Workshops
Learn it from the operators.
Small-cohort, hands-on training run by the operators who run your engagements. Built around real targets and real tooling, you leave with working notes, custom tooling, and a direct line to the operator who taught it.
The catalogue
Five workshops, run hands-on.
Each is taught against live labs, not slides, from deep technical attack paths to an executive tabletop for the boardroom.
5-day workshop
Advanced Active Directory Attack Paths
From a domain user to Tier-0 control, the way an operator does it today, AD CS abuse (ESC1 through ESC11), BloodHound edge inference, Kerberoasting variants, S4U2Self chains, and NTLM relay in modern hardened forests.
Who it's for: Pentesters and red teamers working in Windows and Active Directory environments.
4-day workshop
Business-Logic Web Attack
The bugs scanners cannot find. Race conditions, IDOR and BOLA chains, multi-step abuse, OAuth/OIDC misconfigurations, and refund/discount logic abuse, worked through on realistic e-commerce targets.
Who it's for: Application-security testers and bug-bounty hunters who want to go past the checklist.
3-day workshop
Detection Engineering, Reversed
Build Sigma rules from the attacker's side. Learn what gets logged, what doesn't, and which callbacks slip past default EDR rule sets, then close the gaps you just found.
Who it's for: Blue-team and detection engineers who want an attacker's view of their telemetry.
3-day workshop
Cloud Control-Plane Adversary
AWS, Azure, and GCP control-plane attack paths, STS and IAM persistence, federated-trust abuse, and container escape into pod-identity tokens.
Who it's for: Cloud and platform-security engineers, and pentesters moving into cloud environments.
2-day workshop
Executive Tabletop & Board Briefing
An executive-grade incident-response drill run with the CFO, General Counsel, and Comms in the room. You leave with a concise playbook ready to take to the board.
Who it's for: Executive teams and incident-response leads preparing for a real breach.
How it works
Small groups. Real targets.
Operator-led
Taught by the same operators who run live engagements, not a training department reading someone else's deck.
Hands-on labs
Every workshop runs against live targets and real tooling. You attack, not watch.
You keep the tooling
Leave with working notes and a packet of custom tooling you can use the next day.
Private cohorts
Single-organization sessions on-site or in your range, with labs aligned to your own stack.
Bring the workshop to your team.
Tell us who's attending and what you need. An operator replies within one business day.