The only cloud IR training platform

Train for Cloud Incidents Like Never Before

Cloud Labs is the only cloud-centric training platform that lets you practice in a real cloud environment. Whether you’re a SOC analyst, experienced incident responder, or just getting started, you'll investigate realistic scenarios across Azure, AWS, M365, and Google Cloud. There's more than 50 hours of labs covering 40+ MITRE ATT&CK techniques to build your cloud incident response skills.

Start Training Explore Labs
“I love it, the questions guide me with an investigative mindset.” “Cloud Labs gave me a real hands-on way to build my cloud and incident response skills — way better than just theory.” “I've personally been waiting for something like this for some time now.” “This is also friendly to sort of beginner like me.”
Why Cloud Labs

Built for Real-World Response

The only platform designed by responders, for responders. Every lab is based on real incidents and real techniques.

Cloud-First Training

Practice in real cloud environments across major platforms just like it is the real deal. There are new labs added monthly.

Azure AWS M365 GCP

Real Attack Scenarios

Investigate token abuse, cryptojacking, ransomware, and more. Every technique is actively used by adversaries.

Token Abuse Ransomware Cryptojacking

Certifications & Badges

Earn digital certificates and Credly badges that prove your skills. Stand out with recognized credentials.

Credly Certificates

Individuals & Teams

Whether you’re training solo or leading a full SOC, help build repeatable, cloud-first skills. Volume discounts available for teams and organizations.

SOC Teams Enterprise

CTF Scoring

Track your progress with competitive scoring. Challenge yourself and compete with the community.

Leaderboards Challenges

Expert Guidance

Learn from real responders with guided walkthroughs, expert hints, and community support.

Walkthroughs Support
Pricing

Choose Your Path

Start free or unlock everything. Clear pricing, no hidden fees.

Monthly Annual (Save 20%)

Trial

€0 /month

Perfect for beginners or curious explorers

  • Try before you buy
  • 7 days of Premium labs
  • Community support
  • Access to all labs
  • Digital certificates
Start Free
Most Popular

Premium

€34.99 /month

Level up your cloud incident response skills

  • 10+ Premium labs
  • Expert hints & guidance
  • Email support
  • Access to new monthly labs
  • Custom scenarios
  • Credly badges
Unlock All Labs
All-in + Bespoke Enterprise Labs

All-In

€49.99 /month

For dedicated learners mastering cloud IR

  • All lab types access
  • Exclusive adversary scenarios
  • Official Credly badges
  • Priority support
  • Team competitions
Most Popular Labs

Our Labs

All labs are designed by responders with real-world cloud incident experience. Each scenario puts you in control so you're ready when it matters.

Bucket Reaper: Static Site Hijack & AWS Backdoor

Investigate how a ransomware note ended up in an S3 bucket — and where the attacker gained persistence.

AWS Ransomware Difficulty: Medium

Sentinel: Cryptojacking via RunCommand

Uncover a stealthy Azure RunCommand exploit and stop hidden mining activity before the bill explodes.

Sentinel Cryptojacking Difficulty: Hard

Silent Forwarding: Detecting Malicious Mailbox Rules

Threat actors love mailbox rules. Follow the breadcrumbs to find what they were exfiltrating and how.

M365 BEC Difficulty: Easy
Explore All Labs

About Invictus Incident Response

Invictus Team Photo
Invictus Incident Response was born to redefine how the industry responds to cloud breaches. After years teaching cloud IR at Black Hat and DEF CON, we saw a clear need for practical, proactive, and hands-on learning. Today, through Cloud Labs we train and empower defenders to think and respond like the best in the field because that’s exactly who’s teaching them. Our mission is simple: help you emerge stronger and remain unconquered in the face of cyber adversity – that's the Invictus spirit.
FAQ

Frequently Asked Questions

Everything you need to know about Cloud Labs

Just sign up for the Trial plan and enjoy all premium labs immediately. After 7 days you will be automatically upgraded to the Premium plan.
Yes! Manage your subscription through our Billing Portal. Upgrades are instant, downgrades take effect at your next billing cycle.
Yes! We offer volume discounts for teams of 3 or more. Contact us at cloudlabs@invictus-ir.com to discuss your needs.
We cover Azure, AWS, Microsoft 365, Microsoft Sentinel, and Google Cloud Platform. All labs use real cloud environments.
Access your invoices anytime through the Billing Portal. For custom quotes or PO requirements, email cloudlabs@invictus-ir.com.
Cloud Labs is built by real incident responders based on real attacks. You practice in actual cloud environments, not simulations. Every scenario is designed to build job-ready skills that matter in the field.

Cloud Labs is our self-paced, on-demand platform for hands-on practice in real cloud environments. It is ideal for individuals or teams training anytime.

Invictus Cloud IR Trainings are in-depth courses taught by the same experts who teach at Black Hat and DEF CON. These deep-dive sessions are foundantional and build skills in either AWS or Microsoft. They start at €1,650 per course. For more information on our trainings: Invictus Academy.