128Workflows
Guided runs on nmap, sqlmap, kubectl and friends. Read the output right or stay on the step.
Your daily dose of cybersecurity
Tap. Learn. Level up.
Offensive and defensive cybersecurity learning in short interactive sessions solved with a tap or a click. Beginner to professional, at your own pace. Lessons, campaigns, live CVEs, ranked duels and more, on web, iOS and Android.
- Free to start
- No labs, no setup
- Real technical depth
Real tooling, real stacks
- nmap
- sqlmap
- Burp Suite
- Wireshark
- kubectl
- Terraform
- AWS IAM
- Kerberos
- BloodHound
- Log4j
- OpenSSH
- nginx
- Express
- Django
- Spring
- Docker
- Metasploit
- Mimikatz
- Sigma
- Suricata
- GraphQL
- OAuth 2.0
- LangChain
- Solidity
Would you catch it?
Pick a tier and answer. These are graded exactly the way the app grades them. The explanation behind each verdict is what you unlock with an account.
Nothing here is a definition quiz. Every card puts real material on screen and asks for a judgement about it.
Four tiers, Novice to Expert: recognition, application, analysis, then mastery calls on realistic material with nothing signposted.
Cards are authored and validated, never generated on request. The same card id always deals the same card.
Your hand.
Each type has its own renderer, its own answer shape and its own grading rule. Pick a card.
Concept Flash
A prompt, an optional snippet and one right option. Establishes an idea before anything asks you to apply it; the reveal explains your wrong pick too.
01 · A card
Real code. One judgement.
A route handler, five lines, one of them hands the attacker the database. Pick the line. Hints and the glossary are a tap away; in a duel they are not.
- 8 card types
- 4 difficulty tiers
- Instant verdict
02 · The verdict
Right or wrong, you get the reason.
Every reveal explains the correct answer and your pick. Mastery XP lands on the bar the moment the card is graded, once per card, forever.
- +10 to +60 XP by tier
- 120 levels
- Tokens on Pro
03 · Ranked
Same deck. Rating-matched opponent. Ten minutes.
A live pace signal tells you if you are ahead or behind, and by how much. No hints, no debrief until it ends.
- Ranked on every plan
- Ghost never sees your answers
One library. Pick your door.
Workflows
Guided runs on nmap, sqlmap, kubectl and friends. Read the output right or stay on the step.
Campaigns
Multi-stage kill chains with a brief and a debrief. Two free, all on Pro.
CVEs
Real disclosures as cards within days. Bonus scaled by the real CVSS score.
Simulations
Whole environments, end to end: a live target to break into, then harden. Coming soon.
Custom Session
Pick the card type and the count, or run one of every type in a shuffled Quick Drill.
Lessons
Domains → modules → lessons, with a walkthrough before the cards. Seven domains, from fundamentals to Active Directory.
Workflows
Guided runs on nmap, sqlmap, kubectl and friends. Read the output right or stay on the step.
Campaigns
Multi-stage kill chains with a brief and a debrief. Two free, all on Pro.
CVEs
Real disclosures as cards within days. Bonus scaled by the real CVSS score.
Simulations
Whole environments, end to end: a live target to break into, then harden. Coming soon.
Custom Session
Pick the card type and the count, or run one of every type in a shuffled Quick Drill.
Lessons
Domains → modules → lessons, with a walkthrough before the cards. Seven domains, from fundamentals to Active Directory.
What changes after a season.
“The config audits broke a habit I didn’t know I had. I used to flag everything that looked scary. Hexret charges you for that, so now I read the line.”
“Ten minutes a day on the phone, mostly time attacks and the CVE feed. Three months later I recognised every snippet an interviewer put in front of me.”
“Duels are the first training format that felt like an on-call page. No hints, a clock, and someone on the other side of the deck who is also not slowing down.”
“We put the whole platform team on the Blue path for a quarter. The Diff Challenges did more for our code reviews than the last two secure-coding courses combined.”
Free is a real plan. Pro is the whole library.
Every number below is the policy the server enforces. Nothing on free is a trial: it does not expire, and progress carries over the day you upgrade.
Free
€0forever
- Modules2
- Campaigns2
- Workflows5
- CVE feed5 newest
- Quick runs3 / day
- Ranked duels3 / day
- Time attacks3 / day
- Custom & weakness drillsNot included
- TokensNot included
ProAll of it
€9.99/ month
Billed monthly
- ModulesAll
- CampaignsAll
- WorkflowsAll
- CVE feedLive, full
- Quick runsUnlimited
- Ranked duelsUnlimited
- Time attacksUnlimited
- Custom & weakness drillsIncluded
- TokensEvery run
Pro yearlySave 25%
€89.99/ year
€7.50 / month · billed yearly
- ModulesAll
- CampaignsAll
- WorkflowsAll
- CVE feedLive, full
- Quick runsUnlimited
- Ranked duelsUnlimited
- Time attacksUnlimited
- Custom & weakness drillsIncluded
- TokensEvery run
- Season podium: a month of Pro, on the house
- Progress is never partitioned by plan
The same cards, in your pocket.
One account, one progress. Start a lesson on the desk, finish a time attack on the train, check the season ladder before bed.
- Built for thumbs
Swipe decks, haptic verdicts and a level meter that lands where your eye already is.
- Sign in with Apple or Google
Your web account, no new password. GitHub too.
- Reminders that respect you
A ping when a new season opens or you finish on its podium. Nothing else.
- Honest about the network
An offline bar tells you when an answer cannot land, and nothing pretends it did.
Download on theApp StoreSOONGet it onGoogle PlaySOON
Before you start.
Anything missing? The feedback button lives on every screen inside the app.
Do I need an account to try it?
No. The sample cards at the top of this page are graded for real without one. An account is what stores your progress, unlocks the explanation behind each verdict and puts you on the ladder.
What exactly does the free plan include?
A curated starter set of modules (all of Security Fundamentals, half of Web and AI Security, three Cloud modules), two campaigns, five workflows, the five newest CVEs, and three quick runs, three duels and three time attacks a day. It never expires.
What happens when I hit a daily limit?
The surface shows a countdown to the server's next day boundary and everything else stays open. Duels you have already started are never cut short.
Do duels count on the free plan?
Yes. Every duel is ranked on every plan and moves your rating the same way. Free is metered at three a day; the only part of a duel's payout it does not receive is the token.
Can I change my path later?
Any time, from the account menu. The roadmap and the theme switch immediately. Mastery, level, streak and rating belong to your account and are not partitioned by path.
Where does the content come from?
Every card is written by people, validated on import and served from a content store. Nothing is generated when you press play, so the same card is always the same card, and a CVE entry is anchored to the real disclosure, CVSS vector and CWE.
How do refunds and cancelling work?
Inside the first 14 days the whole first payment comes back and Pro ends there and then; that withdrawal is available once per account. After that, cancelling stops the renewal; Pro stays open until the end of the period you paid for, and nothing you earned is lost.
Become a cybersecurity wizard!
Every wizard starts as an apprentice. Start free, switch paths whenever you like, and go Pro when you want the whole spellbook.