Season Zero: Fundamentals
Your first week was supposed to be easy.
Your first week on the team. Ed promised you'd have time to settle in - that lasted about an hour. A routine phishing report just escalated into something bigger. Follow the full incident arc from first alert to containment — no theory dumps, no VM setup.
The five-episode arc
Over 3-4 hours, go from watching the team work to working alongside them through a single incident that keeps escalating.
First Day
Monday, 8:47 AM. Your first shift, and Ed says it's a quiet week. Tess sits with you on your first reported email. The next one is yours alone.
Inbox Zero
Tuesday, 9:55 AM. Yesterday's Finance alert is your first ticket: three copies of one supplier invoice. Read it, look it up, and find out how far it went.
Follow the Thread
Tuesday, 2:45 PM. The watch on j.doe's account just reported a VPN session. Find out who it was, what they did, and where they came from.
Lateral
Wednesday, 9:00 AM. A Finance colleague forwards a note that looks like it came from j.doe and asks if it is real. Every check passes. Follow it from an inbox to a machine.
Containment
Thursday, 7:30 AM. IT worked the ticket overnight. Before anything comes back online, check their work: the scope, the machine, and the campaign.
What you'll actually learn
How each episode works
1. Briefing
Get looped in on what happened, from the people who caught it.
2. Investigate
Analyze real evidence — emails, logs, endpoints, threat intel — and make the calls a real analyst would.
3. Debrief
See how your read on the incident compares, and what happens next.
No setup, no VMs, nothing to install. 5 episodes, 25–50 minutes each.