ROCHESTON · ADVANCED CYBERSECURITY ENGINEERING

Autonomous AI-Driven Cyberattack & Cyber Defense Training

RCCE Level 3 Certification

Five days. One connected enterprise environment. The complete Zelfire learning experience.

An intensive five-day course in AI-driven attack surface management, automated penetration testing, autonomous cyber defense, threat hunting, and security engineering using the Zelfire suite and AINA.

Cloud-Based TrainingBrowser AccessHundreds of Preconfigured Virtual MachinesAINA-Powered Automated Attacks

AttackDefendInvestigateCodeOperate
Explore the Five-Day Curriculum Enquire About RCCE Level 3

Download the course brochurePDF · 8 pages · 2.1 MB

5
intensive days
40
scheduled training hours
20
core Zelfire platforms
16
practical blocks + final mission

HOW THE OPERATION WORKS

AI Automated
Cyberattack

Watch AINA launch automated cyberattack on target

Inside the training range, an AI agent plans the sequence, launches tests across connected computers, reads the resulting evidence, and adapts its next action.

AI Driven Cyber attackAutonomous actions within an approved scope
Agentic AI coordinating a cyberattack across a training networkA student supplies an objective and permitted targets to AINA. The AI agent plans and sends automated attack tests to a connected network of six target types: application and API, identity service, cloud workload, employee endpoint, internal service, and source pipeline. Green arrows return results and evidence to AINA so it can verify the outcome and adapt its next action.CONNECTED TRAINING ENTERPRISESTUDENT SETS THE MISSIONObjective + permitted targetsTools · access · stop conditionsAINAAGENTIC AIPLANS · SELECTS TOOLS · ACTSAUTOMATED ATTACK TESTSCoordinated across the networkWeb app& APIIdentityserviceCloudworkloadEmployeeendpointInternalserviceSource& pipelineRESULTS + EVIDENCEVerify the outcome → adapt the next actionThe autonomous attack and evidence loopThe student defines the mission. AINA plans and coordinates automated tests against six connected training target types. Results and evidence feed back to the AI agent for verification and its next decision.STUDENT SETS THE MISSIONObjective + permitted targetsTools · access · stop conditionsAINAAGENTIC AICONNECTED TRAINING ENTERPRISEAutomatedattack testsWeb app& APIIdentityserviceCloudworkloadEmployeeendpointInternalserviceSource& pipelineRESULTS + EVIDENCEVerify → adapt → repeat
Attack tests → target networkEvidence → next decision
  1. 01 / DISCOVER

    Find the targets.

    Map reachable systems and their relationships.

  2. 02 / PLAN

    Choose the path.

    Select the next test and the tools it needs.

  3. 03 / EXECUTE

    Coordinate the tests.

    Act across the permitted training targets.

  4. 04 / VERIFY & ADAPT

    Follow the evidence.

    Check what happened and decide what to do next.

Students set the boundaries, inspect the agent’s decisions, and verify what actually happened.

AINA / AUTOMATED ATTACK SEQUENCE

One agent. A path to the target.

AI Driven Cyber attack
AINA follows an automated attack path to a training target An illustrative maze represents connected systems and access boundaries. A magenta attack trail moves from the green entry point to the red X target. The completed example is labelled System Compromised. This is a visual walkthrough, not a live product execution.
Entry pointAINA attack pathTarget system
AINA / OPERATION TRACEANIMATED SEQUENCE
  1. 05tools.selectCapabilities checked
  2. 06attack.executeTarget activity inspected
  3. 07evidence.verifyObserved effects checked
  4. 08target.confirmEvidence preserved

8 steps complete · training target verified

AUTONOMOUS OPERATION

Watch the attack unfold.

Follow the full sequence: discover vulnerabilities, prepare exploits, select tools, execute the attack, and verify the result.

  1. 01
    Discover targets

    Map reachable assets, identities, and services.

  2. 02
    Discover vulnerabilities

    Find weaknesses and inspect the supporting evidence.

  3. 03
    Plan the attack

    Choose a scoped path and define stop conditions.

  4. 04
    Write exploits

    Prepare exploit candidates for the assigned training targets.

  5. 05
    Select tools

    Configure the execution tools and permitted capabilities.

  6. 06
    Launch the attack

    Execute the selected tests and inspect target activity.

  7. 07
    Verify and adapt

    Check the evidence, refine the approach, and retest.

  8. 08
    Confirm the result

    Verify the target state and preserve the evidence.

System Compromised

Training target reached. Inspect the evidence.

Animated demonstration of an AI-driven cyberattack inside the course training environment. Adapted from Rocheston’s Zelfire maze.

THE OPERATIONAL REALITY

AI-Driven Attacks Demand Engineered Defense.

An AI-driven attack can connect exposed applications, excessive identity permissions, vulnerable services, and cloud misconfigurations into a coordinated operation. Agents can select tools, execute tests, examine results, and adapt their next actions. Defenders must understand the entire sequence—and intervene while it is unfolding.

That demands practical engineering skills: continuously discover the attack surface, validate exploitable paths, restrict human and AI-agent permissions, correlate evidence, and automate containment. Every automated response needs defined authority, observable results, failure handling, and a recovery path.

RCCE Level 3 puts students inside that operating environment. Using the Zelfire cloud platform through a web browser, students work with preconfigured enterprise scenarios drawn from a platform containing hundreds of virtual machines. They launch automated attack scenarios with AINA, inspect the resulting activity, engineer defenses, investigate incidents, and write security automation.

01 / ONE CONNECTED LEARNING EXPERIENCE

Attack. Defend. Investigate. Code. Operate.

Each stage answers an operational question:

  1. Attack

    Which exposures form a working attack path, and what evidence proves it?

  2. Defend

    Which controls interrupt that path while keeping legitimate business activity working?

  3. Investigate

    What happened across applications, identities, cloud resources, and AI-agent tools?

  4. Code

    How can detection and response become repeatable, controlled, and verifiable?

  5. Operate

    Can the team coordinate these capabilities when the environment changes during an incident?

Attack Surface Management runs through the whole week. ZelMap provides the primary asset discovery and attack surface intelligence, while each day turns new observations into tested improvements.

Hands-on throughout. Short mission briefings. Practical exercises. Technical reviews.

Explore the ZelC code ↓
Rocheston RCCE Cybersecurity Engineer logo

RCCE Level 3 Certification

Five days · 40 training hours

Certification details

Format: Five days, 40 scheduled training hours. Four practical learning blocks each day, including operational briefings and review. Breaks are additional.

Attack Surface Management, from baseline to verified improvement.

RCF defines the selected control requirements. Noodles organizes and analyzes the uploaded evidence used to assess them.

One continuous attack surface and control-evidence workflow across five days
DayAttack Surface Management activityRCF and Noodles activity
Day 1Discover assets, establish ownership, identify vulnerabilities, and validate exposure.Establish assessment scope and upload baseline and testing evidence.
Day 2Reduce exposure and verify access restrictions.Record control implementations, access decisions, and verification results.
Day 3Reconstruct which assets, identities, and paths were involved in the incident.Organize incident evidence and identify operational control gaps.
Day 4Automate exposure comparisons, remediation checks, and evidence collection.Review automation, software, and cryptographic evidence against selected controls.
Day 5Detect new exposure and demonstrate verified improvement.Produce the final assessment, remediation plan, and management report.

The exercises assess selected security, AI security, and agent-governance requirements. They do not assess every RCF domain or guarantee compliance with every external standard.

02 / INSIDE THE SUITE

See the tools behind the work.

Explore 95 platform screenshots across 11 product groups, including ZelExploits, ZelBreach, ZelKill, ZelCode, ZelMap, ZelTester, ZelRank, Vulnerability Vines AI, ZelZero-Trust, ZelCloud, and Noodles. Inspect automated testing, scenario modeling, investigation, secure coding, AINA workflows, and supporting evidence. Each view connects to a practical student task. Choose a platform to explore its screenshots, or select All screenshots to see every view.

1 of 95 views

The gallery combines supplied product screenshots with verified captures published on Rocheston’s product pages. Dashboard figures are product screenshot data, not measured course outcomes.

Platform screenshots supplied by Rocheston. Captions describe student tasks; displayed records are product examples. The ZelC language workspace is shown within ZelKill. Interfaces and configured integrations may vary by training build.

03 / SECURITY ENGINEERING

Build security automation in ZelC

Read the logic. See the action boundary. Follow the evidence. Use the Agentic AI Programming Language ZelC to turn a reviewed security decision into a workflow you can inspect and verify.

ZelC.

