Using Range

How scoring works: the identity and cloud graph

Range scores your decisions on the same identity and cloud graph model used to detect these attacks in production. Here is what that means.

Range does not grade you on a static answer key. It scores your decisions against a model of how identity and cloud attacks actually move, so the feedback reflects what would really have happened.

Train on the same model you defend with

The scoring model is an identity and cloud graph: identities, credentials, resources, and the relationships between them, the edges an attacker traverses. It is the same kind of model used to detect these attacks in production. That is deliberate. The edges you learn to spot in training are the edges that matter in the real environment, so training and detection are not two different mental models.

What gets scored

Detection: did you recognize the attack and scope it correctly, and how quickly?
Containment: did you cut the right edge? Revoking a session beats resetting a password when a token is in play.
Eradication: did you find the real persistence, or treat a symptom?
Forensics: did you scope the blast radius accurately?
Recovery and decisions: did you restore trust in the right order and make the leadership calls well?

Why decisions, not just clicks

A good score reflects sound reasoning under pressure, not memorization. Choosing the right containment for the specific credential being abused, an app-only token versus a user session versus a temporary cloud credential, is the kind of judgment Range measures.

Reading your results

After a scenario you see your score, a decision-by-decision breakdown, and feedback grounded in how the attack behaves. Use it to find where your instinct diverged from what the attack required, then run it again.