✳ Practice / Browser-based / No setup
Step into Meridian Space & Robotics’ incident, cloud, supply-chain, AI agency, and GRC tabletops. Weigh synthetic evidence, commit to a defensive call, and verify the outcome in your browser.
EXERCISE 01 / 8 MIN
The case includes a new device, an unfamiliar network, a push-fatigue approval, and an unauthorized mailbox forwarding rule at Meridian Space & Robotics. Evaluate what the evidence actually proves before proposing containment.
Helpful first: Identity, authentication, authorization, and recovery · Identity alert triage: reconstructing who, what, and how across logs
Evidence-based identity triageEXERCISE 02 / 7 MIN
Three vulnerability findings compete for a single emergency maintenance window at Meridian Space & Robotics. Raw severity scores point in one direction; internet exposure and active exploitation evidence point in another.
Helpful first: Threat, vulnerability, and risk: the core equation · Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure
Context-driven risk prioritizationEXERCISE 03 / 12 MIN
Two simulated cloud console exhibits from Meridian Space & Robotics reveal an exposed object-storage prefix and an over-privileged workload role. Identify who owns each failure under shared responsibility, choose the first fix, and specify the positive and negative verification evidence.
Helpful first: Cloud shared responsibility: what you rent vs what you still own · Least privilege, defense in depth, and Zero Trust boundaries
Cloud shared responsibility and least privilegeEXERCISE 04 / 10 MIN
A synthetic CycloneDX SBOM at Meridian Space & Robotics surfaces a transitive dependency finding on Chronos Hub’s public billing webhook. Walk the prioritization ladder to decide whether to patch, apply a compensating control, or defer, and record the owner and review date.
Helpful first: Direct and transitive dependencies: inherited code in your runtime · SBOM evidence and priority: binding inventory to the running build
SBOM and supply-chain triageEXERCISE 05 / 10 MIN
At Meridian Space & Robotics, an internal assistant named ScheduleClerk holds both executive calendar read access and finance shared-drive write access under a single machine identity. Design an authorization boundary so an untrusted calendar invite can never exfiltrate payroll records on model say-so.
Helpful first: Excessive agency: why a model sentence is never an authorization decision · Human oversight gates and the NIST AI Risk Management Framework
Agent tool permissions and human gatesEXERCISE 06 / 8 MIN
Meridian Space & Robotics requires phishing-resistant MFA for all members of its VPN-Admin group. Four artifacts arrive in the March audit packet alongside an expiring contractor exception. Determine which artifact proves the control operated and how to govern the Friday expiration.
Helpful first: Write the risk sentence: cause, asset, and business impact · Choose the control and its evidence: policies do not execute themselves
Audit evidence and exception governanceTHE NEXT EXPERIMENT
Explore how a small Agentic SOC reference handles duplicate signals, missing evidence, human approval, and verification.
Try the Agentic SOC starter ↗