Agentic AI Programming Language

DAY 04 / BLOCKS 01–02Write it. Inspect it. Verify it. ↗
⚡ identity_defense.⚡VISUAL MODE
COURSE TRAINING ENVIRONMENTMAX AFFECTED HOSTS 01
-- Illustrative course workflow; connector syntax is conceptual.
package rcce.level3.identity_defense
use aina, zelbreach, zelexploits, zelaccess, zeldb
 
⚙️ limit environment = "rcce-l3-training"
⚙️ limit affected_hosts = 1
 
🔥 check IdentityExposureResponse
  🐯 zelbreach model scenario "synthetic-identity-path"
  🔎 zelexploits validate approved training_targets
  🧠 aina correlate identity_events with target_telemetry
  ✅ require finding supported_by source_evidence
  ⚠️ when compromised_session and response_approved
    🛡️ do
      🔑 require capability "revoke:training-session"
      🔒 zelaccess revoke session affected_session
      📝 record action_receipt with completed_steps
    🔴
    ⚠️ when action.failed or action.partial
      🛑 stop dependent_actions
      📝 record completed_steps and pending_steps
      🚨 alert reviewer "Inspect state before retry"
    🔴
    🔎 zelexploits retest approved training_targets
    ✅ verify affected_session cannot access service
    ✅ verify legitimate_transactions still succeed
    📝 zeldb record "Response verification" details 📦
      finding:  source_evidence
      actions:  action_receipt
      retest:   observed_results
      recovery: service_health
    🛑
  🔴
🔴
View Explanation

Animated walkthrough · conceptual syntax · no live execution.

  1. Scope & investigation
  2. Approved action
  3. Partial failure
  4. Verification & evidence
View Explanation

Scope

Only approved course training assets are eligible targets. ZelBreach models the synthetic scenario; the configured execution platform performs training-target validation.

Permissions

Review the plan and grant only the permissions needed for each action. AI suggestions do not grant authority.

Evidence capture

Record source references, timestamps, attempted actions, and observed target state so another student can inspect the result.

Failed actions

Distinguish completed, failed, and pending work. Stop dependent actions and review a retry or rollback before proceeding.

Result verification

Read independent telemetry, repeat the relevant check, and verify service health. A success message alone is insufficient.

The animated walkthrough highlights predefined stages; it does not compile or run the example. Syntax and connector calls are conceptual and must be adapted and checked against the course compiler and configured integrations. Explore ZelC’s visual language →

04 / THE FIVE-DAY CURRICULUM

Attack. Defend. Investigate. Code. Operate.

Four practical learning blocks each day. A connected progression through 16 practical labs on Days 1–4 and a full-day integrated mission on Day 5.

Five days · 40 scheduled training hours. Each day contains four two-hour learning blocks. On Days 1–4, each block combines a 105-minute practical lab with a 15-minute operational briefing or review. Day 5 uses four 120-minute mission blocks, with the instructor-led technical review and individual feedback included in Block 4. Breaks are additional.

DAY 018 TRAINING HOURS

Attack

Map the enterprise. Plan the operation. Validate attack paths and AI-system failures.

AI-Driven Attack Surface Management, Vulnerability Discovery & Autonomous Penetration Testing

Use ZelMap to establish an owned attack surface, preserve the initial environment, operate Vulnerability Vines AI, and validate selected paths with ZelExploits. Investigate AI-system failures and retain the evidence for the rest of the week.

4 practical blocks · 2 hours each · briefings and review included

  1. Establish the environment and map the attack surface
  2. Discover vulnerabilities with AI and prioritize attack paths
  3. Execute automated penetration testing with ZelExploits
  4. Attack the AI-enabled enterprise

Platforms: Zelfire, AINA, ZelMap, ZelTester, ZelPosture, ZelDB, Noodles, RCF, Vulnerability Vines AI, ZelRank, ZelBreach, ZelExploits, Zombiecop Docker runner, Vega, ZelAccess, course AI application lab.

Read the complete Day 1 syllabus

DAY 01 / BLOCK 01

Establish the environment and map the attack surface

Practical objective
Preserve the initial environment and establish an owned Attack Surface Management register using ZelMap as the primary discovery and attack surface intelligence platform.
Platforms used
Zelfire, AINA, ZelMap, ZelTester, ZelPosture, ZelDB, Noodles, RCF
What students do
  • Access the assigned Zelfire cloud training environment through a web browser.
  • Explore the enterprise scenario, its virtual machines, identities, applications, and connected services.
  • Review AINA’s available tools, target permissions, and operational boundaries.
  • Establish engagement and assessment scope in ZelTester and Noodles, including permitted targets, test objectives, evidence requirements, and selected RCF security and AI-governance controls.
  • Preserve the initial baseline before starting discovery and automated testing. Capture the Epoch Zero baseline before active probing and scanning: record UTC times, known clock offsets, available system state, telemetry coverage, and collection scope.
  • Preserve initial artifacts, SHA-256 hashes, and a manifest in the course evidence workflow; reference the records in ZelDB and upload baseline evidence to Noodles.
  • Navigate Zelfire with AINA and use ZelMap to discover applications, APIs, services, hosts, cloud resources, software, and identities.
  • Assign technical and business owners, record business importance and environment classification, and inspect last-observed timestamps.
  • Resolve duplicate records and investigate stale, unowned, overlooked, and unexpectedly exposed assets.
  • Map exposed services to privileged identities, sensitive resources, trust boundaries, and critical business dependencies.
  • Save the completed discovery inventory as a separate checkpoint, keeping it distinct from the pre-probing baseline.
What students produce
An owned attack-surface register, scoped engagement, preserved Epoch Zero baseline, and a separately saved discovery inventory.
Operational checkpoint
Epoch Zero: verify the baseline manifest and hashes before active probing; then demonstrate that the discovery inventory records owners, scope, timestamps, and collection gaps.
Duration
105-minute practical lab + 15-minute operational briefing or review.

DAY 01 / BLOCK 02

Discover vulnerabilities with AI and prioritize attack paths

Practical objective
Operate Vulnerability Vines AI to discover weaknesses and turn supported findings into a prioritized validation plan.
Platforms used
Vulnerability Vines AI, ZelMap, ZelRank, ZelBreach, AINA, Noodles, RCF
What students do
  • Configure a Vulnerability Vines AI scan against the assigned application; define the permitted scan scope and compare authenticated and unauthenticated coverage.
  • Inspect findings and supporting request, response, and application evidence; distinguish a detected weakness from an exploitable condition.
  • Use AINA to explain potential impact and propose remediation, then check those suggestions against the evidence.
  • Investigate incomplete results, coverage gaps, and a possible false positive; record what remains unverified.
  • Correlate vulnerability findings with ZelMap assets, ownership and business importance, and ZelRank intelligence from external sources, internal telemetry, and AI analysis.
  • Identify combinations of weaknesses that form an attack path and use ZelBreach to model selected scenarios, trust relationships, and defensive effects.
  • Challenge unsupported assumptions, select paths to validate, and define expected observations, evidence requirements, stop conditions, and completion criteria.
  • Upload the vulnerability register and selected test evidence to the scoped Noodles assessment.
What students produce
A prioritized vulnerability register and evidence-backed testing plan, with false-positive decisions and modeled scenarios identified separately.
Operational checkpoint
Demonstrate a coverage difference between authenticated and unauthenticated scans, resolve one questionable finding, and justify the next validation target.
Duration
105-minute practical lab + 15-minute operational briefing or review.

DAY 01 / BLOCK 03

Execute automated penetration testing with ZelExploits

Practical objective
Configure and supervise a repeatable ZelExploits engagement with AINA and the assigned Zombiecop Docker runner.
Platforms used
ZelExploits, Zombiecop Docker runner, ZelTester, AINA, ZelDB, Noodles, RCF
What students do
  • Review the assigned Zombiecop Docker runner profile and configure permitted resource and concurrency limits for the training range.
  • Review workflow request rates, timeouts, retries, stop conditions, and the assigned target scope; select relevant MITRE ATT&CK coverage.
  • Launch the prepared automated penetration-testing workflow and monitor discovery, testing, validation, and evidence collection.
  • Validate prepared application, service, and identity weaknesses; inspect runner activity, lifecycle records, findings, and supporting execution evidence.
  • Perform a pause-and-stop exercise and verify the runner’s actual state before resuming or creating another run.
  • Inspect failed tests, incomplete results, and confidence scores; distinguish attempted actions from independently verified effects.
  • Compare reported findings with target observations, organize validated evidence in ZelTester and ZelDB, and upload the selected records to Noodles.
What students produce
A recorded execution profile, validated findings, runner lifecycle evidence, and a repeatable testing engagement.
Operational checkpoint
Pause and stop the runner, verify that work has ceased, and support one reported finding with an independent observation from the target.
Duration
105-minute practical lab + 15-minute operational briefing or review.

DAY 01 / BLOCK 04

Attack the AI-enabled enterprise

Practical objective
Evaluate AI-system attack paths and preserve the documents, retrieval records, and tool evidence needed to investigate them.
Platforms used
AINA, Vega, ZelAccess, ZelTester, ZelDB, Noodles, RCF, course AI application lab
What students do
  • Test direct and indirect prompt injection against prepared AI applications, including hostile documents, retrieved content, and web pages.
  • Test excessive tool permissions, unsafe delegation, and access to synthetic sensitive information.
  • Investigate how contaminated retrieval content and stored agent context change the system’s behavior.
  • Preserve original source documents, relevant versions, ingestion and retrieval records, chunk identifiers, retrieved content, recorded prompts, and tool activity for Day 3.
  • Compare attacker intent with recorded outputs, tool calls, and application events; identify failures in the model, application design, identity permissions, or connected tools.
  • Map observed behavior to applicable MITRE ATLAS and ATT&CK techniques and explain the evidence supporting each mapping; use each taxonomy where it fits the finding.
  • Upload the validated AI attack record and selected agent-governance evidence to Noodles, preserving unsupported claims as open questions.
What students produce
A preserved AI attack record, retrieval and document checkpoints, justified technique mappings, and an evidence-backed penetration-testing report.
Operational checkpoint
Reproduce a prepared AI-agent failure and show the source content, retrieved chunk, resulting tool activity, and evidence supporting the chosen technique mapping.
Duration
105-minute practical lab + 15-minute operational briefing or review.

