What's New
Fresh skills, courses, tracks, and platform updates from Defend the Org.
Latest release
Purple Team is live
Our tenth discipline is here. Read a red team report, decide what your SOC actually caught, and write the detections that close the gaps — then the red team…
Last Week
Headcount: looking around after landing
With a foothold on a workstation, the red team spent ten minutes learning the domain: who it trusts, who runs it, and what else it can reach. One of those…
Ricochet: from an ISO to the finance share
A hands-on-keyboard emulation went from one workstation to the finance file server and out the door. Some of it tripped your rules; some of it tripped the…
Letterhead: an attachment that ran a script
The red team mailed a finance analyst a spreadsheet, and its macro ran a script that pulled down a second stage. Work out which steps your telemetry saw, build…
Nightshift: persistence the logs never saw
The red team staged a tool, set it to run every night, and left. One step of that chain left nothing in your telemetry at all. Work out what you saw, build the…
Keyring: a service account goes looking for secrets
A compromised backup service account went looking for credentials on a finance app server. Make the coverage call on each step, tune the deployed rule that…
Nightjar: blinding the host, then slipping out
The red team blinded a finance workstation and moved data out past the proxy. Make the coverage call on each step, tune the deployed rule that only catches one…
Purple Team: Beginner
Learn to turn a red team report into better coverage. What purple teaming is, how to decide whether the SOC caught each step, and how to write detections that…
October 2026
Shell Session Opened Inside a Production Payments Pod
A shell was opened inside a live card-authorization pod at 02:14 on a Wednesday morning, by a named human account, in a PCI-scoped namespace where no person…
IAM Basics
Who gets in, what they can touch, and how a company keeps it that way: authentication, MFA, SSO, least privilege, the account lifecycle, and spotting identity…
Open Secret — A Leaked Cloud Key at Brightwell
A surprise overnight AWS bill and a crypto-mining alert lead you to a cloud access key that was accidentally made public. Trace what the attacker did with it,…
Count failed logins per user
Before you can spot a brute-force attempt you have to count. Turn a list of auth events into a count of failures per user — surviving the events that are…
Drills are live
Quick, timed rounds that keep your fundamentals sharp. Answer against the clock and every right answer lands a hit on your opponent — every miss, they hit…
Larder: lock down user uploads
Users upload photos and receipts. Serve them through the CDN, accept them through an authenticated upload path, and make sure the bucket has no public endpoint.
Sort alerting IPs into ours and not ours
Every alert queue starts with the same question: is this address one of ours? Classify a batch of source IPs against the corporate allowlist, report which…
September 2026
Guided Paths are live
There is no shortage of material in security. What there is no supply of is order. A Path sequences the courses, labs, tracks and campaigns for one role into…
Email & Phishing Triage
Work a reported phishing email end to end — headers, SPF/DKIM/DMARC, lookalike domains, links and attachments — and reach a verdict you can defend.
Threat Intel & Enrichment Basics
Turn an indicator into a decision. What an IOC is actually worth, where enrichment comes from, and how to script the lookup you would otherwise do forty times…
Workspace export / import bundles
A new export/import path that packs a workspace into a zip and restores it.
Windows & Linux for Analysts
Learn the Windows & Linux fundamentals you actually need to work as a SOC / Security Analyst.
Middleman — A Stolen Session at Harborline
A finance-team account at a commercial real-estate developer is taken over through an adversary-in-the-middle phishing page. The attacker never learns the…
The Defenders Club
The official Defend the Org Discord is open, and it's free to join. Get unstuck on labs without spoilers, talk careers and certs, drop into livestreams and…
The Bedside Review
A remote cardiac monitoring platform streams 40,000 patients' vitals into an alerting pipeline that decides who gets paged. Three weeks from an FDA submission,…
August 2026
Scripting: Beginner
Learn Python from zero, using the data you already work with. Variables, decisions, lists, text and the standard library — then three labs where you write the…
JSON findings to a stakeholder CSV
Compliance needs this quarter's findings as a CSV they can open in Excel. Convert the JSON export, quoting correctly so a comma in a description cannot shift a…
Who was involved, in the order it happened
An incident timeline lists the same accounts over and over. Reduce it to who was involved — once each, still in the order they first appear, because that order…
Write a CSV that does not lie
Someone in compliance wants your findings in a spreadsheet. One of the notes has a comma in it, and joining fields with commas will shift every column after it…
Root console login without MFA
Write the detection the platform team has been asking for: alert when the AWS root account signs into the console without MFA. Four conditions have to hold at…
Decide what to retry, and how long to wait
The nightly export against the EDR vendor's API keeps half-finishing. Write the policy that decides which failed calls are worth retrying, which are hopeless,…
Parse a key=value log line
Half the appliances in the estate emit key=value lines and nothing will parse them for you. Turn one into a dictionary you can actually query — without falling…
Turn risk scores into severities
The triage queue needs a severity on every alert, not a raw number. Apply the banding rule across the whole queue — and get the boundaries right, because an…
Rebuild a process ancestry when PIDs get recycled
The endpoint agent flagged a process and the only question that matters is what launched it. Walk the parent chain back through a flat process log — where the…
The Foundry Review
The asset here isn't customer data — it's the artifact 2.4 million machines install without asking. Review a software release pipeline and find what a…
Billing report CSV export
A new CSV export route on the internal billing report.
