Free lab · no signup · about 7 minutes
Time to Domain Admin
An automated intruder has one stolen login. GTIG and Mandiant watched one go from first account to deep access in about four hours, once in 15 minutes. Spend a budget on controls across five layers, set how fast your SOC responds, and watch the attack run minute by minute. Do you stop it — and at which stage?
00:00 · one account just got phished
An automated intruder has one stolen login. In a real case GTIG and Mandiant watched one go from first account to deep access in about four hours — once in 15 minutes. How far do your controls let it get?
You have a budget of 1000 pts to buy controls across Mandiant’s five layers, and to set how fast your SOC responds. Then the attack runs minute by minute, stage by stage. Each control blocks a stage, slows it, or raises the chance you detect and cut access in time.
Pick your org:
How the clock works
- The attack moves through six stages: recon, foothold, privilege escalation, lateral movement, persistence, exfil prep.
- Blocking controls stop a stage outright. Slowing controls multiply the minutes that stage takes. Detection controls add to the chance your SOC spots the activity.
- A detection only matters with a response time: access is cut a set number of minutes after the first detection fires. Slowing the attacker buys that response time room to land.
- You are compared with a benchmark plan — one control per layer plus a 24/7 SOC — run against the same scenario.
Illustrative teaching scenario: the orgs are fictional and every budget, minute cost and probability is a teaching figure, not a benchmark or advice. Stages and control areas follow the GTIG / Mandiant ARTEX report; no working commands, payloads or indicators are reproduced.
Questions
What is Time to Domain Admin?
A free browser game. An automated intruder starts with one stolen login. You spend an illustrative budget on security controls across five areas and set how fast your SOC responds, then a turn-based simulation runs the attack minute by minute, stage by stage. The outcome is either "stopped at stage X at minute Y" or "reached domain admin".
What are the five control areas?
They follow Mandiant’s five defensive layers: control-plane isolation (admin APIs behind jump hosts and trusted networks), short-lived credentials (roles and workload identity instead of static keys), least privilege (so a stolen account cannot self-promote), segmentation (so lateral movement is slow and noisy), and behavioural detection (alerts on control-plane velocity and mass enumeration).
How does a control change the outcome?
Each control either blocks a stage outright, multiplies the minutes that stage takes, or adds to the chance your SOC detects activity during the stages it touches. A detection does not stop the attack on its own — your SOC response time decides how many minutes later access is cut. If that cut lands before the attacker finishes a later stage, they are stopped there.
Where does the four-hour figure come from?
GTIG and Mandiant’s October 2026 report "ARTEX and Friends: Enter Agentic Offensive Frameworks" describes an automated intruder going from its first compromised account to deep system access in around four hours, and in one case as rapidly as 15 minutes. The game’s stages and control areas follow that report.
Are the numbers real?
No. The budget, the per-control cost, the minutes each stage takes and every percentage are illustrative teaching figures chosen to show the trade-offs. There are three seeded scenarios — cloud-first, AD-heavy and SaaS-centric — and the simulation is deterministic for a given run. Use your own data for real decisions.
Keep going
- Human or Agent? log lab: spot machine-speed attacks in synthetic logs.
- CISO Risk Desk: accept, mitigate, transfer or avoid, under a budget.
- Cyber War Room: lead a full incident as the CISO.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.