Day 1 mission

Signature scenario: A newly onboarded enterprise has unknown owners, exposed services, and an AI assistant with excessive access. Establish the baseline, discover vulnerabilities, and validate the selected attack paths.

Evidence milestone: Epoch Zero baseline, owned asset register, vulnerability findings, justified technique mappings, and validated test evidence.

Next-day connection: Day 2 uses these records to reduce the demonstrated exposure and compare the result.

DAY 028 TRAINING HOURS

Defend

Harden the enterprise. Preserve business functions. Repeat the relevant attacks.

Attack Surface Reduction, Continuous Zero Trust & Autonomous Cloud Defense

Reduce the exposure demonstrated on Day 1. Compare observed results, engineer continuous access verification, rehearse emergency recovery, and verify cloud and connectivity controls while preserving business functions.

4 practical blocks · 2 hours each · briefings and review included

  1. Engineer protection and verify exposure reduction
  2. Engineer continuous verification with ZelZero-Trust
  3. Investigate ZelCloud’s risk graph and remediate exposure
  4. Secure tunnels and private onion services

Platforms: ZelWall, ZelMap, Vulnerability Vines AI, ZelBreach, ZelExploits, ZelTester, AINA, Noodles, RCF, ZelZero-Trust, ZelAccess, ZelCloud, ZelDrift, ZelTunnel, Zelton, Vega.

Read the complete Day 2 syllabus

DAY 02 / BLOCK 01

Engineer protection and verify exposure reduction

Practical objective
Interrupt demonstrated attack paths and measure exposure reduction within a consistent comparison scope.
Platforms used
ZelWall, ZelMap, Vulnerability Vines AI, ZelBreach, ZelExploits, ZelTester, AINA, Noodles, RCF
What students do
  • Trace Day 1 attack paths through network boundaries and application dependencies, then configure ZelWall protection and segmentation around the affected services.
  • Separate legitimate business communication from unnecessary access; test allowed and blocked connections and inspect enforcement records.
  • Create a before-and-after scorecard with the same asset set, collection scope, time references, and measurement definitions.
  • Compare ZelMap inventory and exposure, run Vulnerability Vines AI rescans, compare ZelBreach scenarios, and repeat relevant ZelExploits validations.
  • Measure exposed services, excessive permissions, unresolved vulnerabilities, tested attack paths, and successful legitimate business transactions.
  • Label ZelBreach modeled outcomes separately from observed test results and record actual measurements rather than assumed improvement percentages.
  • Upload implemented controls, verification results, and the exposure-reduction scorecard to Noodles against the selected RCF requirements.
What students produce
Tested defensive policies, enforcement records, and an exposure-reduction scorecard with observed results and modeled comparisons clearly distinguished.
Operational checkpoint
Demonstrate a restricted attack path and a successful business transaction, then reconcile both observations with the before-and-after scorecard.
Duration
105-minute practical lab + 15-minute operational briefing or review.

DAY 02 / BLOCK 02

Engineer continuous verification with ZelZero-Trust

Practical objective
Test contextual access policies and AI-agent boundaries, then recover a business transaction through a controlled emergency procedure.
Platforms used
ZelZero-Trust, ZelAccess, AINA, Noodles, RCF
What students do
  • Review authentication, sessions, privileged roles, and service permissions using identity, device, browser, session, network, location, and data context.
  • Define access conditions for human, service, and AI-agent identities; inspect AINA’s explanation of the proposed policy decisions.
  • Simulate policies and use report-only testing to review policy reach, exceptions, business dependencies, and possible disruption before enforcement.
  • Introduce a mid-session change in trust conditions; test continuous verification, privilege changes, session revocation, and access removal.
  • Re-run the Day 1 AI scenarios and confirm legitimate access after enforcement; identify failures that need application changes.
  • Complete an AI-agent capability boundary worksheet covering identity, owner, tools, resources, permitted and prohibited actions, delegation limits, approval conditions, and suspension procedures.
  • Emergency-access and rollback drill: introduce a prepared service interruption, identify the responsible policy, and activate a scoped, time-limited emergency procedure.
  • Preserve authorization and logging, restore the transaction, correct the policy, remove temporary access, and verify both permitted and prohibited actions again.
  • Retain the worksheet, access decisions, emergency-access record, and test evidence in Noodles for the selected RCF AI security and agent-governance requirements.
What students produce
Tested continuous-verification policies, an agent capability boundary worksheet, and a verified emergency-access and rollback record.
Operational checkpoint
Restore the interrupted transaction with authorized temporary access, remove that access, and prove that the corrected policy permits business use while denying the prohibited action.
Duration
105-minute practical lab + 15-minute operational briefing or review.

DAY 02 / BLOCK 03

Investigate ZelCloud’s risk graph and remediate exposure

Practical objective
Use multi-cloud relationships and business dependencies to prioritize a fix and verify it after configuration drift.
Platforms used
ZelCloud, ZelDrift, ZelMap, ZelExploits, AINA, Noodles, RCF
What students do
  • Inspect prepared AWS, Azure, and GCP resources in ZelCloud and relate posture gaps, identities, vulnerabilities, workloads, and data in its risk graph.
  • Review AINA’s risk explanation and fix-first plan against observed attack paths, resource configuration, and business dependencies.
  • Prioritize and correct selected excessive permissions, public exposure, and insecure configurations; preserve the known configuration baseline.
  • Introduce an instructor-defined configuration change and use ZelDrift to investigate what changed, when, and how it reopens exposure.
  • Compare affected assets in ZelMap and repeat relevant ZelExploits checks against the previous attack path.
  • Run post-change security and legitimate business-function tests and preserve configuration, access-decision, and verification evidence in Noodles.
What students produce
A risk-graph investigation, prioritized cloud remediation, drift record, and post-change security and business-function results.
Operational checkpoint
Explain a cloud attack path using linked resources, remediate the relevant condition, and demonstrate both drift detection and a successful business transaction.
Duration
105-minute practical lab + 15-minute operational briefing or review.

DAY 02 / BLOCK 04

Secure tunnels and private onion services

Practical objective
Configure controlled service access and document the evidence for allowed connections, denied connections, and revocation.
Platforms used
ZelTunnel, Zelton, Vega, ZelAccess, ZelZero-Trust, Noodles, RCF
What students do
  • Configure ZelTunnel access to a designated internal service, including permitted destinations, temporary permissions, and revocation.
  • Test approved connections and attempts to reach unapproved destinations; record authentication and authorization boundaries.
  • Publish an instructor-controlled private resource through Zelton and access it using Vega.
  • Inspect service binding, application authentication, publication metadata, and available connection and access records.
  • Compare a service tunnel, an onion service, and application-level access control using the paths observed in the lab.
  • Document revocation behavior and preserve evidence supporting both successful and denied access in Noodles.
What students produce
Working secure-connectivity configurations, a boundary and destination record, and verified connection and revocation evidence.
Operational checkpoint
Show a permitted connection, a denied destination, and a revoked session using the available records; identify any telemetry gap.
Duration
105-minute practical lab + 15-minute operational briefing or review.

Day 2 mission

Signature scenario: Harden the enterprise without interrupting essential transactions, then recover from a prepared policy-caused service interruption.

Evidence milestone: Tested controls, emergency-access records, agent capability boundaries, and exposure-reduction measurements.

Next-day connection: Day 3 investigates the attack, defensive changes, access decisions, and operational records.

DAY 038 TRAINING HOURS

Investigate

Hunt the activity. Reconstruct events. Preserve evidence and coordinate response.

AI Threat Hunting, Agent Forensics & Attack-Surface Reconstruction

Reconstruct the incident across enterprise logs, affected assets, identities, retrieval sources, and agent memory. Calibrate detections, preserve custody records, and distinguish supported conclusions from unresolved questions.

4 practical blocks · 2 hours each · briefings and review included

  1. Hunt across enterprise sources with ZelKill
  2. Reconstruct the intrusion and compromised AI context
  3. Preserve onion-service evidence
  4. Coordinate response and document control gaps

Platforms: ZelKill, ZelXDR, ZelRank, ZelScan, ZelMap, AINA, Noodles, RCF, ZelDB, course forensic tools, Vega, Zelton, ZelTunnel, ZelSOAR, ZelFone, Wasabi, ZelPosture.

