Live Adversary Simulation, Emulation & Response
LASER
A live-fire purple team program built on one rule: every attack gets met with detection, in real time — not in a debrief three weeks later.
For Individual
For Corporate
For Government
Enquire Now
Fill out the form below to enquire about LASER cohort schedules, hosted live range options, in-person delivery, hybrid capability, or custom Red + Blue team training for your organization.
What is LASER?
- LASER stands for Live Adversary Simulation, Emulation & Response.
- It is a live-fire purple team program where Red and Blue work through the same range, in the same room, in real time.
- The program is designed for mixed Red + Blue cohorts. Single-discipline cohorts are also supported, with an instructor playing the opposite role.
- Every attack technique is followed by detection, triage, response, and debriefing immediately, instead of waiting weeks for a retrospective report.
- Every lab runs on a disposable Infrastructure-as-Code range that is rebuilt per cohort.
LASER Program Access
18 Live Contact Loop Labs
Disposable IaC Range Rebuilt Per Cohort
In-Person, Hosted Live Range & Hybrid-Capable
Mixed Red + Blue Team Cohorts
Detection-as-Code & SIGMA Repository
90-Day Detection Engineering Roadmap
Azure Red Team Operation - Attack Path Overview
Offensive Active Directory - Mythic C2 Red Team Operation
The Contact Loop — Program Philosophy
Most red-plus-blue programs teach in series: a red module, followed at some later point by a blue module covering detection for the same technique. By the time blue sees it, the technique feels theoretical and the urgency is gone. LASER inverts that. Every technique in this program runs inside a single repeating unit called the Contact Loop, and both teams move through it together, in the same room, on the same range, in real time.
STAGE
Red selects and prepares a technique against the week's chosen objective, without disclosing specifics to blue.
CONTACT
Red executes the technique live against the shared range.
SIGNAL
Blue watches it unfold in its own telemetry, in real time, with no advance warning.
COUNTER
Blue triages, builds or tunes a detection, and responds where appropriate — not a retrospective write-up.
DEBRIEF
Both teams reconstruct the exercise together: what red did, what blue saw, where the gap was, and what detection exists now that did not an hour ago.
Every lab in this program — eighteen of them across six days — runs as one or more Contact Loops. By Day 6, the capstone is simply the Contact Loop run at full scale, unscripted, for an entire day.
Learning Outcomes
LASER is intentionally a converged program. It assumes the room contains both disciplines and is built for them to learn from each other — not for one to lecture at the other.
Red-Side Outcomes
- Plan and execute a full attack chain from external recon through domain dominance while operating under a live detection-deconfliction protocol.
- Bypass specific defensive controls — AMSI, ASR, AppLocker, EDR — with a working understanding of what telemetry each bypass attempt generates.
- Build and execute a custom threat-emulation plan mapped to ATT&CK, tailored to a real organization rather than a generic scenario.
Blue-Side Outcomes
- Run a detection-as-code pipeline where SIGMA rules are version-controlled and regression-tested, not just written once and forgotten.
- Run hypothesis-driven threat hunts instead of waiting on alerts.
- Quantitatively measure and report detection coverage gap-closure using a DeTT&CT-style scorecard.
- Correlate identity-attack signal across hybrid Entra ID and AWS environments.
- Secure and test AI-assisted SOC tooling against prompt-injection manipulation.
Joint / Purple Outcomes
- Operate a live Contact Loop exercise model inside their own organization after the program ends.
- Produce a 90-day detection-engineering roadmap tied to a specific environment.
- Run an after-action review that turns one-time findings into standing detections.