Web shell execution on an internet-facing portal
A web server started a shell it had no business starting — and the shell reached out for what came next. Write the detection that catches both relationships,…
Threat Modeling
Look at a finished system design and find where it breaks: spot the threats, name them precisely, and prescribe the fix.
The Backstage Review
Every agent on the support desk can open any customer's account. Find out what else they can do.
July 2026
Relay: secure the async order pipeline
Orders pile up faster than the API can process them. Move the work off the request path without handing an attacker a shortcut into the data tier.
The Gateway Review
Review a public API gateway fronting a mobile backend for authentication and availability weaknesses at the edge.
The Statement Review
Review an internal financial reporting platform for the integrity and accountability gaps an insider could exploit.
The Portal Review
Review a customer account portal and find where it leaks data in transit and at rest, and where it trusts callers it should not.
The Vault Review
A multi-tenant SaaS platform is going GA. Review the frozen design end to end — edge, mesh, and data tier — find every threat, and prescribe the fixes. The…
The Manifest Review
A public ride-dispatch API is about to launch. Review the frozen design, find the threats across the request path and data tier, and prescribe the fixes.
The Blueprint Review
Your first security design review: a small online storefront is about to ship. Walk the diagram, find the four threats, and prescribe the fixes.
User profile endpoints
A new REST route for fetching and creating users.
Scheduled digest emails
A sizeable feature PR adding scheduled digest emails across several files.
Admin user-management route
A new admin route plus the auth middleware it relies on.
Message card endpoint
A new endpoint that renders a message as an HTML card.
Avatar proxy endpoint
A change to let the avatar endpoint proxy images from a URL.
Partial refund support
A change adding a partial-refund path to the order refund endpoint.
Code Review is live
Our seventh discipline is here. Review real GitHub-style pull requests the way a senior engineer does — catch the security bugs, logic errors, and design flaws…
Suspected Insider Data Theft at a Pre-Acquisition Materials Firm
A routine departing-employee data review at Corvane Materials turns up exactly what everyone expected: a Senior Account Director on her way to a competitor, an…
Guided walkthroughs
Every Easy and Medium lab now has an in-lab walkthrough. Redeem a weekly token and a Defender guides you hint by hint — so you learn the skill, not the answer.
Public Profiles
Your Defend the Org profile can now be shared publicly — flip it on and you get a clean, link-anywhere page (great for a resume or LinkedIn) showing your…
Watchtower: build the detection pipeline
Design the observability pipeline that turns scattered application, edge, and identity logs into correlated detections, tamper-resistant archival, and a SOC…
Lights Out at Mercer Health
A regional hospital network catches a ransomware crew mid-Impact phase. Fourteen minutes of telemetry — shadow-copy wipes, service stops, log clearing, and the…
June 2026
Creator Mode
Apply to be a Creator and get access to exercise solutions and explanations to help you plan your educational content.
Defender Initiation
Onboarding got an upgrade. Defender Initiation is a 12-minute campaign that walks you through your first three reps as a defender — triage an alert, contain an…
Campaigns are live — story-driven security operations end-to-end
Real cybersecurity work isn't one skill in isolation. Campaigns recreate the shape of an incident — story-driven scenarios that thread cutscenes between labs…
Lattice — Zero-Trust Service Mesh
Re-architect a flat payments backend into a zero-trust service mesh: mutual TLS east-west, central identity, runtime secrets, and a data tier reachable only…
System Design: Beginner
Learn to design systems that defend themselves. Three concept-per-lab sections — trust zones, edge filtering, and protecting data — that teach the invariants…
Six System Design labs ship with the new module
Keep, Moat, Sieve, Strongbox, Tollgate, and Stratus — five easy/medium labs to learn the invariants, one hard lab to prove them under enterprise pressure.
System Design
Design secure, defensible systems on a graph canvas. The first proactive module in Defend The Org — every other skill is reactive; this one is design-time.
May 2026
Megalodon — Mass GitHub Workflow Backdooring
On 2026-05-18, an attacker pushed malicious .github/workflows/ entries into thousands of GitHub repos in a six-hour window, exfiltrating CI secrets and cloud…
Log Analysis Methodology
The substrate skill underneath detection, hunting, IR, and SOC. Learn how a defender thinks about logs through the loop: Anchor, Scope, Pivot, Corroborate,…
Moat: protect the data tier
Design a public-facing web application so that nobody on the internet can reach the database directly. Place each component in the right trust zone, wire the…
RubyGems GemStuffer
A public supply-chain disclosure (GemStuffer, 2026-05-13) describes 150+ malicious RubyGems published as a data-exfiltration dead-drop. As the security…
Notifications
A bell icon in the top right keeps you in the loop on new labs, friend requests, and platform updates. Tune what you hear about in account settings.
The Fracture Within
A ransomware alert detonates across your finance department — but something deeper is moving through the network. A nation-state actor has been inside for…
What's New page
Browse every recent skill, course, track, and platform update in one place. Subscribe to the RSS feed to get drops as they ship.
RSS feed for releases
Subscribe to /whats-new/feed.xml to get every new skill, course, and feature in your RSS reader.
Defend the Org Public Launch
May 6, 2026
Defend the Org launches publicly
The platform goes live with 5 Skills, 59 Labs, 3 Courses, 6 Tracks.