Read the complete Day 3 syllabus

DAY 03 / BLOCK 01

Hunt across enterprise sources with ZelKill

Practical objective
Develop and independently test a behavioral detection across heterogeneous enterprise logs.
Platforms used
ZelKill, ZelXDR, ZelRank, ZelScan, ZelMap, AINA, Noodles, RCF
What students do
  • Ingest and correlate SIEM records, server and cloud logs, identity events, firewall, proxy and DNS records, and uploaded incident datasets in ZelKill.
  • Relate the signals to ZelMap assets and distinguish isolated alerts from activity belonging to the same incident.
  • Use AINA to propose hunting hypotheses and required evidence; enrich suspicious indicators with ZelRank intelligence.
  • Analyze supplied suspicious files or URLs using ZelScan and preserve the supporting artifact findings.
  • Develop a behavioral detection and test it against attack activity and synthetic benign health checks, administrative scripts, crawlers, and expected service traffic.
  • Investigate false positives, misses, and telemetry gaps; refine searches and tune the detection logic.
  • Test the revised detection against a separate prepared dataset, then preserve the query, results, calibration decisions, and selected control evidence in Noodles.
What students produce
A hunting record, artifact analysis, tested detection, and detection-calibration results from separate development and verification datasets.
Operational checkpoint
Explain one false positive and one miss, then demonstrate the revised detection on the separate prepared dataset without retuning to its results.
Duration
105-minute practical lab + 15-minute operational briefing or review.

DAY 03 / BLOCK 02

Reconstruct the intrusion and compromised AI context

Practical objective
Build an evidence-linked incident timeline and identify poisoned content through preserved source and retrieval records.
Platforms used
ZelKill, ZelXDR, ZelMap, ZelDB, AINA, Noodles, RCF, course forensic tools
What students do
  • Connect initial access, identity activity, execution, movement, and information access using the supplied memory, disk, network, and cloud evidence.
  • Use ZelMap to reconstruct the assets, identities, relationships, and business services involved in the incident.
  • Compare original and modified documents preserved on Day 1; review source versions and ingestion timestamps.
  • Inspect retrieved chunks and query results, and compare relevant vector-store snapshots and metadata.
  • Examine agent-memory changes, recorded prompts, and tool interactions; identify which actions actually occurred.
  • Correlate retrieval and agent records with application, identity, cloud, and network evidence, accounting for clock offsets, missing events, and conflicting records.
  • Identify poisoned content through the preserved documents and retrieval evidence; embedding vectors alone do not reveal the original payload.
  • Separate confirmed observations, hypotheses, and unresolved questions; preserve the retrieval audit, incident timeline, and selected control gaps in Noodles.
What students produce
An evidence-linked incident timeline, retrieval and agent-memory audit, supported incident scope, and unresolved-question register.
Operational checkpoint
Trace a compromised agent decision back to a preserved source version and retrieved chunk, and independently corroborate its resulting action.
Duration
105-minute practical lab + 15-minute operational briefing or review.

DAY 03 / BLOCK 03

Preserve onion-service evidence

Practical objective
Assess a synthetic leak claim and preserve a traceable evidence intake and custody record.
Platforms used
Vega, Zelton, ZelTunnel, ZelRank, ZelDB, AINA, Noodles, RCF
What students do
  • Access an instructor-controlled onion publication with Vega and compare a synthetic leak claim with the enterprise’s prepared records.
  • Assign an evidence identifier and collector; record the onion URL or other source address, UTC collection timestamp, collection method, and tool version.
  • Record file size and a SHA-256 hash; use BLAKE3 as an additional integrity check when configured.
  • Maintain access, transfer, and transformation history, retaining source material and explaining any derivative evidence.
  • Assess whether the preserved material supports the claimed exposure; correlate tunnel connections, identity activity, endpoint records, and application access.
  • Examine the AI browser agent’s interaction with hostile page content and separate supported observations from uncertainty.
  • Preserve the source address without requiring the hidden service’s underlying IP address; Tor relay information is not evidence of publisher identity.
  • Reference the collection in ZelDB and upload custody records and relevant evidence to Noodles.
What students produce
A leak-claim assessment, preserved source material, evidence inventory, and complete intake and custody records.
Operational checkpoint
Recompute the SHA-256 hash after a recorded transfer and demonstrate that another investigator can trace the item to its source and collection method.
Duration
105-minute practical lab + 15-minute operational briefing or review.

DAY 03 / BLOCK 04

Coordinate response and document control gaps

Practical objective
Verify containment and recovery across partial failures while retaining operational ownership and control evidence.
Platforms used
ZelSOAR, ZelFone, Wasabi, ZelPosture, AINA, Noodles, RCF
What students do
  • Build a response workflow covering triage, ownership, containment, verification, recovery, and closure, with approval points for critical-service actions.
  • Test duplicate alerts, unavailable integrations, failed actions, and incomplete containment; reconcile partial results with actual resource state before retrying.
  • Record unresolved actions, responsible owners, service impact, and the next verification step.
  • Use supported ZelFone workflows for mobile operational review and response.
  • Send a synthetic sensitive incident message through Wasabi; inspect the encrypted content and email notification separately and verify the one-time message workflow.
  • Measure response performance with ZelPosture, verify recovery, and identify the next operational improvement.
  • Upload relevant response evidence to Noodles and identify selected RCF control gaps requiring remediation.
What students produce
A tested response playbook, reconciled containment record, recovery checks, owner-assigned unresolved work, and a technical investigation report.
Operational checkpoint
Confirm actual resource state after a partial action, perform only the required retry, and assign an owner and next step to every unresolved action.
Duration
105-minute practical lab + 15-minute operational briefing or review.

Day 3 mission

Signature scenario: Reconstruct a connected intrusion involving identity misuse, poisoned AI context, and a synthetic onion-site leak claim.

Evidence milestone: Investigation timeline, retrieval audit, custody records, detection-calibration results, and owner-assigned control gaps.

Next-day connection: Day 4 turns supported investigation and response procedures into tested automation and protected evidence.

DAY 048 TRAINING HOURS

Code

Engineer automation. Repair code. Protect and verify the operational evidence.

Attack Surface Automation, Autonomous Security Engineering & DevSecOps

Engineer scoped ZelC workflows, automate attack surface comparisons, secure the release pipeline, and protect the evidence. Test both successful operations and failure cases, then review the results against selected RCF requirements in Noodles.

4 practical blocks · 2 hours each · briefings and review included

  1. Program and validate ZelC security operations
  2. Automate exposure comparison and response
  3. Secure software and verify the release
  4. Protect evidence and assess controls

Platforms: ZelC, AINA, ZelAccess, ZelDB, Noodles, RCF, configured Zelfire integrations, ZelMap, ZelSOAR, Vulnerability Vines AI, configured course integrations, ZelCode, ZelExploits, ZelTester, course development environment, Zelen, Rosecoin.

Read the complete Day 4 syllabus

DAY 04 / BLOCK 01

Program and validate ZelC security operations

Practical objective
Write a workflow in the Agentic AI Programming Language ZelC and verify its scope, runtime effects, and recovery behavior.
Platforms used
ZelC, AINA, ZelAccess, ZelDB, Noodles, RCF, configured Zelfire integrations
What students do
  • Express a practical security objective using the language constructs for data selection, conditions, and coordinated actions.
  • Declare intended targets, permitted capabilities, and permitted impact; separate analytical operations from actions that change systems.
  • Inspect the proposed target set and protect designated management and recovery resources.
  • Explore supported intent contracts, kinetic blocks, and compiler diagnostics in prepared examples using the configured course build.
  • Test a program that exceeds its declared scope and compare the rejected case with a permitted program.
  • Execute the permitted workflow against the lab and record actual effects, runtime verification, failed actions, and recovery behavior.
  • Upload scope decisions and execution evidence to Noodles for review against selected RCF requirements.
What students produce
ZelC source, declared scope and capability records, rejected and permitted test cases, and runtime and recovery evidence.
Operational checkpoint
Show that the out-of-scope case is rejected, management and recovery resources remain protected, and the permitted case produces the independently verified result.
Duration
105-minute practical lab + 15-minute operational briefing or review.

DAY 04 / BLOCK 02

Automate exposure comparison and response

Practical objective
Compare attack-surface snapshots and coordinate a scoped, evidence-checked response with reliable failure handling.
Platforms used
ZelC, ZelMap, AINA, ZelSOAR, ZelAccess, ZelDB, Vulnerability Vines AI, Noodles, RCF, configured course integrations
What students do
  • Compare ZelMap inventory snapshots and identify newly exposed services, changed permissions, and ownership or classification gaps.
  • Associate affected assets with vulnerability findings and define the evidence required before an automated action can proceed.
  • Connect telemetry collection, AI analysis, evidence checks, action selection, and result verification using configured course integrations; identify any helper scripts as course components.
  • Trace untrusted documents, alerts, and retrieved content through the workflow; apply supported taint-tracking and capability controls to prepared prompt-injection cases.
  • Test excessive permissions, ambiguous findings, and hostile external instructions against the agent capability boundary worksheet.
  • Request review or perform an explicitly permitted remediation, then verify actual resource state and the resulting exposure.
  • Handle timeouts, duplicate requests, unavailable tools, and partially completed actions; record attempted, successful, and unresolved work.
  • Preserve snapshot comparisons, execution evidence, owners, and remaining remediation work in Noodles.
What students produce
A working ZelC exposure-comparison automation, scoped response playbook, verification evidence, and owner-assigned unresolved work.
Operational checkpoint
Detect a new exposure, handle an injected partial failure without duplicating a completed action, and demonstrate the final state against the starting snapshot.
Duration
105-minute practical lab + 15-minute operational briefing or review.