Program at a Glance
| Day | Theme | Red Focus | Blue Focus |
|---|---|---|---|
| 1 | Range Genesis & Operating Model | Engagement design, IaC range build, threat-informed scoping | Telemetry-first build, baseline coverage scorecard |
| 2 | First Contact: Initial Access | External recon, web/client-side entry, control bypass | Attack-surface monitoring, entry telemetry, first SIGMA rules |
| 3 | Domain Recon & Credential Ops | Identity graph recon, credential harvesting, Kerberos abuse | Identity telemetry, deception objects, ticket-anomaly detection |
| 4 | Lateral Movement & Persistence | Multi-hop pivoting, COM/WMI/DLL/Office persistence | Network pivot detection, hypothesis-driven hunting |
| 5 | Hybrid Identity & AI-Augmented Ops | Entra ID + AWS IAM attack paths, AI-assisted recon | Cross-cloud correlation, AI-assisted triage, prompt-injection testing |
| 6 | Capstone: Live-Fire Red vs Blue | Full kill-chain execution, real-time adaptation | Full detection-to-containment, executive briefing under pressure |
LASER Day-Wise Curriculum
The LASER curriculum runs across six days and eighteen live-fire labs. Each day blends red-side execution, blue-side detection and response, and joint debriefing through the Contact Loop model.
The program begins with the purple operating model and range build, moves through initial access, domain recon, credential operations, lateral movement, persistence, hybrid identity, and AI-augmented operations, and ends with a full-day live-fire capstone and a 90-day detection-engineering roadmap.
6 Days / 48 Hours
Live-Fire Program
Built by Hacker Associate
Program Design
18 Contact Loop
Labs
Day 1 — Range Genesis & the Purple Operating Model
Before a single packet gets thrown, this program builds the operating model both teams will live inside for the rest of the week: how red and blue talk to each other mid-exercise without spoiling the test, how the range gets built so blue has visibility from minute one, and how the week's version of winning actually gets measured.
Module 1.1 — Building a Purple Function That Survives Contact
Red Track
- Drafting the engagement charter, success criteria, and knock-it-off authority before any technique runs.
- Designing a deconfliction channel so red can flag a technique-in-progress to blue without giving away the test itself.
- Setting objective-based scoring tied to business risk, not just flag captured.
Blue Track
- Standing up a live exercise tracker that logs who did what, when, and the resulting detection latency.
- Defining a four-stage detection maturity rubric used all week: Logged, Alerted, Triaged, Contained.
- Setting the threshold for when a live-fire exercise pauses because it might be a real incident.
Tools introduced: Exercise-tracking tooling (VECTR-class), MITRE ATT&CK Navigator, a custom engagement scoring template.
Live Contact Loop Lab: Both teams jointly draft the week's Rules of Engagement and scoring rubric, then fire one deliberately harmless calibration shot, a benign Atomic Red Team test, purely to
prove the scoring and logging pipeline works end to end before anything real begins.
Module 1.2 — Range-as-Code: Building the Battlespace
Red Track
- Standing up disposable attacker infrastructure, including redirectors, listener, and payload staging, via Ansible/Terraform.
- Setting up C2 Server and performing live recon and exploitation.
- Designing the infrastructure to burn and rebuild cleanly between exercises, leaving no cross-contamination.
- Documenting the build as a repeatable pipeline rather than a one-off setup.
Blue Track
- Wiring telemetry in before red ever touches a box: Sysmon configuration baselines, sensor placement, centralized log shipping.
- Standing up the SIEM/log pipeline (Wazuh/ELK-class) and confirming ingestion before Day 2 begins.
- Building the asset inventory and known-good baseline every later anomaly gets compared against.
Tools introduced: Terraform, Ansible, Sysmon-config-as-code, a network sensor (Zeek-class), a SIEM (Wazuh/ELK-class), Velociraptor for endpoint visibility.
Live Contact Loop Lab: Both teams stand up the shared range together — a small AD forest, a DMZ host, and a cloud identity tenant — and validate the full telemetry path with a synthetic event before
lights-out.
Module 1.3 — Threat-Informed Scoping & the Coverage Baseline
Red Track
- Selecting a realistic adversary profile to emulate later in the week, grounded in sector-relevant threat intelligence rather than attack everything.
- Mapping that profile's TTPs onto ATT&CK Navigator as the week's technique backlog.
