Verified.
Not self-reported.
The program re-runs every candidate's evidence scan and signs the result. Your browser verifies that signature before a single number appears, so progress cannot be inflated and the board cannot be quietly edited.
Three disciplines. One operator.
A Ranger is forged to defend a live organization against a real adversary. Every day builds one of three disciplines, and the capstone fuses them under fire.
Defend
Stand up hardened, loopback-bound infrastructure and a SOC that sees everything. Ingest telemetry, write detections with negative controls, and cut false positives without losing the signal.
Strike
Run scoped, rules-of-engagement-bound assessments against owned targets. Reproduce broken access control, prove it, remediate it, and verify the fix with a regression that fails on the vulnerable commit.
Engineer
Harden the pipeline itself. Sign artifacts, gate merges on SAST and secret scanning, enforce architecture with IaC and drift detection, and recover on demand with measured objectives.
Ranger board
Contact: red strikes, blue answers
How engagements are scoredEvery engagement pairs an adversary action with the detection built to catch it, mapped to MITRE ATT&CK. Outcome, dwell time, and time to detect are pulled from each Ranger's own sensors and detection fixtures, then measured by the program.
Harden the code. Block the merge.
What blocks a mergeEvery pull request runs SAST, secret scanning, and a dependency audit. A finding holds the gate shut until it is remediated and proven by a regression. Below is the control the whole program is built around, reviewed inline.
test_vulnerable_baseline flipped 200 → 403 in the same PR; CI shows before and after. Verified by the program, not self-reported.The SOC never goes dark
Detection engineeringLive alerts streaming off the cohort's sensors, shaped exactly as the Wazuh manager emits them: rule id, severity, description, agent, source, and the mapped ATT&CK technique.
Deploy the range
Everything a Ranger needs to stand up the range, straight from this site. The kit bootstraps the loopback lab, the test harness, the CI gate, and the evidence contract.
From first contact to signed record
Day work becomes an evidence record and a pull request. CI runs the tests and the ownership check; a board opens only on a signed release tag. The program's sync job re-measures each repo, signs the cohort, and this page verifies that signature on load.
See the full workflowStand up your range. Defend it for real.
Clone the range from the template, pass six uncoached boards, and graduate with a signed, tamper-evident record of work no screenshot can fake. The adversary is already moving.