For cybercrime investigators

Build a case you can explain.

Cybervestigate puts investigators inside a simulated internet where identities, infrastructure, communications, money, and artifacts can be followed through to a conclusion. The work is the investigation.

Capabilities

  • Evidence preservation

    Keep what you collect attributable, intact, and ready to cite.

  • Subject identification

    Resolve people, aliases, and accounts to the identities behind them.

  • Attribution analysis

    Connect activity to an actor only as far as the evidence supports.

  • Social-media investigation

    Read accounts, posts, images, and relationships as evidence.

  • Online undercover awareness

    Recognize what undercover contact requires before anyone reaches out.

  • Provider records

    Know which records exist, what they can show, and how to request them.

  • Financial tracing

    Follow payments, invoices, and crypto-style transactions across the case.

  • Infrastructure investigations

    Work DNS, hosting, certificates, and WHOIS-style records.

  • Timelines

    Place events in an order the file can defend.

  • Investigative reporting

    Write findings a supervisor, prosecutor, or client can use.

  • Case coordination

    Keep leads, tasks, and teammates aligned on one investigation.

Example case

Operation Glass Harbor

A business email compromise investigation reveals infrastructure connected to several identities, social accounts, cryptocurrency transactions, and an underground forum persona.

Method

How Cybervestigate Works

Five stages, from the first briefing to the debrief against ground truth.

  1. 1

    Receive the case

    The learner receives an allegation, intelligence requirement, incident report, victim complaint, or briefing.

  2. 2

    Investigate

    They search Cybervestigate's simulated internet, collect evidence, interrogate records, correlate identities, examine artifacts, and request information.

  3. 3

    Analyze

    Build timelines, link entities, document hypotheses, evaluate sources, and identify gaps.

  4. 4

    Report

    Write findings and assessments supported by evidence.

  5. 5

    Debrief

    Compare decisions with the scenario ground truth and receive feedback.

Begin with the case.

Operation Glass Harbor is the investigation. The debrief comes after the work.

Start Investigating Train Your Team