When most founders tell their story of a disruptive new platform, they describe a hallelujah moment of clarity. Ours is more gradual.
It started 12 years ago. Nervously standing on the sidelines of the initial Locked Shields exercise as the first version of our range threw nation-state attacks at NATO defenders, we realized what we were building had value for two reasons.
First, we saw there was more to cybersecurity defense than just technical skills. The teams at the top of the leaderboard got there with soft skills; they talked, helped one another prioritize, even shared jokes - despite being buried in DDoS attacks.
Second, we recognised the most valuable factor in teaching defenders was realism. The quality of learning NATO teams got from exercising with real tools, time pressures, attack chains, processes and more was clear. It taught them the most valuable thing: how to act.
This led to one question we have been asking ever since: “How do we get more teams exercising?”
Upskilling: Must fit risk, budgets and workloads
Answering this question has been the hardest part of our journey. Years of talking with security leaders has taught me that, while they see the value, skills are second place to tooling in budgets. Upskilling is still seen as onerous, expensive and is perceived as having less of a direct impact on risk.
Solo labs platforms, including ours, have addressed some of these issues. Getting hands-on with threats is more cost effective and creates a higher quality of learning than classroom training. In defensive terms, it creates skilled individuals with a hero's chance of mitigating sections of the kill-chain.
This, however, is just a fraction of the total skills needed in an attack. It isn’t readiness.
Readiness is when teams can use tools, analyze data, understand kill chains, examine users and more - but, crucially, do so in the context of an attack. This means, amongst other things, knowing how to communicate with peers and other functions, run processes, assess changing priorities, step up and lead, know when to follow - and way more.
Security leaders know this - so it’s no surprise labs platforms alone have to fight to earn their place in budgets.
By contrast, regular and realistic team exercising builds all the required skills. Unfortunately, simulating the minutiae of a breached technical environment is like mapping DNA, making it both expensive and time consuming.
Our answer
12 years later, we feel we may have finally answered these contrasting problems with the launch of a platform that hones both solo skills and teamwork, but more crucially, does so in a way designed for the mass market.
RangeForce Team Readiness integrates regular team exercising with skills labs in easy-to-deliver cycles that can be focussed on specific risks and roles.
Recent leaps in automation and cloud technology have allowed us to slash the price of delivering a range. Democratizing team exercises is a big step for us. Defensive teams the world over will be able to build skills in the same way elite teams of government defenders do.
Now, we can offer team and solo skills building at a fraction of the price of platforms that do only the latter. This solves the budget problem, but how does the platform make sure such programs are relevant to risk?
RangeForce Team Readiness achieves this in a number of ways, at the heart of which sits the ability to automatically create quarterly cycles of exercising and solo labs tailored for your risk, specific to roles. For example, a SOC Analyst learns the theory and tools needed for triage and then perfects this using Crowdstrike, alongside their team, in a live environment. Imagine this scaled across PenTesters, Threat Hunters, Forensics Analysts and more.
Ultimately, we believe the new platform takes us beyond legacy approaches which just load more skills into more individuals. Instead, we focus on building attack-ready teams. We believe this is readiness in the truest sense. All at a fraction of the price of our nearest competitors.
Give RangeForce Team Readiness a try with a free team exercise, a skills gap report and targeted solo labs.