- Agreeing with blue on which techniques stay off-limits for this cohort's environment.
- Monitoring APT Group, Mapping Business Assets and Threat Modelling.
Blue Track
- Running a DeTT&CT-style baseline assessment: what can we currently detect, log, and visualize, before any attack runs.
- Identifying the five biggest detection blind spots the week is designed to close.
- Publishing the Day 1 coverage scorecard — the number both teams get compared against on Day 6.
Tools introduced: ATT&CK Navigator, DeTT&CT, sector threat-intelligence reporting.
Live Contact Loop Lab: A joint working session that produces the program's single most important artifact: the Day 1 coverage scorecard, which every later lab either chips away at or fails to move.
Day 2 — First Contact: Initial Access & Entry Telemetry
Day 2 is about getting in — and about building the visibility blue needs the instant something does.
Module 2.1 — External Recon & Attack Surface Discovery
Red Track
- Passive OSINT and certificate-transparency-based discovery of exposed assets.
- Building a target attack-surface map: exposed services, technology fingerprinting, leaked credentials or secrets.
- Scoping which discovered assets are realistic entry candidates versus noise.
- OPSEC-Safe Asset Scanning via Bot IP Rotation.
Blue Track
- Building a continuous external attack-surface monitoring baseline so blue already knows what's exposed before red finds it.
- Treating newly-exposed assets or subdomains as a detection signal in their own right, not just inventory housekeeping.
- Comparing blue's own asset inventory against what red actually discovered.
Tools introduced: Certificate-transparency monitoring, subdomain/attack-surface discovery tooling, service fingerprinting.
Live Contact Loop Lab: Red produces a target map inside a fixed time window. Blue is scored not on catching red here, but on how closely its own asset inventory matches what red just found — a coverage-gap
test rather than a chase.
Module 2.2 — Modern Web & Client-Side Entry Vectors
Red Track
- API and single-page-app attack surface: JWT abuse, broken object-level authorization, business-logic abuse.
- File-upload and injection-class vulnerabilities chained toward code execution.
- Client-side delivery: lure documents and macro-based execution, with target fingerprinting ahead of payload choice.
- OWASP TOP 10.
- OAUTH/OIDC Exploitation and Security.
- Automate CVE Hunting at Scale.
Blue Track
- Building reverse-proxy and WAF logging that actually supports investigation, not just a block/allow counter.
- Detecting abnormal Office-to-child-process chains as a macro-execution signal.
- Triaging a live web-layer alert against the application's actual business logic, not just the request pattern.
Tools introduced: Intercepting proxy (Burp-class), automated injection testing (sqlmap-class), mail/EDR telemetry for macro execution.
Live Contact Loop Lab: Live-fire: red delivers one payload through a single chosen vector. Blue has a scored window to triage the resulting alert and answer what just happened — not just that something
happened.
Module 2.3 — Living Off the Defenses: Bypassing the Bypass-Detectors
Red Track
- AMSI, ASR, and AppLocker bypass techniques, examined at the mechanism level so blue can be taught the matching signal.
- EDR evasion concepts — hooking, unhooking, direct syscalls — at the depth needed to reason about detection, not just execution.
- Choosing a bypass deliberately noisy enough to be a fair first detection-engineering test for blue.
Blue Track
- Writing the week's first detection-as-code artifact: a SIGMA rule for an AMSI-bypass attempt, version-controlled and test-driven.
- Building a logging strategy specifically for ASR/AppLocker bypass attempts — the attempt itself is the signal, success or not.
- Committing the rule to a shared detection repository before the lab is scored.
Tools introduced: SIGMA rule authoring with sigma-cli/uncoder.io-style conversion, Windows Defender/AMSI event logging.
Live Contact Loop Lab: Red runs a documented bypass live. Blue's SIGMA rule has to fire inside the scored window and gets committed to the week's growing detection repository — the first entry in
what becomes a real artifact by Friday.
