Skip to content
For lecturers and instructors

Run a hands-on security class this week, with no setup.

Browser labs your students open from a link: incident response, SOC triage, detection, forensics and API security. Give the whole room the same case, watch a live class leaderboard, and debrief from real decisions. Nothing to install, and no student accounts for the free labs.

Create a class in the IR Playbook Lab Session plans

What you can do this week

Four things that work today, with nothing to configure and nobody to ask.

IR Playbook Lab class mode

A class code, a live leaderboard and a printable teacher view. 7 incidents, from ransomware on a file server to a compromised IT provider, in English and Spanish.

Open the lab

One seed, one case for everyone

Many labs generate each case from a seed in the link (?seed=). Share one link and the whole room works the identical case, so the debrief compares decisions, not luck.

Labs that take a seed

Cyber War Room as a group exercise

Project one run from your own free account (3 campaigns per account) and let the room argue each call before you click. Every call is graded.

See the Cyber War Room

Evidence students can submit

Each finished IR Playbook Lab run has its own public scorecard page with grade, time and accuracy per phase. The SOC Log Triage Trainer and Pick the Phish give a practice certificate page. Students paste the link into your LMS.

What students see

IR Playbook Lab

Class mode, step by step

  1. 1

    Create the class

    Open the IR Playbook Lab, press Class, type a class name and press Create class. You get a six-character code and a student link. You do not need an account.

  2. 2

    Pick the incident

    Choose the scenario and level, then use "Copy link to this round". Add &class=YOURCODE to that link and every student gets the same incident and lands in your class.

  3. 3

    Students play

    They open the link (or type the code into the lab's Class panel) and play. No student accounts or emails. Their finished runs go to the class board under the display name they choose.

  4. 4

    Debrief from the board

    The teacher view at /tools/ir-playbook-lab/class/CODE shows each player's best score, grade and time, the player count and the class average. It refreshes every 20 seconds and prints cleanly.

  • Codes avoid 0/O and 1/I, so they survive being read aloud or copied from a projector.
  • A student who reloads stays in the class; the code is remembered in their browser.
  • The board keeps each player's best run, so a second attempt after the debrief can only raise their score.

Labs that take a shared seed

Start a run, copy the link (it carries ?seed=), and post it to the class. Everyone gets the same generated case. Where the lab asks for a level, tell students which one to pick.

Ready-made session plans

Each fits a 60 to 90 minute session. Timings are a starting point; the debrief is where most of the learning happens.

Ransomware: the first hour

75 min

Response order and evidence handling under pressure.

  • IR Playbook LabFree, no accountRansomware on a file server, in class mode, everyone on one seed.
  • Forensics LabFree, no accountWork the artifacts behind an intrusion and back each conclusion.

Brief 10 min · IR lab 25 min · debrief from the board 10 min · Forensics Lab 25 min · wrap-up 5 min.

A SOC analyst's shift

60–75 min

Reading logs, spotting the wrong field, then writing a rule that catches it.

  • SOC Log Triage TrainerFree, no accountClick the fields that look wrong in a synthetic log stream.
  • Detection LabFree, no accountWrite and tune detection rules on a labelled stream, one seed for the room.

Triage 20 min · compare misses 10 min · Detection Lab 30 min · share the best rule 10 min.

From phishing to wire fraud

60 min

How a convincing email becomes a finance incident.

Pick the Phish 15 min · IR lab BEC scenario 30 min · debrief 15 min.

API security review

90 min

OWASP API Top 10 risks found in code, in inventory and at the gateway.

Three 25-minute labs on one shared seed each, then a 15-minute comparison of fixes.

Leading through a breach

90 min

Decisions, owners and communication, the leadership side of an incident.

  • Cyber War RoomFree account · 3 campaignsOne run projected; the room votes on each call.
  • IR Playbook LabFree, no accountThe compromised IT provider (MSP) scenario, in class mode.
  • Cascade Incident LabFree account · uses 1 of 3 runsOptional: built for a team tabletop with a projector.

War Room as a group 40 min · IR lab individually 30 min · debrief 20 min.

AI governance and audit

60–75 min

What an auditor asks for, and how ready an organisation really is.

Audit lab 35 min · readiness in groups 25 min · debrief 10 min.

What your students need

Free, no account

A browser and the link. Every item marked “Free, no account” above runs signed out, as many times as they like.

Free account, no card

3 runs for life, shared across the metered labs, spent only when a lab is completed and once per lab. Plus 3 Cyber War Room campaigns.

Pro

Unlimited metered labs and downloadable reports, $5/month or $40/year. Nobody needs it for the free labs or the class leaderboard.

Running a whole course on it?

There is no separate education price today. The Team plan gives 30% off per seat from 5 seats. If you want Pro for a class, tell us the class size and dates and we will talk it through.

Contact us about a class

Frequently asked questions

How does class mode work in the IR Playbook Lab?

The instructor opens the IR Playbook Lab, presses Class, names the class and gets a six-character code and a link. Students open the link or type the code, play as usual, and each finished run goes to a class leaderboard that keeps every player's best score. The teacher view shows the board, the player count and the class average, refreshes every 20 seconds and prints. Neither the instructor nor the students need an account.

Which labs have class mode?

Only the IR Playbook Lab has a class code and a class leaderboard. Many other labs are seeded: share one link with ?seed= and every student works the identical case, which is enough for a shared debrief, but results are not collected on a class board.

Do my students need accounts?

Not for the free labs, which run signed out: the IR Playbook Lab, SOC Log Triage Trainer, Detection Lab, Forensics Lab, Pick the Phish and the API labs on this page. A free account adds 3 runs for life, shared across the metered labs and tools, and 3 Cyber War Room campaigns. A run is spent only when a lab is completed, once per tool, so replaying a lab already used does not spend another.

Can students download their reports?

Downloads and exports (Markdown, PDF, CSV) need Pro in every lab. What students can share for free is the public scorecard page of an IR Playbook Lab run and the practice certificate pages from the SOC Log Triage Trainer and Pick the Phish. These are practice records, not accredited or proctored credentials.

Is there an education discount or a class licence?

There is no separate education price. Pro is $5 a month or $40 a year per person, and the Team plan gives 30% off per seat from 5 seats. If you want to run a whole course on PlayCISO, contact us and tell us the class size and dates.

What data does class mode collect about students?

No accounts and no emails. The leaderboard shows only the display name a student types (email addresses and links are refused as names) with the score, grade, scenario and time. Anyone with the class code can open the board, so ask students to use a first name or a nickname.

Point your students here

The students page explains the labs, the proof they get and the free tiers in their words. The student handbook covers the first months of a security career.

For students The student handbook