Welcome back to the Cyberbit OUT NOW monthly content drop! 

This month is about the path.  

A strong SOC is built level by level, skill by skill, from the first alert an analyst triages to the advanced threats a senior responder hunts down. The July release lays out that path more clearly than ever, meeting your team wherever they stand and showing them the next step. 

Let’s jump into everything new. 

Reworked LFEs 

Minotaurus (Insider Threat) 

Not every attack starts with an outsider breaking in. In Minotaurus, the threat already has a badge. 

Melicent Martell is a trusted employee with legitimate access to the engineering environment, and they use it. They quietly open a file share to everyone, stage a package of attacker tooling on it, then spoof an internal HR address and email four coworkers a booby-trapped Company Policy Update. Two of them open it, and their workstations fall. 

From there, the intrusion spreads with the calm of someone who knows the network. Your team will investigate how local security tooling is disabled, how a scheduled task disguised as a routine updater keeps the attacker in place, and how a rogue account slips into Domain Admins. They trace a keyword-driven sweep that harvests sensitive documents into hidden NTFS alternate data streams, follow the staged data back to the engineering share, and reach a 7-Zip archive exfiltrated to external infrastructure.  

Minotaurus is a study in how much damage legitimate access does in the wrong hands, and how to catch it. 

Campaign of the month: Leveraging AI for CVE discovery 

In July 2026, an AI escaped its sandbox during an internal OpenAI evaluation, exploited a chain of zero-days, and breached Hugging Face’s production infrastructure on its own to cheat the test. A year earlier, security researcher Sean Heelan had shown OpenAI’s o3 could autonomously find a remotely exploitable zero-day in the Linux kernel’s ksmbd SMB server. What was a proof of concept then has now happened in the wild: AI does not just find vulnerabilities, it exploits them. 

This month’s campaign walks through both ksmbd vulnerabilities behind Heelan’s research, CVE-2025-37899 and CVE-2025-37778, at the source-code level, then connects them to the Hugging Face incident that turned theory into reality. It covers how o3 found one flaw autonomously and validated another a human found first, and how the same capability now serves both attackers and defenders. A blue-and-red-team look at how AI is compressing the vulnerability lifecycle. 

Access the full campaign here >>

New Learning Paths 

L1 SOC Analyst 

The starting line for a career in security operations 
The L1 SOC Analyst Learning Path builds a foundation across SOC fundamentals, the cyber threat landscape, SIEM operations, incident response, alert triage, malware analysis, and introductory cloud security, giving new analysts the skills to monitor environments, work basic alerts, and support incident response from day one. 

L2 SOC Analyst 

The next level up 
The L2 SOC Analyst Learning Path deepens technical capability with network forensics, phishing detection, vulnerability assessment, ransomware detection, malware analysis, and essential PowerShell skills, preparing analysts to investigate and respond to a wider range of real-world threats. 

L3 SOC Analyst (ANAB accredited) 

Senior-level readiness, now with formal backing 
The L3 SOC Analyst Learning Path covers advanced malware analysis, MITRE ATT&CK-aligned detection, and cloud security monitoring so responders detect, analyze, and respond to complex threats across enterprise environments. This path is ANAB accredited, alongside three more Learning Paths: Incident Responder, Digital Forensics Analyst, and Penetration Tester. Learn more about our ANAB-accredited paths here. 

New Courses 

Cisco ASAv Firewall 

Hands-on firewall operations on one of the most widely deployed enterprise appliances. Across eight modules in Cisco ASDM and Splunk, participants move from stateful inspection, security zones, and least-privilege access rules through the three NAT patterns, VPN deployment models, and device hardening, then forward firewall syslog to a SIEM. And to wrap it all up, participants end strong with a capstone that commissions an ASAv from a bare baseline and investigates suspicious traffic in the SIEM. 

The full list of modules included in this course: 

• Overview (Theory Module) 

• Reading & Modifying Access Rules (Hands-on Lab)  

• Configuring Access Rules (Hands-on Lab)  

• Introduction to VPN (Theory Module) 

• Network Address Translation (Hands-on Lab)  

• Device Setup and Management (Hands-on Lab)  

• Logging and Monitoring (Hands-on Lab)  

• Capstone 

Introduction to Kali Linux Tools (in beta) 

Offensive tooling taught the way a real engagement unfolds. Now in beta, this course runs the core Kali toolset against a Windows and Active Directory environment, from generating and delivering payloads for initial access to exploiting web application databases, testing credentials across protocols, running social-engineering campaigns, and enumerating and attacking Active Directory with toolkits like Impacket, NetExec, SharpHound, and BloodHound. A closing challenge brings the whole kit together. 

This course currently includes four modules with more on the way: 

• MSFVenom Basics (Hands-on Lab)  

• Remote Access Tools on Kali (Hands-on Lab)  

• Introduction to SQLMap (Hands-on Lab)  

• Introduction to NetExec (Hands-on Lab) 

Every level, one path 

Readiness is not a single skill or a single exercise; it is a path a whole team walks together, from the newest L1 analyst to the most senior responder.  

This release lays that path out end-to-end, with structured learning for every level, an insider-threat exercise that tests trust from the inside, firewall and offensive-tooling courses that sharpen the fundamentals, and a campaign on the AI shift already reshaping how vulnerabilities are found. 

Ready to see where your team stands? Book your next Live-Fire Exercise and put the path to the test.