Day 3 — Domain Recon & Credential Operations
With a foothold established, Day 3 moves into the identity fabric — the part of the network where most real breaches actually become catastrophic.
Module 3.1 — Mapping the Identity Fabric
Red Track
- Identity-graph reconnaissance: object, ACL, and trust enumeration across the directory.
- ON PREM AD + Cloud Entra ID Recon.
- ON PREM AD + Cloud Entra ID Exploitation.
- Exploitation via IMPACKET SCRIPTS.
- SPN, share, and object-permission discovery to locate the shortest path to a privileged target.
- Building an attack-path graph and validating it against the live environment, not just theory.
Blue Track
- Building identity telemetry baselines — what normal authentication actually looks like in this environment.
- Instrumenting directory-service access logging so identity recon itself becomes visible.
- Independently reconstructing the same attack path from configuration review and telemetry alone.
Tools introduced: Graph-based directory enumeration tooling, PowerShell/.NET enumeration, directory-service audit logging.
Live Contact Loop Lab: Red builds a graph to a privileged target. Blue, working from telemetry and configuration review alone and without seeing red's graph, has to independently arrive at the same
path. The debrief compares the two maps.
Module 3.2 — Credential Operations Beyond LSASS
Red Track
- LSASS dumping methods and the OPSEC tradeoffs of each.
- Non-LSASS credential theft: NTLM downgrade-class attacks, forced authentication coercion.
- Directory replication abuse for bulk credential material.
- Password Hash Cracking [ All Types ].
- Pass the PRT and Pass the Hash.
Blue Track
- ETW/Sysmon-based detection for LSASS access patterns.
- Deploying deception objects — honey credentials and canary service accounts — as an active countermeasure, not passive logging.
- Auditing directory replication requests for the specific anomaly pattern bulk theft produces.
Tools introduced: Sysmon/ETW-based credential-access detection, deception/canary tooling, directory-replication auditing.
Live Contact Loop Lab: Blue plants a canary credential before the day starts, without telling red which one. Red runs its credential-harvesting operation cold. The debrief reveals whether red touched
the canary, and exactly how fast blue's alert actually fired.
Module 3.3 — Kerberos Warfare
Red Track
- Roasting techniques against service and AS-REP-eligible accounts.
- All Kerberos Attacks.
- Ticket forgery and delegation abuse across unconstrained, constrained, and resource-based patterns.
- Cracking the resulting material and validating its actual usability before claiming success.
Blue Track
- Detection patterns for ticket-request anomalies and delegation abuse.
- Building anomaly baselines for ticket lifetime and encryption-type patterns.
- Updating the week's coverage scorecard with the first mid-week measurement.
Tools introduced: Kerberos auditing event analysis, ticket-analysis tooling, hash-cracking workflows.
Live Contact Loop Lab: Red roasts and cracks a target account live. Blue has to catch both the roasting attempt and the later ticket misuse — two separate detections, scored separately — before
the week's scorecard gets its first real update.
Day 4 — Lateral Movement, Persistence & Threat Hunting
Day 4 is where the program stops being about a single technique and starts being about an adversary settling in for the long haul — and a blue team that has to go looking instead of waiting.
Module 4.1 — Pivoting the Battlespace
Red Track
- Multi-hop tunneling and port-redirection across network and identity boundaries.
- Evading egress controls while maintaining a usable command channel.
- Choosing a pivot path that a network-only sensor would plausibly be able to see, as a fair test for blue.
Blue Track
- Network-based pivot and beaconing detection using sensor data alone, with no endpoint assistance.
- Building a baseline for what normal internal traffic shape looks like in this environment.
- Reconstructing the pivot path from network telemetry after the fact, hop by hop.
Tools introduced: Network sensor analysis (Zeek-class), traffic-baseline tooling, beacon-pattern detection.
Live Contact Loop Lab: Red builds a multi-hop pivot chain. Blue's job is to detect and reconstruct it from network telemetry alone — deliberately without endpoint help — inside the scored window.
