Cynchor Range:
Live demo (V1)Upcoming (V2)
Cynchor
Live demo (V1)Upcoming (V2)

Prove the defense.

Live, adversarial red-vs-blue cyber range training engineered for real-time skill development in safe synthetic environments.

Test Our ProductRequest a pilot
ENTERPRISE RANGE CONSOLE (CONCEPT PREVIEW)Active Session
fintechcorp.local • Proxmox Isolated Bridge
Play-Mode Architecture:
Dimension
Facilitator-led (Instructor & Team Cohort)
Self-service (Automated Bot & Coach)
Control Authority
Session facilitator/instructor controls timeline, speed (0.5x–4x), pausing, and vector injection.
Learner controls their own shift pace, pauses locally, and navigates step-by-step at individual speed.
Adversary Behavior
Orchestrated red timeline with Game Master overrides, speed adjustments, and scripted synthetic injects.
Deterministic automated bot: advances on learner detection or escalates when detection timer elapses.
Support Delivery
Live instructor guidance, custom hints on demand, and cohort-wide discussion review.
Deterministic 3-tier hint ladder (concept → approach → syntax) with transparent XP deductions.
Post-Scenario Flow
Facilitated group debrief with scrubbable event markers, cohort leaderboard, and class telemetry comparisons.
Automated end-of-run retrospective report card with pipeline latency, missed techniques, and printable PDF/summary.
BLUE SOC ALERT QUEUE
MTTD: —
No active SOC alerts. Baseline nominal.
Telemetry Pipeline Stream
● LIVE INGEST
Listening on syslog socket 10.0.99.1:514...
BATTLE MAP: fintechcorp.local
Compromised Isolated Clean
Network Topology Map fintechcorp.local
Internet198.51.100.0/24clean
mail-gw10.0.1.10clean
ws-40210.0.2.42clean
dc-0110.0.3.5clean
srv-fin0110.0.4.100clean
DMZ: 10.0.1.0/24LAN: 10.0.2.0/24DOMAIN: 10.0.3.0/24VAULT: 10.0.4.0/24Micro-segmentation: SDN Active
Red Attack Progress0 XP
Blue Containment Score0 XP
Simulation Clock0s / 36s

Step-by-step telemetry correlation across synthetic domain fintechcorp.local (.invalid external domain).

STEP 01T1566.001

Detect

Red Action: Spearphishing lure sent from synthetic relay spoofing payroll@fintechcorp-secure.invalid.

Blue Signal: Mail filter logs cryptographic SPF/DKIM verification failure and unapproved RFC 822 sender domain.

STEP 02T1059.001

Isolate

Red Action: Target executes macro spreadsheet attempting synthetic powershell child process on ws-402.

Blue Signal: EDR fires high-severity alert. Defender triggers instant SDN firewall host drop rule on ws-402 (10.0.2.42).

STEP 03T1021.002

Mitigate

Red Action: Adversary attempts cached credential replay via SMB admin shares to reach dc-01.

Blue Signal: Defender purges Kerberos TGT tickets for compromised service accounts and blocks lateral subnet routes.

STEP 04POST-INCIDENT

Review

Debrief & Audit: Ingest timeline correlated with audit_logs records, calculating MTTD and missed sub-techniques.

Outcome: Zero lateral penetration of finance database vault. Actionable remediation steps logged.

CONCEPTUAL ARCHITECTURE DIAGRAM (FINTECHCORP.LOCAL)Step 1 Detail

Computed from the range simulation engine.

Time to Detect (MTTD)
12s

Average elapsed seconds from synthetic adversary payload execution to defender SOC alert generation.

Illustrative (synthetic data)
Time to Contain (MTTC)
32s

Duration from first anomalous indicator detection to host network isolation and ticket revocation.

Illustrative (synthetic data)
Techniques Exercised
4 MITRE Techniques

Verified ATT&CK techniques actively stimulated during the live simulation scenario.

Illustrative (synthetic data)
Techniques Missed
1 Technique (T1087)

Adversary steps that bypassed perimeter telemetry without generating a high-confidence triage alert.

Illustrative (synthetic data)

Clear distinction between what runs today and our planned cloud platform roadmap.

Live V1 Range (Current Production)

Live in V1

Proxmox-based on-premise hypervisor infrastructure running dedicated, isolated virtual machines with synthetic datasets only.

