Trusted by teams at
Application security for developers
Five hands-on tracks in a simulated workstation. Exploit a real bug on the surface your team actually ships, then write the fix yourself.
$ login --user admin password: [ok] authenticated 1,284 rows exfiltrated
A single quote in a lookup form empties the customer table.
// concatenated input query(`... id = ${id}`) ✗ // parameterized query('... id = ?', [id]) ✓
Bind user input as a parameter and the quote stays data, never code.
$ GET /api/trips/50318 retry: 200 OK · rider_id 8814 another rider's receipts
Change one id in the path and the API hands over another rider’s trips.
// authenticated, not authorized return db.trip(req.params.id) ✗ // check the object owner if (trip.riderId !== me) return 403 ✓
Authentication proves who is calling. Only an owner check proves they may.
$ git log --all -p grep: commit 9f8e7d6 live key, deleted at HEAD
The key is gone from HEAD and still live three commits back.
// removed in a later commit git rm config/secrets.js ✗ // rotate first, then rewrite git filter-repo --invert-paths ✓
Rotate the credential first. A history rewrite alone does not un-leak it.
$ docker history checkout-api:1.4.2 layer: sha256:9c1f4e7a · 184 MB secret readable in the layer
Anyone who can pull the image can read the layer that built it.
// baked into the image ENV STRIPE_KEY=sk_live_... ✗ // mounted, never committed RUN --mount=type=secret,id=stripe ✓
A BuildKit secret mount lets the build read a value it never stores.
$ aws s3 ls --no-sign-request bucket: 4,102 objects listed patient exports downloadable
A support note names the bucket, and the bucket answers anonymously.
// public read on the bucket Principal: "*" ✗ // block public access, scope the reader Principal: cloudfront-oac ✓
Block public access, then let one named reader through the front door.
Covers the languages your team ships in
The vulnerable code and its fix are shown in the language your developers work in every day.
- JavaScript
- TypeScript
- Java
- C#
- Python
- Scala
- PHP
- Ruby
- Go
- Kotlin
- Secure-coding practice for injection, broken access control, XSS, CSRF, and SSRF
- Exploit and remediation side by side, so the fix sticks, not just the fear
- Built for engineering teams in PCI DSS 6.2 and secure-coding programs
Phishing simulations
Test your workforce against realistic phishing attacks delivered through direct mailbox injection. Track the full funnel from delivery to credential submission, and auto-assign targeted training to employees who click.
- M365 and Google Workspace direct injection bypasses spam filters
- Outlook and Gmail reporter buttons capture real-time employee reports
- Full-funnel analytics: delivered, opened, clicked, credentials, reported
- Auto-remediation assigns exercises to employees who fail simulations
Inside the phishing add-on
Real screens from the admin console.
-
Templates Lure library with a live email preview -
Landing pages The page a click lands on -
Teach-back What they learn right after the miss -
Analytics Funnel and trend across every campaign -
Campaigns Sends spread across a delivery window
Smishing simulations
Test your workforce against SMS phishing, the channel with no email gateway in front of it. Send realistic but harmless text lures over a real SMS transport, measure who taps and who reports, and route the rest into targeted training.
- Real SMS delivery gated to business hours and carrier rate limits
- Per-recipient tap and REPORT-reply tracking via signed, time-limited tokens
- Full-funnel analytics: sent, delivered, clicked, submitted, reported
- Auto-remediation enrolls anyone who taps the lure into targeted lessons
Inside the smishing add-on
Real screens from the admin console.
-
Campaigns SMS channel with a package-delivery lure -
Lure The delivery text that lands on the phone -
Analytics Sent, delivered, tapped, submitted, reported
Human risk management
Every employee gets a 0 to 100 score from how they handle real simulations, and every score can be traced to the events behind it. Rules then assign training to the people who need it, with a dry run before anything goes live.
- A score per person, 0 to 100 Built from simulation outcomes, phish reports, and training status. Recent behavior counts most, and everyone lands in a Low, Moderate, High, or Critical band.
- Every score shows its work Open any score to see its four weighted sub-scores and the events behind it. Managers and admins can trace any number to the exact simulations, reports, and lessons that produced it. No dark web, no profiling.
- Bring your own signals and data Push risky sign-ins, SOC alerts, and privilege flags from your SIEM, identity provider, or a script over a REST API, or upload a CSV. Define custom signal types for anything the catalog misses, and dry-run every import before it lands.
- Rules act on the score Auto-enroll remediation the moment someone crosses a threshold and alert their manager. Dry-run every rule first, with an audit log and a kill switch.
Inside the platform
The control room your security team signs into. Built to ship training, prove it ran, and hand receipts to an auditor.
-
See human risk move, in real time.
Tenant-wide time-spent, average per user, and active-campaign rollups update the moment a learner finishes. Filter by user, team, or date range without leaving the page.