Module 4.2 — Ghosts in the Machine: Persistence Tradecraft
Red Track
- COM hijacking and COM search-order abuse.
- WMI event-subscription persistence: filters, consumers, and filter-to-consumer bindings.
- DLL search-order, Office template/add-in, and application-shim persistence.
- Stealth persistence through directory objects rather than the filesystem.
Blue Track
- Building a hypothesis-driven persistence-hunting playbook instead of waiting for an alert to fire.
- Converting every successful hunt into a standing detection rule before the day ends.
- Practicing the hunt cold, against a mechanism the hunter was not told in advance.
Tools introduced: Hunt-playbook tooling, WMI/COM event auditing, the week's growing SIGMA repository.
Live Contact Loop Lab: Red implants exactly one persistence mechanism without disclosing which. Blue runs the hunt playbook it just built that morning and has a scored window to find it — then turns
the find into a rule before lunch.
Module 4.3 — Coverage Scoring & Mid-Week Gap Closure
Joint Session
- Recomputing the DeTT&CT-style scorecard from the Day 1 baseline and showing the measured delta after three days of live contact.
- Identifying which blind spots remain open and why.
- Re-prioritizing Day 5 and 6 focus areas based on what the numbers actually show, not assumption.
Tools introduced: DeTT&CT, ATT&CK Navigator.
Live Contact Loop Lab: A joint scoring session, not a live-fire lab — the whole point of Day 4's close is to look at the numbers together before deciding where Day 5 needs to push hardest.
Day 5 — Hybrid Identity & AI-Augmented Operations
Day 5 pushes into the two places most programs still treat as afterthoughts: identity that spans more than one cloud, and an AI layer that is now part of the attack surface on both sides.
Module 5.1 — Breaking Hybrid Identity: Entra ID + AWS IAM
Red Track
- Entra ID attack paths: token theft, consent-grant abuse, device-code phishing.
- Abusing service principals and managed identities.
- AWS IAM attack paths run in parallel: misconfigured policy abuse, trust-policy exploitation, role-chaining for privilege escalation.
- Chaining a privilege-escalation path that crosses both identity providers in a single engagement.
Blue Track
- Cloud-native detection on the Entra/identity-protection side of the house.
- Cloud-native detection on the AWS CloudTrail/GuardDuty side of the house.
- Correlating signal from both platforms into a single incident timeline — deliberately harder than detecting either one alone.
Tools introduced: Entra ID identity-protection logging, AWS CloudTrail/GuardDuty-class detection, IAM policy-analysis tooling (Prowler/ScoutSuite-class).
Live Contact Loop Lab: Red executes a privilege-escalation chain that crosses both identity providers. Blue has to correlate signal across both platforms into one timeline — the hardest detection
exercise of the week by design.
Module 5.2 — AI-Augmented Adversary Operations
Red Track
- Using LLMs to accelerate recon synthesis and report drafting under authorized scope.
- Generating AV-evasion test variants with AI assistance, covered at a methodology and ethics level rather than as a how-to.
- Understanding where AI-assisted tradecraft actually saves time versus where it just adds noise.
Blue Track
- AI-assisted SOC triage and alert summarization across a high-volume queue.
- Securing the AI layer itself: prompt-injection risk inside AI-driven SOAR and copilot tooling.
- Testing whether the AI assistant in their own triage workflow can be manipulated by content inside the data it is summarizing.
Tools introduced: LLM-assisted recon/reporting workflows, AI-assisted SOC triage tooling, prompt-injection test cases.
Live Contact Loop Lab: Blue is handed a flood of synthetic alerts and uses an AI-assisted triage workflow to find the one real incident inside a scored window. One alert in the flood contains a
planted prompt-injection attempt aimed at the AI layer itself — the debrief reveals whether it worked.
Module 5.3 — Building a Custom Adversary Emulation Plan
Joint Session
- Each participant builds a threat-archetype emulation plan tailored to their own organization's actual exposure — not a generic, pre-packaged actor.
