HackersRange Academy

Learn cyber by doing the real work.

One clear path from zero experience to a job-ready security specialist — offensive or defensive. Every course runs on a live company network where you work through real attacks, so by the day you finish, you have already done the job.

Enrol on the range See the learning path
Academy credentials — HackersRange Certified
HRCF HRCSA HRCIR HRCPT HRCRTO
How the academy works

Learn it. Prove it on the range.

Every track is delivered the same way: instruction frames the discipline, then the majority of your hours are spent operating a live, instrumented enterprise — assessed on evidence, not multiple choice.

01

Start at the foundation

Intro to Cyber builds the computing, networking, Linux and Windows base every specialist track assumes.

02

Choose a career branch

Move into offensive (Penetration Testing) or defensive (SOC, IR/DFIR) work — or add a cloud and OT specialization.

03

Work the live range

Browser-reachable, fully isolated environments with real adversary activity replayed in — both sides fully instrumented.

04

Earn the credential

Each track closes with a graded capstone and an HRC certification mapped to the role you are training for.

We practice what we preach

Taught by the operators who run the real engagements.

HackersEye is a working offensive and incident-response firm. The same red teamers, penetration testers, DFIR analysts and SOC operators who break into and defend live enterprises write the syllabus and teach the range — so what you learn is current tradecraft drawn from real attacks, not theory rewritten from a textbook.

Every module is reverse-engineered from work we actually do in the field — then rebuilt as something you can attack and defend on the range.

HackersEye — Offensive · IR · SOC

Red team & pentest

Full-scope adversary emulation and penetration testing against organisations that cannot afford to be wrong. The PT and Red Team tracks teach exactly this tradecraft.

Explore Prevent

SOC & detection

24/7 monitoring, detection engineering and threat hunting run for real clients — distilled into the SOC Analyst track and its hands-on capstone, scored on real work.

Explore Detect

DFIR investigations

Real incident response and digital forensics on genuinely compromised estates. The IR/DFIR track is built from those investigations, evidence and all.

Explore Respond

Crisis response

When a breach is live, our team is in the room. That front-line pressure shapes how the range replays real adversary activity for every learner.

Explore Respond
The learning path

One foundation. Two career branches.

The HackersRange ladder starts with a single mandatory on-ramp, rises into offensive and defensive specialist tracks, and tops out in advanced red team operations and DFIR — with cloud and OT specializations alongside.

Tier 0 · Foundation Intro to Cyber Cyber Foundations — the mandatory on-ramp to every specialist track. HRCF · 120 hrs · 8 weeks
Defensive branch Offensive branch
Tier 1 · Defensive SOC Analyst Security operations & defensive analysis — monitor, triage, hunt. HRCSA · 200 hrs Tier 2 · Defensive IR Specialist · DFIR Incident response & digital forensics — builds on the SOC Analyst track. HRCIR · 280 hrs Tier 1 · Offensive Penetration Testing Offensive security — recon to domain compromise, plus the report. HRCPT · 240 hrs Tier 2 · Offensive PT Expert · Red Team Advanced offensive operations & adversary emulation under active defence. HRCRTO · 320 hrs
Specialization tracks
Specialization Cloud Security Securing and attacking cloud and hybrid identity estates — a specialist track on the pathway. Pathway track
Specialization IoT / OT Security Industrial control systems and connected-device security — a specialist track on the pathway. Pathway track
Foundation (required) Defensive tracks Offensive tracks Specializations
Tracks & curriculum

What you actually learn and build.

Real modules, real hours and real outcomes from the HackersRange syllabus. Each track closes with a graded capstone on the range and an HRC credential.

Curriculum — 8 modules

FND-01Computing & Operating System Fundamentals
FND-02Networking Essentials
FND-03Linux for Security
FND-04Windows for Security
FND-05Security Fundamentals & the Threat Landscape
FND-06Web & Application Basics
FND-07Offensive vs Defensive Foundations
FND-08Tooling, Lab Discipline & Documentation

You will graduate able to

  • Reason about security at the OS, file-system, process and network level.
  • Operate confidently on the Linux and Windows command lines and script in Bash and PowerShell.
  • Capture and interpret network traffic, and complete a guided two-sided intrusion on a live range.

Tools & certification path

WiresharkKali LinuxPowerShellBashBurp SuiteVirtualBox
  • Aligns to CompTIA Security+, Network+ and ISC2 CC.

Curriculum — 12 modules

SOC-01SOC Operations & Frameworks
SOC-02Log Sources & Telemetry
SOC-03SIEM Fundamentals — Splunk & Elastic Security
SOC-04Network Security Monitoring
SOC-05Endpoint Detection & Response
SOC-06Detection Engineering
SOC-07Alert Triage & Investigation
SOC-08Cyber Threat Intelligence for the SOC
SOC-09Threat Hunting Fundamentals
SOC-10Incident Handling for Analysts
SOC-11SOAR & Automation
SOC-12Reporting, Metrics & Communication

You will graduate able to

  • Operate a SIEM and an EDR to monitor and investigate an enterprise estate.
  • Write, test and tune detections as code, including Sigma and Elastic rules.
  • Run hypothesis-driven threat hunts mapped to MITRE ATT&CK and hand off to IR.

Tools & certification path

SplunkElasticsearchKibanaSysmonZeekSuricataMISP
  • Aligns to BTL1, CompTIA CySA+ and Microsoft SC-200.