- Daily activity timeline with rolling windows
- Active and recent campaigns at a glance
- Slice by team, role, or individual
-
Find every knowledge gap, then close it.
Per-question results from every quiz attempt. See exactly which questions your workforce keeps missing.
- Question-level correct/incorrect tracking
- Hardest-questions ranked across the org
- Trend lines by course, team, and time
-
Plan training waves end to end.
Set deadlines and grace periods, target by team or role, and let automatic reminders chase the stragglers.
- Recurring rollouts with deadline extensions
- Auto-escalation to managers when at risk
- Recognition windows that backfill prior completions
-
Track every cohort, all the way to done.
Each campaign gets its own room: roster, analytics, and a full audit log. Drill from the full cohort down to a single stalled learner.
- Live completion + average progress per cohort
- At-risk flagging the moment a deadline slips
- Full audit log of every change, by whom
-
Every seat, every license, in view.
Filter by team or role, then bulk-invite, disable, or hand off seats without ever overshooting your contract.
- Live license utilisation and pending-invite count
- Inline role + team + manager assignment
- CSV bulk import and SCIM auto-provisioning
-
Mirror your org chart.
Each manager sees their own direct reports, and gets pinged the moment one of them falls behind on training.
- Manager view scoped to direct reports
- At-risk and missed-deadline alerts
- External-id mapping for HRIS sync
-
Framework-mapped evidence, on demand.
Every completion maps to the controls it satisfies. SOC 2, ISO 27001, HIPAA, NIST CSF, and 21 more, all live.
- 25 frameworks mapped out of the box
- Per-framework completion percentages
- Vanta and Drata streaming integrations
-
Auditor-ready exports in one click.
Tenant, course, or campaign reports. Filter by team and pick from 25 compliance frameworks. PDF or CSV.
- Filter by team and framework before export
- Scheduled monthly delivery to GRC inboxes
- Per-user and per-cohort report formats
-
Ship every exercise via SCORM or LTI.
Export any course as a SCORM 1.2 or 2004 zip, or launch it in your LMS over LTI 1.3. Instructors deep-link the exact exercise, course, or path, and completion and scores post back automatically. Works with Workday, Cornerstone, Moodle, Canvas, and more.
- One-click SCORM export, or an LTI 1.3 launch
- Deep linking, grade passback (AGS), and roster sync (NRPS)
- Tested across 50+ enterprise LMS platforms
-
Mix in your own policies, videos, and SCORM.
Upload internal SOPs, employee handbooks, or your own SCORM packages. Drop them into learning paths next to off-the-shelf training.
- PDF, image, video, and SCORM 1.2 / 2004 uploads
- Step into any learning path alongside our content
- Per-user tracking and completion in one place
-
An LMS your workforce will actually use.
A clean catalogue, visible progress, and certificates issued the moment a course is done. Multilingual support so every employee learns in the language they think in.
- Self-serve enrolment with clear progress
- Automatic certificate issuance
- Multilingual learner experience
-
Gamification that actually drives completion.
Unlockable achievements, rarity tiers, and a daily streak counter turn training into something learners come back to instead of avoid.
- Achievements unlocked across the learner journey
- Rarity tiers that make milestones feel earned
- Daily streak counter learners protect on their own
Built for enterprise IT
How RansomLeak plugs into the identity, LMS, and security tooling you already run.
Plugs into your security stack
SSO, SCIM, and SIEM out of the box. Sign in with your IdP, provision from your HRIS, and stream every training event into your SOC pipeline.
- SAML 2.0 and OIDC SSO with any IdP
- SCIM 2.0 auto-provisioning from HRIS
- Webhooks to Splunk, Datadog, and Sentinel
SCORM & LTI for your LMS
Deploy via SCORM 1.2 and 2004 packages, or launch with LTI 1.3 and automatic grade passback.
- Works with your existing LMS via SCORM or LTI
- No custom development required
- Completion and scores post back to your gradebook
Dedicated multi-tenant architecture
Secure, isolated environments with complete customization.
- Complete data segregation per tenant
- White-label with your branding
- Role-based access controls & compliance
Latest blog articles
Practical guides on phishing, AI security, and awareness training. Written by the team behind the exercises.
Hoxhunt vs KnowBe4: Adaptive Phishing or Content Depth?
Hoxhunt vs KnowBe4 compared on adaptive phishing simulation, content library, engagement, SCORM export, reporting, and pricing. Vendor-neutral 2026 buyer guide.
Read the article
KnowBe4 vs Proofpoint: Which Security Awareness Platform Wins?
KnowBe4 vs Proofpoint Security Awareness compared on phishing simulation, threat intelligence, content library, SCORM export, and pricing. Vendor-neutral 2026 guide.
Read the article
OWASP MCP Top 10: Model Context Protocol Risks
The OWASP MCP Top 10 ranks the risks of connecting AI agents to tools. What each category means, and why MCP breaks the assumptions API security relies on.
Read the article