Lead a car factory through a cyberattack in Line Down
£1.9 billion is the estimated cost of the Jaguar Land Rover cyberattack to the UK economy. With AI now regularly outperforming humans in CTF competitions, it is worth asking: are we training security professionals for the right skills?
So I built a lab focused on the decisions that actually matter during a major cyber incident: understanding the business, working with stakeholders, managing money, people, communications and technical risk.
The scenario
You are Head of Cyber Operations at Blackthorn Motor Group, a fictional UK carmaker. It is Day Zero, 04:12, and an intrusion has just been discovered. The company makes £61m of production a day and supports 104,000 jobs across the supply chain. You have six analysts, a £4m budget, and the authority to disconnect anything in the company. Once.
Fourteen days in the simulation. Six technical consoles. Six stakeholders who can overrule you. The press, the regulator and the board all want answers. And a live economy running underneath it all.
The whole simulation runs on the server. Your browser only sees what an analyst would see, so there is no answer key hiding in the console.
A few hints
Containment is not free. The plants can stop because you cut off the systems the factory depends on, not because the attacker reached the floor. Investigate before you pull the plug.
Read the quiet signals. Sign-in logs and the rhythm of the traffic tell you more than the loudest alert.
People matter as much as packets. Keep your stakeholders informed. A good technical decision that nobody understood can still be overruled.
Why this matters
Finding the bug is one skill. Making the right call with incomplete information, a budget and people shouting at you is another. The second one is much harder to practise, and it is the one that decides how much a real attack costs.
There is no perfect score. Even a strong run loses money. But a clean, evidenced and certified response unlocks your flag.
CyberLearner.org is a free cybersecurity training platform, built on the curriculum of the International Cybersecurity Olympiad (ICO). Every lab is hands-on and runs in your browser. It is open to everyone, regardless of skill level.