- Mapping the chosen archetype's TTPs onto ATT&CK Navigator as a reusable artifact.
- Reviewing each other's plans for realism before anyone executes one.
Tools introduced: ATT&CK Navigator, the week's accumulated threat-intelligence notes.
Live Contact Loop Lab: Each team executes its own mini emulation plan end to end, with the opposite team running the full triage-to-containment workflow against it live.
Day 6 — Capstone: Live-Fire Red vs. Blue
Day 6 does not introduce new material. It is the Contact Loop run at full scale, unscripted, for an entire day — the test of whether the previous five days actually changed anything.
Module 6.1 — Capstone Operations Order
Joint Session
- Final Rules of Engagement briefing and reconfirmation of knock-it-off authority.
- Scoring rubric reveal: how the day will actually be measured.
- Team assignment — mixed cohorts split into dedicated red/blue sides for the day, or rotate roles partway through.
Tools introduced: The full scoring rubric and exercise tracker built on Day 1.
Live Contact Loop Lab: No scored lab here — this module is the briefing the capstone itself runs on.
Module 6.2 — Full-Day Live-Fire Capstone
Red Track
- Attempting a full kill chain against the now-hardened range, end to end, with no advance disclosure to blue.
- Operating under the same deconfliction protocol established on Day 1.
- Adapting in real time when a technique gets detected and contained mid-chain.
Blue Track
- Detecting, triaging, and containing across the full chain in real time.
- Delivering a real-time executive briefing partway through the day — testing communication under pressure, not just detection.
- Logging every detection and containment action for the after-action review.
Tools introduced: Everything built over the previous five days: the SIEM, the SIGMA repository, the deception objects, the hunt playbooks.
Live Contact Loop Lab: The capstone itself: a full day of live contact, scored against the same rubric used all week, with no script and no advance warning on either side.
Module 6.3 — After-Action Review & the 90-Day Roadmap
Joint Session
- Running a formal after-action review that turns one-time findings into standing detections, not just a slide deck.
- Recomputing the final coverage scorecard against the Day 1 baseline and presenting the measured delta.
- Drafting a 90-day detection-engineering roadmap tied to the participant's own environment.
- Reviewing completion criteria for the LASER Purple Team Practitioner credential.
Tools introduced: The full week's detection repository, the coverage scorecard history, an AAR documentation template.
Live Contact Loop Lab: The program's final artifact: each participant leaves with a signed-off 90-day roadmap, not just a certificate.
Course Delivery
- In-Person
- Hosted Live Range
- Hybrid-Capable
- Onsite Corporate Cohorts
Instructor
Program Design: Harshad Shah / Hacker Associate. LASER is built as a practitioner-focused live-fire purple team program where Red and Blue learn from each other through direct contact, real telemetry, and measurable detection improvement.
Trusted By
Range & Tooling Architecture
Everything below is real, industry-standard tooling — the range is built to be rebuilt by the client's own team after the program ends, not locked to a vendor platform.
| Category | Examples |
|---|---|
| Range Infrastructure-as-Code | Terraform, Ansible, Vagrant/Packer |
| Red — Initial Access & Web | Intercepting proxy (Burp-class), automated injection testing (sqlmap-class), lure/document tooling |
| Red — Identity & Credential Ops | Graph-based AD enumeration, Kerberos ticket tooling, hash-cracking workflows |
| Red — Evasion & C2 | Direct-syscall/unhooking techniques, EDR-aware loaders, disposable C2 infrastructure |
| Blue — Telemetry & SIEM | Sysmon, a network sensor (Zeek-class), a SIEM (Wazuh/ELK-class), Velociraptor for endpoint triage |
| Blue — Detection Engineering | SIGMA authoring with sigma-cli/uncoder.io-style conversion, DeTT&CT coverage mapping, ATT&CK Navigator |
| Blue — Deception | Honey credentials, canary service accounts, decoy services |
| Cloud Identity | Entra ID identity-protection tooling, AWS IAM policy-analysis tooling (Prowler/ScoutSuite-class) |
| AI-Augmented Ops | LLM-assisted recon/report drafting, AI-assisted alert triage, prompt-injection test harnesses |
| Exercise Tracking | Purple-team exercise tracker (VECTR-class), custom scoring rubric template |
Total Program Fee
CustomCohort-based pricing
Course Pricing
LASER is delivered as an in-person, hosted live range, hybrid-capable, or onsite corporate cohort. Pricing depends on cohort size, range requirements, delivery mode, and customization needs.
