For intelligence analysts

The same universe. A different question.

Cybervestigate lets the same fictional universe produce a different training experience. Analysts are tasked with an intelligence requirement, then judged on how they evaluate sources, hold competing explanations, and brief a decision-maker.

Capabilities

  • Intelligence requirements

    Start from the question a customer, commander, or client actually asked.

  • Source evaluation

    Grade what a record can support, including sources that disagree.

  • Alternative hypotheses

    Keep a competing explanation alive until the evidence retires it.

  • Collection gaps

    Name what you still do not know, and what would change the call.

  • Confidence assessments

    State how much weight the assessment can bear.

  • Actor profiling

    Describe an actor from behavior and infrastructure, within the evidence.

  • Strategic implications

    Say what the case means beyond the individual incident.

  • Executive reporting

    Brief findings a decision-maker can use without the full file.

Same operation, intelligence tasking

Operation Glass Harbor

An intelligence requirement asks what the infrastructure, identities, social accounts, cryptocurrency transactions, and underground forum persona behind a business email compromise imply for the organizations they target — and how confident that assessment should be.

Investigators work this same operation as a criminal case. Read the investigation.

Method

How Cybervestigate Works

Five stages, from the first briefing to the debrief against ground truth.

  1. 1

    Receive the case

    The learner receives an allegation, intelligence requirement, incident report, victim complaint, or briefing.

  2. 2

    Investigate

    They search Cybervestigate's simulated internet, collect evidence, interrogate records, correlate identities, examine artifacts, and request information.

  3. 3

    Analyze

    Build timelines, link entities, document hypotheses, evaluate sources, and identify gaps.

  4. 4

    Report

    Write findings and assessments supported by evidence.

  5. 5

    Debrief

    Compare decisions with the scenario ground truth and receive feedback.

Begin with the case.

Operation Glass Harbor is the investigation. The debrief comes after the work.

Start Investigating Train Your Team