Train, compete, evaluate, defend — against threats that didn’t exist yesterday.
Upskill a SOC, run a branded CTF, benchmark autonomous agents, stand up a national programme, or harden your OT defenders: it’s the same foundation of AI-generated, validated, never-repeated scenarios underneath all six products. Pick the one that fits your needs — or combine two.
The portal matches the client mode you buy.
LevelUpCTF uses one platform with mode-specific language, roles, navigation, and reports. Event, enterprise, and academia customers do not see the same workspace with different labels taped on.
One-off hosted competitions and assessments
Competition/event language with Organisation Lead, Event Manager, Viewer, and Player roles.
Long-running programmes and recurring skills development
Programme/campaign language with Organisation Lead, Program Manager, Viewer, and Player roles.
Academic cohorts, courses, and labs
Course/lab language with Faculty Coordinator, Instructor, Viewer, and Student roles.
Enterprise Training
DFIR scenario training for your SOC — multi-stage campaigns, per-analyst calibration, audit-ready telemetry.
- Per-analyst ELO + 15-axis challenge-type skill vector
- Private challenge libraries per tenant
- SSO/SAML · GDPR · SOX · PCI-DSS · NIST
DFIR Range / Incident Reconstruction
Landmark incidents, defanged into multi-stage DFIR investigations your SOC and blue teams can work end-to-end.
- Real-incident-inspired, fully fictionalized
- Alert triage → forensic question-banks
- 3 campaigns live · ELO-matched per analyst
CTF Event Hosting
Run your own branded competition using LevelUpCTF - AI-generated and fresh per event, with zero writeup leakage.
- Whitelabel — your domain, your logo
- Full stack: scoreboard, teams, hints, replay
- Handled end-to-end or self-run
AI Agent Evaluation
A REST API for benchmarking autonomous security agents against fresh, real sandboxes — not stale benchmarks.
- Developer tier free — 1K calls / mo
- Fresh nightly — no benchmark memorisation
- Agent-vs-par: solve time, tool use, retries
Education / Curriculum Integration
Ready-made curriculum sets for university programmes and national cyber-talent initiatives — with split-infra to deploy on your own cloud.
- Institutional or national-scale rollout (1K – 10K seats)
- Split-infra — deploy on your AWS / GCP
- Curriculum alignment · multi-year terms
OT Readiness
Train OT defenders on calibrated industrial-protocol scenarios — fresh every week, simulators only.
- Modbus · DNP3 · S7 · OPC-UA · EtherNet/IP
- Anomaly hunts, IR triage, safety-violation
- Simulators only — never real PLC firmware
Scenario training that calibrates to every analyst.
Multi-stage campaigns with per-user variants and platform-side grading against MITRE ATT&CK, on a REACTOR-generated stream that stays fresh. Built for security leaders buying skills uplift and training managers buying content.
Per-analyst rating across every category, so difficulty meets each learner at the right stretch.
Hand-curated scenarios to your brief plus REACTOR-generated challenges, visible only to your team.
Keystroke cadence, tool use, AI-vs-human signatures — every keystroke replayable for instructor review.
SAML 2.0 with your IdP, training-hour attestations and mappings to GDPR, SOX, PCI-DSS, NIST.
Real incidents, defanged into investigations your team can work.
Narrative DFIR campaigns — seven-plus stages from ticket triage through evidence analysis, MITRE mapping, on-chain tracing and executive write-up. Per-user variants mean two analysts see different IOCs, actors and timestamps on the same campaign. For IR consultancies and breach-readiness programmes that think in incidents. Three campaigns run today.
Trace a poisoned software update.
A trusted build pipeline ships a tampered update and a quiet beacon wakes across the estate.
- Beacon alert triage — verdict, IOCs, MITRE
- Host forensics — find the tampered artifact
- Network & DNS — map the C2 channel
- Lateral movement & forged-token abuse
Follow a multisig drain on-chain.
A malicious signing flow tricks approvers into a hostile upgrade; a custody wallet empties in minutes.
- Drain alert triage — verdict, IOCs, MITRE
- Transaction analysis — the subverted signature
- First-hop fund tracing — follow the outflow
- Cross-chain timeline — mixers, bridges
Catch a rogue command on a water plant.