  • Isolated private bridge networking with zero production route peering.
  • All entities, credentials, and email records restricted to synthetic domain fintechcorp.local.
  • Operator-provisioned, invite-only access governed by single-use 256-bit hashed tokens.
  • Append-only audit logging with privacy-preserving one-way SHA-256 IP hashing.

Planned V2 Cloud Architecture

Upcoming (V2)
System Architecture: Coming soon — we're still building our cloud platform integration.

Scalable multi-tenant cloud cyber range designed for on-demand lab dispatching and browser-based access.

  • Browser-based access is planned for zero-footprint student workstations (nothing installed locally).
  • Zero agent footprint or compute overhead claimed on client machines.
  • Automated cloud lab teardown and micro-segmented training enclaves.

Live components active in the Proxmox virtual environment. Text-only verified specifications.

GoPhish

Live V1

Simulated phishing campaigns and lookalike email delivery across synthetic test mailboxes.

Verified in codebase

Active Directory

Live V1

Synthetic domain services (fintechcorp.local), Kerberos tickets, and LDAP directory trees.

Verified in codebase

Proxmox VE

Live V1

Virtualization hypervisor powering isolated lab node environments.

Verified in codebase

SPF / DKIM / DMARC Checks

Live V1

Cryptographic email authentication header verification and delivery policy enforcement.

Verified in codebase

Built for Your Mission

Focused workflows for students, class instructors, and SOC leadership.

Real adversary telemetry without the textbook abstraction

Step into a working SOC environment where every command generates observable forensic artifacts.

Key Operational Outcomes
  • Read real RFC 822 email headers and correlate living-off-the-land script telemetry.
  • Execute surgical endpoint containment before adversary lateral pivots reach domain controllers.
  • Build documented, verifiable operational track records with transparent skill radars.
What you see in the product:
Interactive triage queue with SLA timers
Live terminal inspecting simulated host minidumps
Personal progression radar across 6 core operational competencies

What You Can Verify Today

Transparent security claims and verified operational facts without manufactured badges or fake certifications.

Security Page
What we do not claim:
We do NOT claim SOC 2, ISO 27001, FedRAMP, or PCI-DSS certifications today. Independent third-party audit assessments are planned for future evaluation.
The cyber range never stores, ingests, or processes real enterprise customer data or production credentials. All simulated entities, mail headers, and logs are 100% synthetic (fintechcorp.local).
Our matchmaking algorithms do not claim AI-driven or skill-weighted balancing in V1; experience levels are saved to user profiles for self-organization.

Live V1 features vs. upcoming V2 cloud range capabilities.

Live Now (V1)Live in V1
  • Proxmox VE isolated training range
  • Synthetic directory & email simulation (fintechcorp.local)
  • Red vs Blue deterministic battle scenarios
  • Triage workstation mini-game with 6-axis skill radar
  • Operator invite system & append-only audit logging
Planned (V2)Upcoming (V2)
  • Cloud-hosted on-demand scalable cyber range
  • Facilitator-led live multi-squad cohort console
  • Automated adversary bot playbook runner
  • Browser-based in-range interactive student terminals
  • Self-service 3-tier deterministic hint ladder
Future RoadmapLater
  • Governance, Risk & Compliance (GRC) module — Coming soon
  • Custom student scenario authoring studio
  • Third-party SIEM forwarder connectors

Exercise Readiness Planner

Model cohort squad sizing and range concurrency requirements before running live exercises.

Planning aid, not a quote
24
4 min200 max
4 per squad
3 players6 players
90 min
30m blitz180m drill
Squads Formed6Balanced cohorts
Red/Blue Pairings3 vs 3Simultaneous matches
Sessions Needed2Both sides exercised
Total Range-Hours9 hrsLab runtime
Formula: Pure client-side arithmetic for curriculum planning. Zero pricing or commercial quote assumptions.

Request an Academic / Team Pilot

Partner with us to pilot live red-vs-blue exercises for your university cohort, bootcamp, or security operations team.

V1 Pilot Access
Notice: Requests are rate-limited to 10 submissions per minute per IP to prevent automated queue abuse.
Data minimization: Collects name & email only. Zero advertising trackers.
Architecture & Security ResourcesZero gated downloads or fake whitepapers. Direct links to live technical manifests.
Proxmox ArchitectureSecurity Posture