What's New
Fresh skills, courses, tracks, and platform updates from Defend the Org.
Latest release
Email & Phishing Triage
Work a reported phishing email end to end — headers, SPF/DKIM/DMARC, lookalike domains, links and attachments — and reach a verdict you can defend.
This Week
Threat Intel & Enrichment Basics
Turn an indicator into a decision. What an IOC is actually worth, where enrichment comes from, and how to script the lookup you would otherwise do forty times…
Workspace export / import bundles
A new export/import path that packs a workspace into a zip and restores it.
Last Week
Windows & Linux for Analysts
Learn the Windows & Linux fundamentals you actually need to work as a SOC / Security Analyst.
Middleman — A Stolen Session at Harborline
A finance-team account at a commercial real-estate developer is taken over through an adversary-in-the-middle phishing page. The attacker never learns the…
September 2026
The Defenders Club
The official Defend the Org Discord is open, and it's free to join. Get unstuck on labs without spoilers, talk careers and certs, drop into livestreams and…
The Bedside Review
A remote cardiac monitoring platform streams 40,000 patients' vitals into an alerting pipeline that decides who gets paged. Three weeks from an FDA submission,…
August 2026
Scripting: Beginner
Learn Python from zero, using the data you already work with. Variables, decisions, lists, text and the standard library — then three labs where you write the…
Root console login without MFA
Write the detection the platform team has been asking for: alert when the AWS root account signs into the console without MFA. Four conditions have to hold at…
Rebuild a process ancestry when PIDs get recycled
The endpoint agent flagged a process and the only question that matters is what launched it. Walk the parent chain back through a flat process log — where the…
JSON findings to a stakeholder CSV
Compliance needs this quarter's findings as a CSV they can open in Excel. Convert the JSON export, quoting correctly so a comma in a description cannot shift a…
Who was involved, in the order it happened
An incident timeline lists the same accounts over and over. Reduce it to who was involved — once each, still in the order they first appear, because that order…
Write a CSV that does not lie
Someone in compliance wants your findings in a spreadsheet. One of the notes has a comma in it, and joining fields with commas will shift every column after it…
Turn risk scores into severities
The triage queue needs a severity on every alert, not a raw number. Apply the banding rule across the whole queue — and get the boundaries right, because an…
Decide what to retry, and how long to wait
The nightly export against the EDR vendor's API keeps half-finishing. Write the policy that decides which failed calls are worth retrying, which are hopeless,…
Parse a key=value log line
Half the appliances in the estate emit key=value lines and nothing will parse them for you. Turn one into a dictionary you can actually query — without falling…
The Foundry Review
The asset here isn't customer data — it's the artifact 2.4 million machines install without asking. Review a software release pipeline and find what a…
Billing report CSV export
A new CSV export route on the internal billing report.
Web shell execution on an internet-facing portal
A web server started a shell it had no business starting — and the shell reached out for what came next. Write the detection that catches both relationships,…
Threat Modeling
Look at a finished system design and find where it breaks: spot the threats, name them precisely, and prescribe the fix.
The Backstage Review
Every agent on the support desk can open any customer's account. Find out what else they can do.
July 2026
Relay: secure the async order pipeline
Orders pile up faster than the API can process them. Move the work off the request path without handing an attacker a shortcut into the data tier.
The Gateway Review
Review a public API gateway fronting a mobile backend for authentication and availability weaknesses at the edge.
The Statement Review
Review an internal financial reporting platform for the integrity and accountability gaps an insider could exploit.
The Portal Review
Review a customer account portal and find where it leaks data in transit and at rest, and where it trusts callers it should not.
The Vault Review
A multi-tenant SaaS platform is going GA. Review the frozen design end to end — edge, mesh, and data tier — find every threat, and prescribe the fixes. The…
The Manifest Review
A public ride-dispatch API is about to launch. Review the frozen design, find the threats across the request path and data tier, and prescribe the fixes.
The Blueprint Review
Your first security design review: a small online storefront is about to ship. Walk the diagram, find the four threats, and prescribe the fixes.