Contact Hacker Associate for PricingWho Should Attend & Prerequisites
Prerequisites
- Working knowledge of networking, Linux, and Windows fundamentals.
- Familiarity with Active Directory and core security concepts.
- Comfortable with the command line and at least one scripting language: Bash, PowerShell, or Python.
- Prior hands-on exposure to either offensive or defensive security work.
NOTE:
This is a converged program for practitioners, not an entry point into the field.
Who Should Attend?
- Penetration testers and red team operators who want to see what their actions actually trigger on the blue side of the glass.
- SOC analysts, detection engineers, and blue team members who want hands-on offensive context instead of slides.
- Purple team leads and security program owners building or scaling an internal purple capability.
- Forensics and DFIR practitioners who want offense-informed context for their investigations.
Audience Model
- Mixed Red + Blue cohorts are the primary audience.
- Single-discipline cohorts are supported, with an instructor playing the opposite role.
- The room is built for both disciplines to learn from each other, not for one to lecture at the other.
- The program is suitable for individual practitioners, corporate teams, and government organizations.
NOTE:
Program flow can be adapted for red-only or blue-only teams while preserving the Contact Loop.
Assessment, Scoring & Certification
Every live-fire lab in this program is scored against the same three metrics, rolled into one running scorecard carried from Day 1 to Day 6.
Detection Coverage %
A DeTT&CT-style measurement, tracked from the Day 1 baseline through the Day 6 final score.
MTTD & MTTC
Mean Time to Detect and Mean Time to Contain, measured per scored exercise, not estimated after the fact.
Red Objective Completion %
Whether red achieved the stated engagement objective within the agreed Rules of Engagement.
Participants who complete the Day 6 capstone and submit a 90-day detection roadmap receive the LASER Purple Team Practitioner completion credential.
Final Artifacts Participants Leave With
Detection Repository
- SIGMA rules created, tuned, and committed during the week's detection-as-code workflow.
- Standing detections created from hunts, bypass attempts, identity attacks, and capstone activity.
Coverage Scorecard
- Day 1 baseline measurement.
- Mid-week delta after live contact.
- Final scorecard showing measured detection gap closure by Day 6.
90-Day Roadmap
- A formal after-action review output.
- A signed-off 90-day detection-engineering roadmap tied to the participant's own environment.
- AAR documentation template and coverage scorecard history.
Certification
LASER certification is earned through live-fire participation, Contact Loop execution, practical detection engineering, the Day 6 capstone, and submission of a 90-day detection roadmap. The credential validates that participants can operate a live purple team exercise model, measure detection coverage, and turn after-action findings into standing detections.
Successful participants receive the LASER Purple Team Practitioner completion credential from Hacker Associate.
LASER Course FAQs
01
What does LASER stand for?
LASER stands for Live Adversary Simulation, Emulation & Response. It is a live-fire purple team program where every attack gets met with detection, response, and debriefing in real time.
02
Who is LASER built for?
It is built for penetration testers, red team operators, SOC analysts, detection engineers, blue team members, purple team leads, security program owners, and DFIR practitioners.
03
What makes the Contact Loop different?
The Contact Loop keeps Red and Blue in the same exercise cycle: stage, contact, signal, counter, and debrief. Blue sees the technique unfold in telemetry as it happens, not weeks later in a report.
04
What do participants receive after completion?
Participants who complete the Day 6 capstone and submit a 90-day detection roadmap receive the LASER Purple Team Practitioner completion credential.
