Home / Products / Attack Reasoning Lab

Attack Reasoning Lab · Available

Think like a defender under pressure.

A real architecture with an active attack chain. Five questions, each built from your previous answer. Scored on five published dimensions.

Start free Try one question now
threatready.io/app · Lab session
Lab session screen: S3 Bucket Misconfiguration Chain, Intermediate, question 1 of 5. Attack chain diagram from attacker through public S3 and API keys to EC2, a threat identification question, and the answer box with copy-paste disabled Lab session screen in light theme: S3 Bucket Misconfiguration Chain, question 1 of 5
Product screenshot · question 1 of 5, timer running, copy-paste disabled
Format
1 architecture scenario · 5 adaptive questions
Levels
Beginner, Intermediate, Advanced, Expert
Answer by
Typing or voice dictation
Integrity
No copy-paste · forward-only · continuous timer
Anatomy of a session

The second question depends on your first answer.

Questions are bounded by the scenario's ATT&CK tactics and the role's competency map. Shallow answers get clarifying follow-ups; strong answers get harder ones.

  1. Q1Opens on the scenario and its architecture.
  2. Q2Follow-up generated from your Q1 answer.
  3. Q3Follow-up generated from your Q2 answer.
  4. Q4Follow-up generated from your Q3 answer.
  5. Q5Follow-up generated from your Q4 answer.

Question categories in the scenario pool include Threat ID, Detection, Architecture, Containment, Remediation, Forensics, Triage and Compliance.

threatready.io/app · Cloud Security
Difficulty selection for Cloud Security: Beginner 5 adaptive questions 5–8 min with full hints, Intermediate 10–14 min reduced hints, Advanced 12–18 min minimal hints, Expert 15–20 min no hints Difficulty selection in light theme
Product screenshot · difficulty selection
Four levels

Less help, more depth at each level.

LevelTimeHints
Beginner5–8 minFull
Intermediate10–14 minReduced
Advanced12–18 minMinimal
Expert15–20 minNone

Every level runs five adaptive questions.

How it's scored

Each question weights the five dimensions differently.

A "map this to ATT&CK" question leans on Threat Identification; an executive briefing leans on Communication. The weights are published in the rubric.

Read the rubricHow scoring works
Dimension weighting by question category, from the published rubric
Question categoryTICRABCQFA
Threat Identification40%10%15%10%25%
Containment & Response10%40%20%15%15%
Architecture Analysis15%10%40%10%25%
Executive Communication10%10%5%50%25%
Incident Response15%35%15%20%15%
Default (balanced)20%20%20%20%20%
0%50%Source: published rubric, §5
Mapped to MITRE ATT&CK

Techniques referenced across the scenarios.

T1078Valid AccountsT1530Data from Cloud StorageT1190Exploit Public-Facing ApplicationT1552.001Credentials in FilesT1562Impair DefensesT1567Exfiltration Over Web ServiceT1566.001Spearphishing AttachmentT1021Remote ServicesT1550.001Application Access TokenT1548Abuse Elevation ControlT1098.001Additional Cloud CredentialsT1195.002Software Supply ChainT1486Data Encrypted for ImpactT1496Resource Hijacking

Try one question. No sign-up.

Then start free: two Beginner scenarios on any role, no card required.

Try a live scenarioStart free