Running live, safe, authorised drills against Harrowgate Market's own detection and response controls around the drill loop of objectives, design, telemetry, execution, playbook, verdicts, remediation and cadence; one scored drill in which a simulated credential dump triggered an EDR alert in 216 seconds against a five-minute hypothesis, with containment at 430 seconds and recovery at 646; and the lessons behind it — an 11-hour real containment caused by a playbook step naming a decommissioned tool, an escalation list that failed its re-drill and now runs as a quarterly regression, and detection time falling month by month.

CY-EXPERT-015Expert Level · Blue Teaming

Blue Team Incident Drills — The Drill Loop

An expert-level course in control-challenge drilling: designing and running live, authorised technical drills in your own environment that test specific detection and response controls, score them into evidenced verdicts, and drive remediation, always inside a written safety envelope with benign own-environment simulations only.

18 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Set a falsifiable control hypothesis mapped to an ATT&CK technique and prioritised by real risk.
Design a written, authorised safety envelope with blast-radius limits and a tested kill switch.
Run a live drill with a run-of-show, assigned controller and observers, and a working abort path.
Score a drill into MTTD/MTTC/MTTR, pass/fail verdicts, and a diagnosed root-cause category, then remediate and re-drill to verify.

Price:৳12,000