains
- Command-and-control server
Perimeter
- Firewall (NGFW)
- VPN gateway
- WAF
DMZ
- Website
- Mail server
Office
- Windows workstations
- Employee laptops
- USB devices
Servers
- Active Directory
- 1C
- Database
- File server
- Backup
Monitoring
- SIEM
- EDR / XDR
- DLP
- IDS
- NET HUNTER
The training network is isolated from your live network. No real data or accounts are moved into the environment.
How it works
- 1Assessment
We define who needs training and in what: roles, skill level and the threats typical for your industry.
- 2Training
Theory plus step-by-step tasks in the environment, with hints.
- 3Exercises
The attack unfolds in real time, and the team's decisions change its course.
- 4Measurement
A report: time to detect and respond, mistakes and recommendations.
Scenario catalog
More than 20 ready-made scenarios. Choose an audience and we'll show the ones that fit.
- BasicIndividual
Phishing email
An email "from accounting" with a link to a fake login page. Spot it and report it.
EmployeesT1566T1204 - BasicIndividual
Ransomware message
A ransom demand appears on the screen. What to do in the first minutes so you don't lose data.
Employees · IT teamT1486 - BasicIndividual
USB infection
A USB stick someone found runs a malicious file. Detect and isolate the infected computer.
Employees · IT teamT1091T1204 - IntermediateIndividual
Compromised account
Someone logs in as an employee from another country. Find it, block the account and end all sessions.
IT team · SOC and securityT1078T1110 - IntermediateIndividual
Server password guessing
Mass login attempts over RDP and SSH. Detect them in the logs and stop them.
IT team · SOC and securityT1110T1021 - AdvancedTeam
Attack on Active Directory
Credential theft and privilege escalation up to domain administrator.
SOC and securityT1003T1078.002T1484 - AdvancedTeam
Ransomware in the network
From a VPN login to an attempt to delete backups. Break the chain in time.
SOC and security · IT teamT1021.002T1490T1486 - IntermediateTeam
Attack on the database and 1C
An attacker tries to export the database. Detect it and protect the data.
SOC and security · IT teamT1190T1005 - IntermediateTeam
DDoS attack on the website
The website stops responding. Identify the type of attack and bring the site back.
IT team · SOC and securityT1498T1499 - IntermediateTeam
Insider data leak
An employee is taking the customer database. Stop it and collect evidence.
SOC and security · ManagementT1567T1052 - AdvancedIndividual
Security tool evasion
Malware switches off the antivirus. Detect it by indirect signs.
SOC and securityT1562 - BasicTeam
Crisis tabletop exercise
An attack has stopped the business. Management makes the decisions: communications, the regulator, recovery.
ManagementT1486
What an exercise looks like from the inside
This is a simplified copy of the range operator console. Pick a scenario, run it and make the call at the critical moment: your choice decides whether the attack is stopped or keeps going.
Scenario brief
Friday, 18:40. The accounting team has gone home. An attacker has logged in over VPN with a contractor account that has no second factor.
Environment
- Normal
- Under attack
- Compromised
- Isolated
- Encrypted
Scenario time--:--:--
Time to detect—
Score—
Hosts in environment7
Event log
- This is a simplified copy of the range operator console. Pick a scenario, run it and make the call at the critical moment: your choice decides whether the attack is stopped or keeps going.
What's inside the range
The environments run the same types of security tools that real companies use. Participants learn on real consoles, not on pictures.
Workstation protection
Network and perimeter
Monitoring
Data and access
Who it's for
Don't become the way in
Employees learn to recognize phishing, suspicious attachments and ransomware messages, and to report an incident the right way.
- Format
- Training mode, individual
- Result
- Fewer clicks on phishing links and faster attack reports
Assessment
Skills testing without hints and with automatic scoring. For staff and SOC certification.
Team
Participants play different roles in the same incident. Information handoffs, decisions and actions are all recorded.
Research
One scenario run with different security tools in an identical configuration. For selecting and testing products.
A report management can understand
After the exercise you don't get a simple "pass / fail", but a measurable picture of how ready your team is.
78Readiness index
- Average time to detect
- 18 min
- Average time to respond
- 24 min
- Critical mistakes
- 2
MITRE ATT&CK technique coverage
Initial access
Execution
Persistence
Credential access
Lateral movement
Impact
- Detected in time
- Detected late
- Missed
- L1 analyst82
- L2 analyst91
- Administrator64
- Shift lead77
The range runs on our own platform
Cyber Range is IT-HUNTER's own product: environments are deployed from templates, scenarios branch based on participants' actions, and the final score is calculated from recorded events. The platform can also be deployed in your infrastructure.
Technical detailsFrequently asked questions
Do we need to install anything on our network?
No. Exercises take place at the IT-HUNTER facility or in an isolated environment. If you prefer, the platform can also be deployed inside your infrastructure.
Can you replicate our infrastructure?
Yes. For custom scenarios we reproduce your workstations, servers, 1C, a copy of your website and the security tools you use.
Who scores the participants?
The final score is calculated automatically from the scenario rules and the recorded events. The AI module only explains mistakes and prepares recommendations.
Is it suitable for employees without technical knowledge?
Yes. There are separate basic-level scenarios for them: phishing, malicious attachments and ransomware messages.
Can we test a security tool before buying it?
Yes. In research mode, one scenario is run with different products and settings, so you can see what each of them detects.
What your organization gets
Employees see an attack in a safe environment, make decisions themselves and understand the consequences. You test staff readiness, evaluate your security tools and see what needs strengthening.
Request a demo