Free lab · no signup · about 6 minutes
Human or Agent? Machine-Speed Log Lab
Autonomous offensive AI frameworks now probe cloud accounts, fuzz web apps and sweep Active Directory faster than a person can type. Each round drops a short synthetic log on your desk. Call it: a human at a keyboard, an agentic framework at machine speed, or your own automation doing exactly what it should. The last one is the trap.
Shuffling the logs…
Why machine speed cuts both ways
Agentic frameworks like the ones GTIG and Mandiant describe in "ARTEX and Friends" compress an attack phase into seconds: the report saw 27 permission-check events in 23 seconds, a sub-second write-then-delete storage test, and command output posted to hundreds of rotating one-time callback URLs. But your backup job, CI pipeline and scanner move just as fast. So a rate threshold on its own fires on your own tools.
The job is to pair speed with the things only an attacker shows — permission sweeps on a key that never writes, counters that climb by one, error-and-retry loops, rotating callbacks — and the things that clear your own automation: a known identity, a fixed schedule, a trigger you can trace. This lab trains that judgement.
Illustrative teaching scenario: every log, company, account, IP address and timestamp is synthetic. The detection tells and the quoted figures come from the GTIG / Mandiant report cited above; no working commands, payloads or real indicators are reproduced. Use your own telemetry for real decisions.
Questions
What is the Human or Agent? log lab?
A free browser game. Each round shows a short synthetic log excerpt — cloud audit, sign-in, web server, directory or database — and you decide whether a human operator, an autonomous offensive AI framework, or your own benign automation was behind it. You also pick the tells you relied on, and get a per-round explanation.
Why is benign automation the trap?
Your own CI pipeline, backup job, vulnerability scanner and identity-sync job all move at machine speed too — bursts of API calls, bulk snapshots, sequential names. Speed alone does not prove an attack. The game forces you to use ownership and trigger context, not just rate, so you do not drown real signal in false positives.
What tells distinguish an agentic framework?
Compressed bursts of actions then long pauses; event rates no person could type; incremental names like probe-00417, probe-00418; error-then-rewrite-then-retry loops seconds apart; dry-run permission sweeps and tiny write-then-delete tests; results posted to rotating one-time callback URLs; and sub-agents overwriting each other while chasing the same goal.
Are the logs and figures real?
The logs are synthetic and summarised — no real commands, payloads or indicators. The tells and the numbers quoted in the explanations are drawn from GTIG and Mandiant’s October 2026 report "ARTEX and Friends: Enter Agentic Offensive Frameworks". The company, accounts, IP addresses and timestamps are invented for teaching.
Is it the same every time?
No. Rounds are dealt from a seeded shuffle, so each play gives a different mix of scenarios while staying balanced across human, agent and benign.
Keep going
- Time to Domain Admin: buy controls and watch an automated intruder race your SOC clock.
- Log triage labs: spot the attack in the logs, earn certificates.
- SOC Triage Trainer: work a queue of alerts under time pressure.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.