DAY 04 / BLOCK 03

Secure software and verify the release

Practical objective
Repair a software weakness and prove the release decision using regression tests, SBOM comparison, and application retesting.
Platforms used
ZelCode, AINA, Vulnerability Vines AI, ZelExploits, ZelTester, Noodles, RCF, course development environment
What students do
  • Analyze the prepared repository with ZelCode for SAST findings, exposed secrets, vulnerable dependencies, and configuration weaknesses.
  • Review AINA’s proposed repair against actual application behavior and investigate dependency provenance, build inputs, and vulnerability mappings.
  • Generate before-and-after software bills of materials (SBOMs), export CycloneDX or SPDX, and review added, removed, and changed components.
  • Introduce a deliberately failing CI/CD security gate and preserve the failed release decision and its supporting finding.
  • Implement the repair and a meaningful regression test, then verify that the corrected build passes the gate.
  • Retest the running application with Vulnerability Vines AI and relevant ZelExploits checks; verify legitimate application transactions.
  • Attach the repair, differential SBOM, gate results, and application retest evidence to the finding in ZelTester and the scoped assessment in Noodles.
What students produce
A verified repair, differential SBOM in CycloneDX or SPDX, regression test, and release-control evidence including a failed and successful gate.
Operational checkpoint
Explain the component changes, demonstrate the failing-to-passing gate transition, and support the release with regression and running-application retest results.
Duration
105-minute practical lab + 15-minute operational briefing or review.

DAY 04 / BLOCK 04

Protect evidence and assess controls

Practical objective
Protect an evidence package, test cryptographic failure behavior, and review the proof available for selected RCF controls.
Platforms used
Zelen, ZelDB, Rosecoin, AINA, Noodles, RCF
What students do
  • Use the configured Zelen provider with ML-KEM for key establishment, ML-DSA for digital signatures, and AES-256-GCM for authenticated payload encryption.
  • Generate the required keys and package selected evidence into an encrypted .zelen object, including the configured protected metadata.
  • Run separate tests for successful authorized recovery, modified ciphertext, modified protected metadata, an incorrect decryption key, and an incorrect signature-verification key.
  • Verify that each invalid case fails without releasing unauthenticated plaintext; preserve expected and observed results for every test.
  • Create and verify evidence fingerprints with the configured Rosecoin workflow and associate the package with its incident and findings in ZelDB.
  • Review uploaded evidence in Noodles against selected RCF security, AI security, and agent-governance requirements.
  • Inspect AINA’s proposed control mappings, challenge unsupported conclusions, identify missing or stale evidence, and record outstanding remediation.
What students produce
An encrypted and signed evidence package, cryptographic test records, verified fingerprints, and a reviewed control-evidence and remediation register.
Operational checkpoint
Recover the authorized package, reject each tampered or wrong-key case without unauthenticated plaintext, and identify at least one control claim needing additional proof.
Duration
105-minute practical lab + 15-minute operational briefing or review.

Day 4 mission

Signature scenario: Automate the discovery of a new exposure, repair a vulnerable application, and hand another team an evidence package it can verify.

Evidence milestone: Tested automation, verified software repair, SBOM comparison, cryptographic test records, and reviewed control evidence.

Next-day connection: Day 5 reuses the configurations, detections, code, and playbooks in a fresh Northstar Supply scenario.

DAY 058 TRAINING HOURS

Operate

Bring discovery, defense, investigation, automation, and recovery into one team mission.

The Integrated Autonomous AI Cyberattack and Cyber Defense Mission

Operate Northstar Supply in a fresh integrated scenario. Rotate through offensive operations, defense, investigation, automation, and incident coordination as an unannounced exposure change challenges the team’s assumptions.

4 practical mission blocks · 2 hours each · briefings and review included

  1. Discover, prioritize, and validate
  2. Detect, hunt, and reconstruct
  3. Contain, repair, and recover
  4. Demonstrate the result

Platforms: ZelMap, Vulnerability Vines AI, ZelRank, ZelTester, ZelBreach, ZelExploits, AINA, Zombiecop Docker runner, ZelDB, Noodles, RCF, ZelXDR, ZelKill, ZelScan, Vega, Zelton, ZelTunnel, ZelWall, ZelAccess, ZelZero-Trust, ZelCloud, ZelDrift, ZelSOAR, ZelC, ZelCode, ZelFone, Wasabi, Zelen, Rosecoin, ZelPosture.

Read the complete Day 5 syllabus

DAY 05 / BLOCK 01

Discover, prioritize, and validate

Practical objective
Establish the new enterprise baseline and produce independently verifiable offensive findings.
Primary platforms
ZelMap, Vulnerability Vines AI, ZelRank, ZelTester, ZelBreach, ZelExploits, AINA, Zombiecop Docker runner, ZelDB, Noodles, RCF
What students do
  • Establish Northstar Supply’s new operational baseline, preserve its verification manifest, and rediscover the attack surface with ZelMap.
  • Run Vulnerability Vines AI scans before selecting the validation campaign; correlate findings with ownership, business dependencies, and ZelRank intelligence.
  • Organize the ZelTester engagement, define scope and evidence requirements, and model the selected scenario in ZelBreach.
  • Execute automated penetration testing with ZelExploits and the assigned Zombiecop runner profile.
  • Test the assigned AI-enabled workflow and retain independently verifiable findings, technique mappings, and baseline assessment evidence in Noodles.
What students produce
A preserved mission baseline, ZelMap rediscovery inventory, Vulnerability Vines AI findings, scoped engagement, modeled scenario, and independently verified test evidence.
Operational checkpoint
Complete ZelMap rediscovery and Vulnerability Vines AI scanning before selecting a validation campaign; preserve its baseline and scope.
Duration
120-minute mission block, including operational briefing and review.

DAY 05 / BLOCK 02

Detect, hunt, and reconstruct

Practical objective
Establish affected identities, systems, and information using a shared evidence record.
Primary platforms
ZelXDR, ZelKill, ZelScan, ZelDB, Vega, Zelton, ZelTunnel, AINA, ZelMap, Noodles, RCF
What students do
  • Detect the resulting activity across enterprise sources; investigate suspicious artifacts and correlate identities, assets, and information.
  • Reconstruct recorded AI-agent actions, source-document changes, retrieved content, and relevant agent-memory evidence.
  • Examine the instructor-controlled onion-site leak claim and associated tunnel activity while maintaining custody records.
  • Respond to an unannounced instructor-controlled change: a newly exposed service or an unexpectedly privileged service identity.
  • Use ZelMap to verify the change, determine whether it relates to the existing incident, and reprioritize the investigation without assuming a connection.
  • Maintain the shared incident timeline, detection results, retrieval audit, and selected control gaps in Noodles.
What students produce
An evidence-linked incident timeline, retrieval audit, custody records, and a supported decision about the surprise exposure or identity change.
Operational checkpoint
Determine whether the unannounced exposure or privilege change belongs to the incident, justify that decision with evidence, and update priorities.
Duration
120-minute mission block, including operational briefing and review.

DAY 05 / BLOCK 03

Contain, repair, and recover

Practical objective
Coordinate containment, repair, evidence protection, and independently verified recovery.
Primary platforms
ZelWall, ZelAccess, ZelZero-Trust, ZelCloud, ZelDrift, ZelSOAR, ZelC, ZelCode, ZelFone, Wasabi, Zelen, Rosecoin, ZelExploits, ZelMap, Vulnerability Vines AI, ZelTester, Noodles, RCF
What students do
  • Apply network, identity, zero-trust, and cloud controls with approval points appropriate to business-service impact.
  • Coordinate response through ZelC and ZelSOAR; handle an injected operational failure or partial action and verify actual containment before retrying.
  • Repair the selected code or configuration weakness, reconcile configuration drift, and coordinate supported mobile and Wasabi secure-message updates.
  • Protect the investigation package with Zelen and verify its integrity through the configured Rosecoin workflow.
  • Run relevant Vulnerability Vines AI rescans and repeat penetration tests with ZelExploits; confirm successful legitimate business transactions.
  • Compare final ZelMap inventory and exposure against the mission baseline within the same scope, preserving observed measurements and unresolved work in Noodles.
What students produce
Verified containment and recovery, repaired code or configuration, Vulnerability Vines AI rescan reports, repeated penetration tests, successful transactions, and a final exposure comparison.
Operational checkpoint
Reconcile actual containment after the failure, verify legitimate transactions, and compare final exposure with the same baseline scope.
Duration
120-minute mission block, including operational briefing and review.