User profile endpoints
A new REST route for fetching and creating users.
Scheduled digest emails
A sizeable feature PR adding scheduled digest emails across several files.
Admin user-management route
A new admin route plus the auth middleware it relies on.
Message card endpoint
A new endpoint that renders a message as an HTML card.
Avatar proxy endpoint
A change to let the avatar endpoint proxy images from a URL.
Partial refund support
A change adding a partial-refund path to the order refund endpoint.
Code Review is live
Our seventh discipline is here. Review real GitHub-style pull requests the way a senior engineer does — catch the security bugs, logic errors, and design flaws…
Suspected Insider Data Theft at a Pre-Acquisition Materials Firm
A routine departing-employee data review at Corvane Materials turns up exactly what everyone expected: a Senior Account Director on her way to a competitor, an…
Guided walkthroughs
Every Easy and Medium lab now has an in-lab walkthrough. Redeem a weekly token and a Defender guides you hint by hint — so you learn the skill, not the answer.
Public Profiles
Your Defend the Org profile can now be shared publicly — flip it on and you get a clean, link-anywhere page (great for a resume or LinkedIn) showing your…
Watchtower: build the detection pipeline
Design the observability pipeline that turns scattered application, edge, and identity logs into correlated detections, tamper-resistant archival, and a SOC…
Lights Out at Mercer Health
A regional hospital network catches a ransomware crew mid-Impact phase. Fourteen minutes of telemetry — shadow-copy wipes, service stops, log clearing, and the…
June 2026
Creator Mode
Apply to be a Creator and get access to exercise solutions and explanations to help you plan your educational content.
Defender Initiation
Onboarding got an upgrade. Defender Initiation is a 12-minute campaign that walks you through your first three reps as a defender — triage an alert, contain an…
Campaigns are live — story-driven security operations end-to-end
Real cybersecurity work isn't one skill in isolation. Campaigns recreate the shape of an incident — story-driven scenarios that thread cutscenes between labs…
Lattice — Zero-Trust Service Mesh
Re-architect a flat payments backend into a zero-trust service mesh: mutual TLS east-west, central identity, runtime secrets, and a data tier reachable only…
System Design: Beginner
Learn to design systems that defend themselves. Three concept-per-lab sections — trust zones, edge filtering, and protecting data — that teach the invariants…
Six System Design labs ship with the new module
Keep, Moat, Sieve, Strongbox, Tollgate, and Stratus — five easy/medium labs to learn the invariants, one hard lab to prove them under enterprise pressure.
System Design
Design secure, defensible systems on a graph canvas. The first proactive module in Defend The Org — every other skill is reactive; this one is design-time.
May 2026
Megalodon — Mass GitHub Workflow Backdooring
On 2026-05-18, an attacker pushed malicious .github/workflows/ entries into thousands of GitHub repos in a six-hour window, exfiltrating CI secrets and cloud…
Log Analysis Methodology
The substrate skill underneath detection, hunting, IR, and SOC. Learn how a defender thinks about logs through the loop: Anchor, Scope, Pivot, Corroborate,…
Moat: protect the data tier
Design a public-facing web application so that nobody on the internet can reach the database directly. Place each component in the right trust zone, wire the…
RubyGems GemStuffer
A public supply-chain disclosure (GemStuffer, 2026-05-13) describes 150+ malicious RubyGems published as a data-exfiltration dead-drop. As the security…
Notifications
A bell icon in the top right keeps you in the loop on new labs, friend requests, and platform updates. Tune what you hear about in account settings.
The Fracture Within
A ransomware alert detonates across your finance department — but something deeper is moving through the network. A nation-state actor has been inside for…
What's New page
Browse every recent skill, course, track, and platform update in one place. Subscribe to the RSS feed to get drops as they ship.
RSS feed for releases
Subscribe to /whats-new/feed.xml to get every new skill, course, and feature in your RSS reader.
Defend the Org Public Launch
May 6, 2026
Defend the Org launches publicly
The platform goes live with 5 Skills, 59 Labs, 3 Courses, 6 Tracks.