Trusted by teams at
Application security for developers
Application security training that drops developers into a simulated workstation with a real browser and a deliberately vulnerable web app. Every hands-on exercise takes one flaw from the OWASP Top 10, from SQL injection and XSS to broken access control, and has you exploit it before you write the fix. It comes from the team behind Kontra Application Security Training.
$ login --user admin password: [ok] authenticated SELECT * FROM users 1,284 rows exfiltrated
A single quote in a login form empties the customer table.
// concatenated input query(`... id = ${id}`)✗ // parameterized query('... id = ?', [id])✓
Every exercise pairs the attack with the secure pattern that stops it.
Covers the languages your team ships in
The vulnerable code and its fix are shown in the language your developers work in every day.
- JavaScript
- TypeScript
- Java
- C#
- Python
- Scala
- PHP
- Ruby
- Go
- Kotlin
- Secure-coding practice for injection, broken access control, XSS, CSRF, and SSRF
- Exploit and remediation side by side, so the fix sticks, not just the fear
- Built for engineering teams in PCI DSS 6.2 and secure-coding programs
Inside the platform
The control room your security team signs into. Built to ship training, prove it ran, and hand receipts to an auditor.
-
See human risk move, in real time.
Tenant-wide time-spent, average per user, and active-campaign rollups update the moment a learner finishes. Filter by user, team, or date range without leaving the page.
- Daily activity timeline with rolling windows
- Active and recent campaigns at a glance
- Slice by team, role, or individual
-
Find every knowledge gap, then close it.
Per-question results from every quiz attempt. See exactly which questions your workforce keeps missing.
- Question-level correct/incorrect tracking
- Hardest-questions ranked across the org
- Trend lines by course, team, and time
-
Plan training waves end to end.
Set deadlines and grace periods, target by team or role, and let automatic reminders chase the stragglers.
- Recurring rollouts with deadline extensions
- Auto-escalation to managers when at risk
- Recognition windows that backfill prior completions
-
Track every cohort, all the way to done.
Each campaign gets its own room: roster, analytics, and a full audit log. Drill from the full cohort down to a single stalled learner.
- Live completion + average progress per cohort
- At-risk flagging the moment a deadline slips
- Full audit log of every change, by whom
-
Every seat, every license, in view.
Filter by team or role, then bulk-invite, disable, or hand off seats without ever overshooting your contract.
- Live license utilisation and pending-invite count
- Inline role + team + manager assignment
- CSV bulk import and SCIM auto-provisioning
-
Mirror your org chart.
Each manager sees their own direct reports, and gets pinged the moment one of them falls behind on training.
- Manager view scoped to direct reports
- At-risk and missed-deadline alerts
- External-id mapping for HRIS sync
-
Framework-mapped evidence, on demand.
Every completion maps to the controls it satisfies. SOC 2, ISO 27001, HIPAA, NIST CSF, and 21 more, all live.
- 25 frameworks mapped out of the box
- Per-framework completion percentages
- Vanta and Drata streaming integrations
-
Auditor-ready exports in one click.
Tenant, course, or campaign reports. Filter by team and pick from 25 compliance frameworks. PDF or CSV.
- Filter by team and framework before export
- Scheduled monthly delivery to GRC inboxes
- Per-user and per-cohort report formats
-
Ship every exercise via SCORM or LTI.
Export any course as a SCORM 1.2 or 2004 zip, or launch it in your LMS over LTI 1.3 — instructors deep-link the exact exercise, course, or path, and completion and scores post back automatically. Works with Workday, Cornerstone, Moodle, Canvas, and more.
- One-click SCORM export, or an LTI 1.3 launch
- Deep linking, grade passback (AGS), and roster sync (NRPS)
- Tested across 50+ enterprise LMS platforms
-
Mix in your own policies, videos, and SCORM.
Upload internal SOPs, employee handbooks, or your own SCORM packages. Drop them into learning paths next to off-the-shelf training.
- PDF, image, video, and SCORM 1.2 / 2004 uploads
- Step into any learning path alongside our content
- Per-user tracking and completion in one place
-
An LMS your workforce will actually use.
A clean catalogue, visible progress, and certificates issued the moment a course is done. Multilingual support so every employee learns in the language they think in.
- Self-serve enrolment with clear progress
- Automatic certificate issuance
- Multilingual learner experience
-
Gamification that actually drives completion.
Unlockable achievements, rarity tiers, and a daily streak counter turn training into something learners come back to instead of avoid.
- Achievements unlocked across the learner journey
- Rarity tiers that make milestones feel earned
- Daily streak counter learners protect on their own
Built for enterprise IT
How RansomLeak plugs into the identity, LMS, and security tooling you already run.
See all featuresPlugs into your security stack
SSO, SCIM, and SIEM out of the box. Sign in with your IdP, provision from your HRIS, and stream every training event into your SOC pipeline.
- SAML 2.0 and OIDC SSO with any IdP
- SCIM 2.0 auto-provisioning from HRIS
- Webhooks to Splunk, Datadog, and Sentinel
SCORM & LTI for Your LMS
Deploy via SCORM 1.2 and 2004 packages, or launch with LTI 1.3 and automatic grade passback.
- Works with your existing LMS via SCORM or LTI
- No custom development required
- Completion and scores post back to your gradebook
Dedicated Multi-Tenant Architecture
Secure, isolated environments with complete customization.
- Complete data segregation per tenant
- White-label with your branding
- Role-based access controls & compliance
Phishing Simulations
Test your workforce against realistic phishing attacks delivered through direct mailbox injection. Track the full funnel from delivery to credential submission, and auto-assign targeted training to employees who click.
- M365 and Google Workspace direct injection bypasses spam filters
- Outlook and Gmail reporter buttons capture real-time employee reports
- Full-funnel analytics: delivered, opened, clicked, credentials, reported
- Auto-remediation assigns exercises to employees who fail simulations
Smishing Simulations
Test your workforce against SMS phishing, the channel with no email gateway in front of it. Send realistic but harmless text lures over a real SMS transport, measure who taps and who reports, and route the rest into targeted training.
- Real SMS delivery gated to business hours and carrier rate limits
- Per-recipient tap and REPORT-reply tracking via signed, time-limited tokens
- Full-funnel analytics: sent, delivered, clicked, submitted, reported
- Auto-remediation enrolls anyone who taps the lure into targeted lessons
Latest blog articles
Practical guides on phishing, AI security, and awareness training. Written by the team behind the exercises.
Read all posts
AWS Cloud Security Misconfigurations to Fix First
The AWS cloud security misconfigurations that expose real companies, from public buckets to open security groups, and the fixes that close each one fast.
Read the article
AWS IAM Best Practices to Stop Privilege Escalation
AWS IAM security best practices that stop privilege escalation before it starts. Harden roles, keys, and cross-account trust with hands-on exercises today.
Read the article
API Security Best Practices: OWASP API Top 10 in Practice
Apply API security best practices that hold up under attack. Work through the OWASP API Security Top 10 with hands-on exercises your developers can run today.
Read the article