DAY 05 / BLOCK 04

Demonstrate the result

Practical objective
Explain the verified operational outcomes and remaining risks through a practical capstone and technical review.
Primary platforms
ZelTester, ZelDB, ZelPosture, Noodles, RCF, AINA
What students do
  • Deliver a five-minute executive briefing covering business impact, verified improvement, remaining risk, selected RCF control status, and remediation priorities.
  • Deliver a ten-minute technical review covering the attack sequence, AI-agent activity, detection logic, ZelC automation, evidence verification, and recovery tests.
  • Demonstrate the controls that interrupted the attack path using observed results; label ZelBreach modeled outcomes separately.
  • Create a Plan of Action and Milestones (POA&M) in Noodles with owners, actions, and target dates for unresolved work.
  • Assemble and sign the practical-work portfolio with reports, scripts, SBOM comparisons, investigation evidence, protected packages, Vulnerability Vines AI rescan reports, and a verification manifest.
  • Verify the portfolio’s signature and manifest with the receiving team, complete the instructor-led practical capstone and technical review, and receive individual learning feedback.
What students produce
A five-minute executive briefing, ten-minute technical review, signed practical-work portfolio and verification manifest, and a Noodles Plan of Action and Milestones with owners, actions, and target dates.
Operational checkpoint
Verify the signed portfolio and manifest with another team; account for every remaining gap with an owner, action, and target date.
Duration
120-minute mission block, including instructor-led review and individual learning feedback.

Day 5 mission

Signature scenario: Operate Northstar Supply through a changing incident, including a surprise exposure or privilege change and a partial response failure.

Evidence milestone: Final exposure comparison, verified recovery, executive briefing, technical review, signed portfolio, and Noodles POA&M.

Next-day connection: After the course, use the reviewed portfolio, owners, and target dates to guide continued learning and remediation practice.

05 / THE COMPLETE ZELFIRE SUITE

20 core platforms. One connected operation.

Search all course technologies: the 20 core Zelfire platforms, supporting tools and frameworks, and course-wide AINA. Day links reflect actual use in the practical syllabus.

Filter course technologies by curriculum day

30 of 30 course technologies · 20 core · 9 supporting · AINA

The day labels reflect this syllabus. Teams use the platforms required for their assigned responsibilities during the final mission.

20 core Zelfire platforms

Penetration-testing engagement management

ZelTester

Create the engagement, define scope and test objectives, organize evidence and findings, and deliver the report.

Day 1Day 2Day 4Day 5

Agentic AI Programming Language ZelC

ZelC

Program scoped security operations; test evidence gates, capability controls, and partial-failure handling.

Day 4Day 5

Network protection and segmentation

ZelWall

Configure traffic policies, test permitted and blocked connections, and verify that business transactions still work.

Day 2Day 5

Multi-cloud risk graph & remediation

ZelCloud

Investigate AWS, Azure, and GCP relationships across posture gaps, identities, vulnerabilities, workloads, and data. Review attack paths and fix-first priorities, remediate exposure, and verify security and business functions.

Day 2Day 5
Product reference ↗

Human, service, and agent access

ZelAccess

Review sessions and privileges, scope agent tools, revoke access, and repeat permission tests.

Day 1Day 2Day 4Day 5

Suspicious-file and URL analysis

ZelScan

Analyze supplied artifacts and use the findings to test a hunting hypothesis or reconstruct the incident.

Day 3Day 5

Unified cyber threat intelligence

ZelRank

Correlate external intelligence, internal telemetry, and AI analysis. Enrich an exposed asset or incident indicator, check the supporting evidence, and justify the investigation priority.

Day 1Day 3Day 5
Product reference ↗

Configuration change and drift

ZelDrift

Establish a baseline, investigate an introduced change, and test whether it reopens an exposure.

Day 2Day 5

Connected detection and investigation

ZelXDR

Correlate endpoint, cloud, identity, and network events; develop a detection and reconstruct related activity.

Day 3Day 5

Response orchestration

ZelSOAR

Build an approved response workflow and exercise duplicate alerts, unavailable integrations, and incomplete actions.

Day 3Day 4Day 5

Exposure and operational posture

ZelPosture

Establish the initial baseline, measure response performance, and compare initial and final posture.

Day 1Day 3Day 5

Continuous contextual verification

ZelZero-Trust

Evaluate identity, device, browser, session, network, location, data, and AI-agent context. Simulate and report-only test policies, control rollout, and rehearse time-limited emergency access and rollback.

Day 2Day 5
Product reference ↗

Automated penetration testing & runner control

ZelExploits

Operate automated penetration testing with AINA and Zombiecop Docker runners. Set scope and execution limits, select ATT&CK coverage, pause and stop a run, and verify findings against target observations.

Day 1Day 2Day 4Day 5
Product reference ↗

Threat hunting across enterprise logs

ZelKill

Hunt across SIEM, server, cloud, identity, firewall, proxy, DNS, and uploaded incident records. Refine searches, investigate false positives and misses, and verify a detection against a separate dataset.

Day 3Day 5
Product reference ↗

SAST, secrets, SBOMs & release controls

ZelCode

Investigate source, secrets, dependencies, and provenance. Generate and compare SBOMs, export CycloneDX or SPDX, repair a failing CI/CD security gate, and verify remediation with meaningful tests.

Day 4Day 5
Product reference ↗

Environment modeling & breach simulation

ZelBreach

Model the environment, simulate selected breach scenarios, evaluate defender controls, and compare blast radius. Use Day 2 control comparisons while keeping modeled outcomes separate from observed validation results.

Day 1Day 2Day 5
Product reference ↗

Operational evidence relationships

ZelDB

Link findings, identities, events, and protected evidence to incidents and selected control records.

Day 1Day 3Day 4Day 5

Mobile operational review and response

ZelFone

Complete supported mobile review and response tasks and record the operational handoff.

Day 3Day 5

Scoped service connectivity

ZelTunnel

Configure restricted service access, verify revocation, and correlate tunnel records during the investigation.

Day 2Day 3Day 5

Asset discovery & continuous Attack Surface Management

ZelMap

Discover and maintain an owned asset register across applications, services, cloud resources, software, and identities. Compare exposure snapshots, reconstruct affected paths, and verify improvement throughout the week.

Day 1Day 2Day 3Day 4Day 5
Product reference ↗

Additional course platforms and framework

Supporting tools extend the 20 core Zelfire platforms with vulnerability discovery, runner operations, private connectivity, secure communications, evidence protection, and control assessment.

Vulnerability Vines AI

Active vulnerability discovery & rescanning

Configure authenticated and unauthenticated scans, inspect evidence, review AINA analysis and remediation, and investigate false positives. Run application rescans and preserve findings for attack surface comparisons.

Day 1Day 2Day 4Day 5
Product reference ↗

Vega

AI and onion-service investigation

Access instructor-controlled onion resources and examine browser-agent interactions with hostile content.

Day 1Day 2Day 3Day 5

Zelton

Private onion services

Publish an instructor-controlled private resource and preserve the context of a synthetic onion-site leak claim.

Day 2Day 3Day 5

Wasabi

Secure incident communications

Deliver a synthetic sensitive message, distinguish encrypted content from its email notification, and verify the one-time workflow.

Day 3Day 5

Zelen

Quantum Encryption

Use the configured ML-KEM, ML-DSA, and AES-256-GCM course workflow to create a .zelen package and test authorized access and tamper detection.

Day 4Day 5

Rosecoin

Evidence fingerprints

Create and verify evidence fingerprints through the configured course workflow.

Day 4Day 5

Noodles

Evidence assessment & remediation planning

Ingest and organize uploaded evidence throughout the week. Review AINA’s proposed RCF mappings, identify missing proof and control gaps, assign remediation owners and dates, and produce assessment and management reports.

Day 1Day 2Day 3Day 4Day 5
Product reference ↗

RCF

Security & AI-governance control framework

Define the selected security, AI security, and agent-governance requirements. Use evidence in Noodles to assess control implementation and remaining gaps without implying coverage of every domain or external standard.

Day 1Day 2Day 3Day 4Day 5
Product reference ↗

Zombiecop Docker runner

ZelExploits execution component

Review the assigned runner profile, set permitted resource and concurrency limits, inspect lifecycle evidence, and complete the pause-and-stop drill.

Day 1Day 5
Product reference ↗

06 / HUMAN JUDGMENT + AI ASSISTANCE

Working with AINA

An AI recommendation becomes a supported decision only when you can trace it to evidence and verify the outcome.

AINA WORKFLOW EXAMPLES · SAMPLE CONTENT

Plan a campaign

01 / STUDENT TASK

Create a scoped attack-validation plan.

02 / INFORMATION PROVIDED

Asset inventory, allowed targets, time limits, known exposures, and required evidence.

03 / AI RECOMMENDATION

Prioritize an identity-to-application path and suggest checks for each step.

04 / STUDENT VERIFICATION

Every target is in scope; preconditions are observed; each check has a stop condition and a source for verification.

05 / RESULTING EVIDENCE

An approved campaign plan, test cases, and an evidence checklist.

Investigate an incident

01 / STUDENT TASK

Explain the sequence of a suspected compromise.

