🛡️ Active Attack Defense
Incident-response simulation — analyze the evidence and decide how a security analyst should respond.
Suspicious Authentication Activity
The security monitoring system has detected unusual authentication activity involving a fictional employee account.
🚨 SECURITY ALERT
Multiple failed authentication attempts were followed by a successful login from an unfamiliar device. The activity requires investigation.
Analyst Decision
What should be the first defensive priority? Choose the response that best protects the fictional account while the incident is investigated.
📋 Incident Response Report
🎣 Phishing Investigation
Analyze a fictional message and identify the indicators that should make a security analyst suspicious.
Investigate the sender, language, link, and information being requested.
Hello,
We detected unusual activity on your account. Please verify your information immediately.
If you do not verify your account within 24 hours, access may be restricted.
http://account-verification.example
Please provide your username, password, and security information.
Thank you,
Security Team
🔎 Identify the Indicators
🔎 Security Log Investigation
Practice recognizing activity that deserves further investigation.
Clyvexis Authentication Logs
● FICTIONAL TRAINING DATA
Which activity deserves investigation?
📚 Cybersecurity Learning Library
Learn the concepts behind the simulations before putting your knowledge into practice.
The Clyvexis Learning Library is a quick-reference collection of cybersecurity concepts. Choose a topic to learn what it means, why it matters, and how it connects to real-world defensive security.
Authentication & MFA
Learn how systems verify identity and how multi-factor authentication adds protection.
Authentication verifies who a user or system is. MFA adds additional verification factors, such as a password plus a security code or security key.
Why it matters:
A stolen password is less useful to an attacker when another verification factor is required.
Phishing & Social Engineering
Understand how attackers manipulate people into revealing information or taking unsafe actions.
Phishing uses deceptive messages, websites, or other communication to trick people. Social engineering is the broader idea of manipulating people rather than relying only on technical flaws.
Watch for:
Urgency, unexpected requests, suspicious links, unusual sender addresses, and requests for sensitive information.
Networking & DNS
Learn how devices communicate and how DNS helps connect domain names to network addresses.
Networks allow devices and systems to communicate. DNS, or the Domain Name System, helps translate domain names into IP addresses.
Why it matters:
Understanding networking helps security analysts recognize unusual connections and network activity.
Malware
Learn about malicious software and how defenders recognize and respond to suspicious behavior.
Malware is software designed to perform harmful or unauthorized actions.
Examples:
Viruses, worms, Trojans, ransomware, and spyware are different categories of malicious software.
Defense:
Security updates, endpoint protection, careful software installation, and monitoring can reduce risk.
Encryption & Hashing
Understand two important security concepts used to protect and verify information.
Encryption transforms readable data into protected ciphertext so unauthorized people cannot easily read it.
Hashing:
Hashing creates a fixed-size representation of data. Cryptographic hashes can help verify integrity and are used in many security systems.
Firewalls
Learn how firewalls help control network traffic using security rules.
A firewall monitors and controls network traffic according to configured security rules.
Why it matters:
Firewalls can help restrict unwanted connections and reduce the exposure of systems and services.
Incident Response
Learn how security teams investigate, contain, recover from, and learn from incidents.
Incident response is the organized process of handling a cybersecurity incident.
Common stages:
Detection, analysis, containment, eradication, recovery, and lessons learned.
Security Logs
Learn how analysts use recorded system events to investigate suspicious activity.
Logs are records of events occurring within systems, applications, networks, and other technology environments.
Why they matter:
Analysts can compare timestamps, accounts, devices, and actions to understand what happened.
Password Security
Learn why unique passwords and password managers are important for account security.
Use unique, strong passwords for different accounts and avoid sharing passwords.
Password managers:
A password manager can help generate and store unique passwords so users do not have to memorize every one.
Least Privilege
Understand why users and systems should receive only the access they actually need.
The principle of least privilege means giving users, applications, and systems only the permissions necessary to perform their tasks.
Why it matters:
Limiting permissions can reduce the potential impact of a compromised account or application.
Threat Detection
Learn how defenders identify unusual behavior that may require investigation.
Threat detection involves monitoring systems and identifying signs of potentially malicious or unauthorized activity.
Examples:
Unusual logins, unexpected processes, suspicious network connections, and repeated failed access attempts can all deserve investigation.
CIA Triad
Learn one of the foundational models used to think about cybersecurity objectives.
Protect information from unauthorized access.
I — Integrity:
Keep information accurate and protected from unauthorized modification.
A — Availability:
Keep systems and information accessible to authorized users when needed.