Curriculum — 12 modules

IR-01Incident Response Lifecycle & Governance
IR-02Evidence Acquisition & Forensic Soundness
IR-03Windows Forensics I — File System & Registry
IR-04Windows Forensics II — Logs, Execution & Timeline
IR-05Memory Forensics
IR-06Linux & Cloud Forensics
IR-07Network Forensics
IR-08Malware Triage & Behavioral Analysis
IR-09Email Compromise & BEC Investigations
IR-10Cyber Threat Intelligence & Attribution
IR-11Containment, Eradication & Recovery
IR-12DFIR Reporting & Expert Communication

You will graduate able to

  • Acquire evidence in a forensically sound manner with a defensible chain of custody.
  • Perform Windows, Linux, cloud, memory and network forensics to reconstruct attacker activity.
  • Reconstruct a defensible timeline and produce DFIR reporting and executive briefings.

Tools & certification path

KAPEAutopsyVolatility 3MemProcFSPlasoRegRipperM365 UAL
  • Aligns to GIAC GCFA, GCFE, GCIH and GREM (partial).

Curriculum — 13 modules

PT-01Methodology, Scoping & Ethics
PT-02Reconnaissance & OSINT
PT-03Scanning & Enumeration
PT-04Vulnerability Analysis
PT-05Exploitation Fundamentals
PT-06Web Application Pentesting I
PT-07Web Application Pentesting II
PT-08Password & Credential Attacks
PT-09Active Directory Fundamentals
PT-10Active Directory Attacks
PT-11Privilege Escalation
PT-12Post-Exploitation & Pivoting
PT-13Reporting & Remediation

You will graduate able to

  • Scope an engagement and operate within legal and ethical constraints.
  • Exploit network, web-application and Active Directory weaknesses to escalate access.
  • Move from external foothold to domain compromise and write a professional report.

Tools & certification path

NmapBurp SuiteMetasploitBloodHoundImpacketHashcatCrackMapExec
  • Aligns to OffSec OSCP, TCM PNPT, INE eJPT/eCPPT and PenTest+.

Curriculum — 11 modules

PTX-01Red Team Operations & Adversary Emulation
PTX-02Advanced Active Directory Attacks
PTX-03Advanced Kerberos & Ticket Attacks
PTX-04Evasion & Defense Bypass
PTX-05Command & Control Infrastructure
PTX-06Initial Access & Social Engineering Operations
PTX-07Advanced Web & API Exploitation
PTX-08Exploit Development Fundamentals
PTX-09Cloud & Hybrid Identity Attacks
PTX-10Lateral Movement, Persistence & Domain Dominance
PTX-11Red Team Reporting & Purple Teaming

You will graduate able to

  • Plan and run a full-scope red team engagement with adversary emulation and OPSEC.
  • Evade and operate against EDR and a live monitoring team using current tradecraft.
  • Achieve cross-forest domain dominance and deliver red and purple-team reporting.

Tools & certification path

Cobalt StrikeSliverMythicCertipyRubeusMimikatzx64dbg
  • Aligns to OffSec OSEP, Zero-Point CRTO, OSWE and Altered Security CRTP/CRTE.
Inside the platform

Every hour is spent on the range.

The academy is taught entirely on HackersRange — browser-reachable, fully isolated environments where you work real attacks and your progress is tracked, assessed and certified inside one console.

platform.hackersrange.com/student
Student dashboard
HackersRange — your scenarios in progress, resume where you left off

Your learning command centre

One workspace ties your track, scheduled labs, your own always-on range and progress together — pick up exactly where you left off, on any machine.

platform.hackersrange.com/courses
Courses & certs
HackersRange — career-path courses, module by module to an HRC certification

Courses & certifications

Modules, hands-on labs and graded capstones are organised by track, with HRC credentials issued on evidence of work completed on the range.

Evidence-based, both sides

The range captures host, network and cloud telemetry in full. Offensive learners watch what their actions leave behind; defensive learners work from the same complete record a real analyst would have. Instructors observe every environment from a console and can step in inside the same session.

Explore the range
Why train on a live range

A real enterprise, not a simplified lab.

Each track runs on a managed, fully isolated range that recreates a real estate — Windows AD, production-grade EDR, network sensors, a SIEM stack and a cloud tenant — with genuine adversary activity replayed in.

Browser-reachable

Open the range straight in your browser — no client, no install, available from any machine.

Safe by design

Segmented from any production network. Each team runs on its own instance and any host can be reset on demand.

Full telemetry

Host, network and cloud activity captured in full — so an attack and its evidence are visible at the same time.

Your range stays yours

You keep your own range for the whole track — repeat a lab, finish a challenge or practise whenever it suits you.

For teams & enterprises

Workforce capability you can actually measure.

The academy is built for individuals starting a career and for security leaders building one inside their organisation — with skill validated on evidence of real work, not attendance.

Career starters

Begin with no prior security knowledge and follow one deliberate line to a job-ready specialism — every hour spent operating a live enterprise, not watching slides.

SOC & security teams

Ramp analysts and responders on the same tooling and adversary activity they will face in production — and close known gaps with the track that maps to the role.

Security leaders

Give CISOs and team leads a defensible, evidence-based view of who can do the work — with team tracking, role-aligned paths and credentials mapped to recognised standards.

Business outcomes

What it changes for the organisation.

Faster ramp to productive

Structured, hands-on tracks shorten the path from hire to contributing on real work, on real tooling.

Skill validated on evidence

Graded capstones on the range certify what a person can actually do — not what a multiple-choice exam guessed.

Coverage across the team

One foundation feeds offensive, defensive, cloud and OT tracks — so capability scales across the whole function.

Mapped to recognised standards

HRC credentials align to industry certifications and MITRE ATT&CK, giving leaders a common language for capability.

Talk about team training Explore the range Team enrolment, role-aligned tracks and progress reporting.

Start at the foundation. Graduate job-ready.

Enrol on the range to begin Intro to Cyber, or talk to us about team training and the right specialist track for your people.

Enrol on the range Book a demo