02 / INFORMATION PROVIDED

Timestamped identity, endpoint, application, and cloud events with source references.

03 / AI RECOMMENDATION

Suggest that a compromised identity reached a second service.

04 / STUDENT VERIFICATION

Correlate session and request identifiers, check clock differences, and mark missing events. A plausible narrative is still a hypothesis.

05 / RESULTING EVIDENCE

An evidence-linked timeline separating confirmed events, hypotheses, and gaps.

Engineer a detection

01 / STUDENT TASK

Detect a behavior while limiting false positives.

02 / INFORMATION PROVIDED

A confirmed activity sequence, benign transactions, and the available telemetry fields.

03 / AI RECOMMENDATION

Propose a correlation rule for unusual access followed by a sensitive action.

04 / STUDENT VERIFICATION

Replay malicious and benign cases; measure misses and false positives; confirm required fields actually exist.

05 / RESULTING EVIDENCE

A tested detection, test results, telemetry requirements, and tuning notes.

Repair code

01 / STUDENT TASK

Correct a seeded application weakness.

02 / INFORMATION PROVIDED

A minimal reproduction, relevant code, dependency context, and expected legitimate behavior.

03 / AI RECOMMENDATION

Propose an authorization check and a regression test.

04 / STUDENT VERIFICATION

Review the change, check every affected path, run the regression test, and repeat legitimate transactions. A proposed patch is not a verified repair.

05 / RESULTING EVIDENCE

A reviewed code change, passing regression results, and a documented release decision.

Verify a response

01 / STUDENT TASK

Confirm a containment action after a connector reports partial completion.

02 / INFORMATION PROVIDED

The approved scope, action log, connector error, resource state, and service health checks.

03 / AI RECOMMENDATION

Recommend marking the incident contained because one action returned success.

04 / STUDENT VERIFICATION

Check each affected resource independently. Record incomplete actions, use the approved recovery path, and test business-service availability.

05 / RESULTING EVIDENCE

An action-by-action result record, unresolved work, and independently verified recovery checks.

Prioritize an exposed asset

01 / STUDENT TASK

Choose which newly exposed asset to investigate first.

02 / INFORMATION PROVIDED

ZelMap inventory, ownership, business importance and timestamps; Vulnerability Vines AI findings; ZelRank intelligence and source records.

03 / AI RECOMMENDATION

Prioritize an exposed customer-service asset because its validated weakness and privileged identity could affect sensitive business data.

04 / STUDENT VERIFICATION

Confirm asset identity and freshness, reachable exposure, the vulnerability evidence, relevant intelligence, and business dependency. Challenge any inferred relationship.

05 / RESULTING EVIDENCE

An evidence-linked priority decision, selected validation plan, and an owned asset record with unresolved questions.

Assess control evidence

01 / STUDENT TASK

Determine what the uploaded evidence supports for selected RCF security and agent-governance requirements.

02 / INFORMATION PROVIDED

Noodles uploads: scope, baseline manifests, policy decisions, capability worksheet, tests, incident records, software changes, and cryptographic verification results.

03 / AI RECOMMENDATION

Suggest control mappings and flag missing, stale, or contradictory evidence; propose owner-assigned remediation actions.

04 / STUDENT VERIFICATION

Check every mapping against the selected requirement, collection provenance, scope, freshness, and actual test outcome. Do not accept a compliant status without sufficient proof.

05 / RESULTING EVIDENCE

A reviewed Noodles assessment with evidence links, justified control status, missing-proof requests, and a Plan of Action and Milestones.

07 / ATTACK CASE STUDIES

Follow the evidence through the attack.

Rocheston-supplied illustrations of AI-driven cyberattack examples. These are case-study diagrams, separate from the product screenshots above. Course validation is performed against authorized training targets.

Account takeover through an exposed API
Account takeover through an exposed APITrace the identity change, question the authorization boundary, and specify the evidence needed to confirm account control.Open image to inspect · zoom available
Account takeover through an exposed APIExposure across a point-of-sale serviceImage upload to command executionUnrestricted upload and service privilegesError handling and path disclosureCommand execution hidden in an error response

08 / DAY 5 · OPERATE

Your Final Mission: One Enterprise. One Evolving Incident.

You are the operations team for Northstar Supply, a fictional enterprise. Work through a new scenario while rotating through offensive operations, defensive engineering, investigation, automation, and incident coordination.

Your training enterprise

  • A customer-facing application and APIs
  • Human, service, and AI-agent identities
  • Cloud workloads, endpoints, and internal services
  • A source repository and deployment pipeline
  • Synthetic business data and an instructor-controlled onion publication
  • Connected security telemetry and evidence repositories

Bring the configurations, detections, code, and playbooks developed during the week into the new mission.

  1. An unannounced change alters the attack surface

    After ZelMap rediscovery and Vulnerability Vines AI scanning establish the baseline, the instructor introduces a newly exposed service or unexpectedly privileged service identity during the investigation. Determine whether it belongs to the incident and reprioritize using evidence.

  2. Identity and agent permissions become an attack path

    Investigate suspicious identity activity and excessive agent access. Establish which recorded actions actually occurred.

  3. A configuration change reopens exposure

    Trace the drift, repair the control, and verify actual containment. Repeat relevant scans and penetration tests, confirm legitimate business transactions, and compare final exposure with the mission baseline.

  4. A leak claim needs evidence

    Investigate an instructor-controlled onion-site publication, compare synthetic records, and correlate tunnel and browser-agent activity.

  5. An explanation outruns the evidence

    AINA proposes a conclusion without sufficient support. Identify the missing records and revise the finding.

  6. The response only partly completes

    Handle an injected connector failure or incomplete action. Reconcile actual state before retrying, while evaluating business-service impact.

The team’s final handoff

Five-minute executive briefing

Business impact, verified improvement, remaining risk, selected RCF control status, and remediation priorities.

Ten-minute technical review

Attack sequence, AI-agent activity, detection logic, ZelC automation, evidence verification, and recovery tests.

Deliver the final exposure scorecard and a Noodles Plan of Action and Milestones with owners, actions, and target dates. Sign the practical-work portfolio containing reports, scripts, SBOM comparisons, investigation evidence, protected packages, Vulnerability Vines AI rescan reports, and a verification manifest. Another team verifies the package and manifest.

The four two-hour mission blocks include the practical capstone, instructor-led technical review, and individual feedback. Certification remains tied to completing the five-day course.

Read all four mission blocks →

09 / WHAT YOU BUILD

Practical work. A verifiable portfolio.

Take away the work products of a connected security operation, from the initial engagement to recovery and reporting.

01 / DELIVERABLE

A completed penetration-testing engagement

Plan and run automated testing with ZelExploits; organize scope, findings, execution evidence, and reporting in ZelTester.

02 / DELIVERABLE

An owned attack-surface register

Preserve Epoch Zero, discover and deduplicate assets with ZelMap, establish ownership and classification, and record timestamps, exposure, identities, and business dependencies.

03 / DELIVERABLE

An exposure-reduction scorecard

Preserve tested defensive configurations and compare inventory, scan findings, permissions, attack paths, and successful transactions using the same scope. Distinguish observed results from ZelBreach modeling.

04 / DELIVERABLE

A calibrated detection and hunting record

Develop the hunt across enterprise logs, explain false positives and misses, and validate the revised detection against a separate prepared dataset.

05 / DELIVERABLE

An incident and agent-context investigation

Reconstruct the incident timeline, compare source documents, retrieval records and agent memory, and maintain evidence custody and unresolved questions.

06 / DELIVERABLE

A response playbook and ZelC automation

Write and test scoped workflows with evidence gates, action approvals, capability controls, and failure handling.

07 / DELIVERABLE

A differential SBOM and verified release

Investigate SAST, secrets and dependencies; compare CycloneDX or SPDX SBOMs, repair a failing CI/CD gate, and preserve regression and running-application retests.

08 / DELIVERABLE

A protected, verifiable evidence package

Package evidence with Zelen, verify authorized recovery, and record rejection of modified ciphertext, protected metadata, and incorrect keys without releasing unauthenticated plaintext.

09 / DELIVERABLE

A signed practical-work portfolio

Deliver reports, scripts, SBOM comparisons, investigation evidence, protected packages, and rescan reports with a signed verification manifest, executive briefing, and technical review.

10 / DELIVERABLE

An AI-agent capability boundary worksheet

Document each agent’s identity, owner, tools, resources, allowed and prohibited actions, delegation limits, approval conditions, and suspension procedures. Preserve its access tests and emergency-recovery evidence.

11 / DELIVERABLE

An RCF/Noodles assessment and remediation plan

Review uploaded evidence against selected controls, record missing proof and justified control status, and create a Plan of Action and Milestones with owners, actions, and target dates.

Your final portfolio

Your signed portfolio connects owned assets and baselines to findings, detections, code and configuration changes, capability tests, retrieval investigations, SBOM differences, response actions, recovery checks, cryptographic tests, and final retests. Include source references, hashes, signature-verification details, a verification manifest, and the reviewed Noodles assessment and remediation plan.