An exposed remote-support tool lets an actor pivot from IT and write a rogue Modbus setpoint to a dosing PLC.
- SCADA alarm triage — verdict, MITRE ICS
- IT→OT pivot — the dual-homed host
- Modbus forensics — the rogue FC6/FC16 write
- Containment — segment, lock remote access
Verdict, IOCs, MITRE techniques and a containment call — scored platform-side, not on the honour system.
Over logs, on-chain traces and supply-chain artifacts. One answer at a time, hash-compared.
A junior and a lead work the same incident at the level matched to their skill vector.
- Ticket triage — verdict, IOCs, MITRE
- Evidence analysis — 3 questions
- JS bundle reversing — 5 questions
- MITRE mapping — 10 questions
- On-chain first-hop laundering — 4 questions
- Cross-chain timeline — 3 questions
- Executive write-up — free-form ticket
Incident Reconstruction — any breach report becomes a range in days.
Paste a public breach-report URL. REACTOR reads the advisory, extracts the attack chain, and reconstructs each stage as a deterministically-varied sandbox. A rekt.news post, a CISA advisory, a vendor PIR — all fair game.
Ingestion module in development; today we ship hand-curated campaigns.
Run a branded competition — fresh, per event, leak-proof.
AI-generated challenge sets unique to each event mean no writeup leakage and no shared answers between attendees. Whitelabel it on your domain, or let us run it end-to-end.
Your domain, your logo, your colours — attendees never leave your brand.
Scoreboard, teams, hints and session replay out of the box.
A fresh challenge set every time — no shared answers between attendees.
Handled end-to-end by our team, or self-run on the platform.
Benchmark autonomous security agents on fresh, real sandboxes.
A REST API that evaluates agents against REACTOR-generated challenges that regenerate nightly — so you measure capability, not benchmark memorisation.
Developer tier free at 1K API calls/mo; commercial and enterprise tiers add advanced analytics.
New challenges every night — agents can’t memorise a static benchmark.
Live Docker sandboxes, not multiple-choice — the work agents actually have to do.
Solve time, tool use and retries scored against a human/par baseline.
National-scale talent programmes, on your own infrastructure.
For national cyber programmes and university curricula. Split-infra keeps generation with us and delivery with you — your data never leaves your tenant.
National-scale rollout with volume discounts and multi-year terms.
REACTOR runs in our cloud; delivery runs on your AWS or GCP tenant.
CTF curricula mapped to course structure and learning outcomes.
Long-horizon agreements built for public-sector procurement.
Generation, validation and calibration happen on our side. The signed challenge images are deployed inside your tenant, where all analyst data stays.
Train OT defenders on calibrated industrial-protocol scenarios.
Anomaly hunts, IR triage and safety-violation detection across the protocols your plant actually runs — calibrated to each defender, fresh every week, simulators only.
Safety-violation detection on calibrated, real-protocol scenarios.
Asset discovery and protocol-level investigation across the control LAN.
Never real PLC firmware — calibrated simulators, fresh every week.
Difficulty ELO-matched to each defender, like every LevelUpCTF product.
Nine agents. One pipeline. The defensibility is the tech.
Every product above runs on REACTOR — a 9-agent pipeline running in production against every challenge on the platform. No stage is LLM-alone: every agent reads and writes to SAGE, the open-source memory framework underneath, so one agent’s lesson becomes the next agent’s starting context. The result: fresh, non-leakable, validated content at a rate a manual authoring team can’t match.
Designer drafts. Static Analysis lints. Validator builds and proves solvability end-to-end. Calibrator scores difficulty. Repair patches on stage failure. Deploy hardens and ships. The Evolution Worker reruns the whole catalogue nightly.
Book a 30-minute demo.
A solutions engineer walks you through REACTOR against one of your rotations, SSO against your IdP, and a quote shaped to whichever product fits.
You’ll see:
- → A live REACTOR run — a fresh challenge generated in real time
- → Cohort setup against one of your rotations
- → SSO against your IdP (bring a test tenant if you can)
- → Private-library workflow and review gate
- → Pricing shaped to your seat count and deployment model
- → Split-infra architecture for regulated clients
Request a walkthrough
The full intake form captures your team size, compliance requirements, and timeline so the demo is tailored to your stack before we meet. Takes two minutes.