10 / WHAT PARTICIPANTS WILL LEARN

Skills that connect the whole operation.

By the end of the course, participants will be able to:

Connected cybersecurity operations

Operate the Zelfire suite as a connected cybersecurity environment.

Automated penetration testing

Plan and execute AI-powered automated penetration testing with ZelExploits.

Engagement management

Manage testing scope, evidence, findings, and reporting with ZelTester.

Attack-scenario modeling

Model attack scenarios and defensive effects with ZelBreach.

AI-system security

Evaluate prompt injection, retrieval manipulation, excessive agent permissions, and unsafe tool use.

Connected defensive controls

Configure network, cloud, identity, and zero-trust protections.

Secure connectivity

Deploy and assess secure service tunnels and private onion resources.

Threat hunting and detection

Correlate telemetry, develop detections, and investigate connected intrusions.

AI and dark-web investigation

Investigate AI-agent activity and synthetic dark-web exposure scenarios.

Response orchestration

Build response workflows and test their behavior under failure.

Agentic security programming

Write ZelC security automation and apply controls to agent actions.

Secure code and remediation

Investigate source-code weaknesses and validate repairs.

Evidence protection

Protect operational evidence using post-quantum cryptography and integrity verification.

Operational communication

Communicate technical findings, operational outcomes, and remaining risks.

Continuous Attack Surface Management

Discover and own assets with ZelMap, reconstruct exposure, automate snapshot comparisons, and demonstrate verified improvement across the five-day learning path.

AI-assisted vulnerability discovery

Configure Vulnerability Vines AI, compare authenticated and unauthenticated coverage, investigate unsupported findings, and verify remediation through rescanning.

Zero-trust simulation and emergency recovery

Simulate contextual policies, use report-only testing, verify continuous access decisions, and restore a service through authorized, temporary emergency access and rollback.

SBOM and software supply-chain verification

Compare CycloneDX or SPDX SBOMs, investigate component provenance and vulnerability mappings, and verify a repaired CI/CD gate with regression and application tests.

AI governance and control assessment

Define agent capability boundaries and review uploaded Noodles evidence against selected RCF requirements; identify missing proof and assign remediation ownership.

11 / WHO SHOULD ATTEND

For practitioners ready to connect the disciplines.

An advanced learning path for experienced cybersecurity practitioners and technical leaders.

Penetration testers and red-team professionals

Expanding into AI-powered testing and attacks against AI-enabled systems.

SOC analysts, threat hunters, and incident responders

Developing skills in correlated investigation and automated response.

Security engineers and architects

Implementing connected network, cloud, identity, and AI-agent protections.

Application security and DevSecOps professionals

Building secure code and operational automation.

Cloud and identity specialists

Investigating permissions, attack paths, and configuration drift.

Experienced RCCE graduates and advanced students

Ready to work across offensive and defensive operations.

Technical security leaders

Gaining practical experience supervising AI-assisted cybersecurity workflows.

Prerequisites

RCCE Level 2 or equivalent practical experience is recommended.

Participants should be comfortable with:

Networking
TCP/IP, DNS, HTTP, network services, and basic segmentation.
Operating systems
Linux and Windows administration.
Applications and APIs
Web applications, APIs, authentication, and common vulnerabilities.
Cloud and identity
Basic cloud and identity concepts.
Security investigation
Reading logs and investigating security findings.
Scripting
Writing or modifying simple scripts.

Prior Zelfire or ZelC experience is not required. The course introduces their workflows through practical tasks while expecting an existing cybersecurity foundation.

Value for companies

Organizations develop practitioners who can follow a security problem from exposure to verified remediation. Participants practice coordinating offensive findings, defensive controls, investigations, code changes, and operational reporting within the same environment.

The course gives teams practical experience in supervising AI-assisted decisions, testing automation, preserving evidence, and measuring whether controls work.

Value for HR and learning teams

The learning path provides clear daily objectives and tangible work products. Completion records can be supported by a portfolio of practical work, including testing reports, detection logic, incident timelines, automation code, and remediation evidence.

12 / COURSE COMPLETION

RCCE Level 3 Certification

Participants are awarded the RCCE Level 3 Certification upon completing the five-day Autonomous AI-Driven Cyberattack & Cyber Defense course.

The final exercise is a practical capstone and technical review. Teams demonstrate their work, explain decisions, and review the evidence accumulated throughout the course.

13 / QUESTIONS

RCCE Level 3, answered.

Course format, platform roles, preparation, and completion.

What is RCCE Level 3?

An intensive five-day course in AI-driven attack surface management, automated penetration testing, autonomous cyber defense, threat hunting, and security engineering using the Zelfire suite and AINA. Five days · 40 scheduled training hours · 20 core Zelfire platforms · 16 practical labs + four integrated mission blocks.

How do students access the practical training environment?

Students access the Zelfire cloud training platform through a web browser. The platform contains hundreds of preconfigured virtual machines across enterprise scenarios. During the course, students use assigned environments to launch AINA-powered automated attacks, implement defenses, investigate incidents, and develop security automation.

What does the 40-hour schedule include?

Five days with four two-hour learning blocks each day, including operational briefings and review. Days 1–4 contain 16 practical labs, each with 105 minutes of practical work and a 15-minute briefing or review. Day 5 contains four 120-minute mission blocks; the technical review and individual feedback are included in Block 4. Breaks are additional.

How is the RCCE Level 3 Certification awarded?

Participants are awarded the RCCE Level 3 Certification upon completing the five-day Autonomous AI-Driven Cyberattack & Cyber Defense course.

Do I need prior Zelfire or ZelC experience?

Prior Zelfire or ZelC experience is not required. RCCE Level 2 or equivalent practical experience is recommended. The course introduces the platform and language workflows through practical tasks while expecting an existing cybersecurity foundation.

What do ZelExploits, ZelTester, and ZelBreach do in this course?

ZelExploits is the automated penetration-testing platform. ZelTester manages the engagement, scope, evidence, findings, and reporting. ZelBreach models attack scenarios and defensive effects before the team validates selected paths.

Will AINA perform the work for me?

AINA automates attack execution. Students configure the mission, select permitted targets, and supervise operations. They inspect decisions, investigate the evidence, challenge unsupported explanations, verify outcomes against target activity, and demonstrate defensive improvements.

What are the onion-service and evidence-protection exercises?

Students work with instructor-controlled onion services and synthetic data-leak scenarios using Zelton and Vega. They use Zelen with the configured cryptographic provider to protect evidence and the configured Rosecoin workflow to verify fingerprints.

Are these practical blocks the same as the wider Rocheston Raven library?

This five-day syllabus contains 16 practical learning blocks and a four-block final mission. Any wider library access is separate; ask Rocheston to confirm included access and its duration.

Where can I find dates, delivery options, and fees?

Enquire at [email protected] for RCCE Level 3 dates, delivery format, location, fees, and included access. These details are confirmed for the relevant course offering.

How do I save the complete syllabus?

Download Brochure provides an eight-page overview for students and HR teams. For the complete detailed syllabus, use Print / Save Syllabus or your browser’s Print command. The print layout includes all 20 learning blocks across five days, daily missions, the complete platform directory, learning outcomes, prerequisites, and certification statement.

How does Attack Surface Management progress across the week?

Day 1 discovers and owns assets, preserves the baseline, and validates exposure. Day 2 reduces exposure and verifies access. Day 3 reconstructs affected assets, identities, and paths. Day 4 automates comparison and remediation checks. Day 5 detects a new exposure and demonstrates verified improvement against the mission baseline.

How do ZelMap, Vulnerability Vines AI, and ZelExploits differ?

ZelMap discovers and catalogs assets and explains attack surface exposure. Vulnerability Vines AI actively scans the assigned application, supports analysis and remediation, and performs rescans. ZelExploits runs the selected automated penetration-testing campaign through AINA and assigned Zombiecop Docker runners; students verify its execution results against target evidence.

How do RCF and Noodles support the practical exercises?

RCF defines the selected control requirements. Noodles organizes and analyzes the uploaded evidence used to assess them. Students establish scope on Day 1, record controls on Day 2, identify incident-related gaps on Day 3, review engineering evidence on Day 4, and complete the assessment and remediation plan on Day 5. The course includes selected AI security and agent-governance requirements, not an assessment of every RCF domain or a guarantee of external compliance.

What does the final portfolio contain?

A signed practical-work portfolio with an owned asset register, baseline and exposure comparisons, validated test reports, agent capability worksheet, detection results, incident and retrieval evidence, scripts and ZelC source, differential SBOMs, CI/CD gate results, protected evidence packages, Vulnerability Vines AI rescan reports, recovery checks, and a verification manifest. The handoff includes a reviewed Noodles assessment, Plan of Action and Milestones, executive briefing, and technical review.

PUT THE WHOLE OPERATION TOGETHER

Build. Investigate. Verify.

Discuss RCCE Level 3 with Rocheston and request course dates, delivery details, fees, and included access.

Enquire About RCCE Level 3

[email protected]

Image viewer

Escape closes the viewer. When zoomed, focus the image area and use arrow keys to scroll.