Live-fire investigation workshops

Investigate a real breach. Then find it before it happens.

Every workshop below is free and open-source, always — the exercise, the evidence, the wiki, no login, no paywall. An AI agent, armed with the open-source Anthropic Cybersecurity Skills library, does the actual investigation while you drive and check its work. What's for sale is a live seat in the room — see how that works below.

casky-ai.github.io
/casky-workshops

Workshops

Cloud · SSRF → IMDS → S3 exfil

TollBooth / OpenDoor

A web server leaked AWS credentials through SSRF. Investigate the breach (TollBooth), then audit the configs that caused it (OpenDoor). ~20 min each, free to run yourself.

DFIR · Phishing → AD domain compromise

Tailgate / GuestList

A phishing email leads to lateral movement and a full Kerberoasting domain compromise — a 3-act kill chain. Then audit the email/network/AD hygiene that let it happen (GuestList). ~25 min each, free to run yourself.

AppSec · Vibe-coded app breach

FastLane / SpeedBump

"The Vibe Coding Security Top 10 Gotchas" — a vibe-coded SaaS app breached through a real, sourced pattern (RLS misconfig, leaked secrets, IDOR, slopsquatting). Then audit it before it ships (SpeedBump). ~25 min each, free to run yourself.

Which path do I run?

Every workshop can be driven two different ways. Pick whichever matches today's room setup — your facilitator will tell you which, but here's the difference:

	Section 1 — Kali + Claude Code	Section 2 — Casky Box
Skill selection	10 hand-picked skills, symlinked per laptop	Auto-classified from all 818 skills, per investigation
Agent runtime	Claude Code installed per laptop	One shared `casky-runner` container
Verification	`verify.sh` — raw grep/jq checks on the data	`[VERIFIED]` transcript per step — did the agent actually run the assigned skill's script
Output	Cheat-sheet answer pages	Structured plan → findings → CISO-style consolidated report
Reset between attendees	`./reset.sh` (<10s)	Each investigation run is already fresh

Each workshop's own Setup page has the exact steps — do that first, before opening either scenario page. Every setup has been run end-to-end for real before being written down, not just described.

Skill-focused workshops

A separate, lighter series: each one is built around a single skill from the Anthropic Cybersecurity Skills library, exercised end-to-end against one scenario — no reactive/proactive pair, no Casky Box section, just one skill and one focused exercise.

Data protection · anonymizing-pii-with-microsoft-presidio

Dashcam

Catch PII before it leaves the building — a support-ticket export, a Slack thread, a driver-records export, and a dashcam frame image, all headed to a vendor or staging unscrubbed. ~15–20 min, free to run yourself.

How this works

Every exercise here — the scenario, the evidence, the wiki, the scripts — is free and open-source in this repo, permanently. What's for sale is live delivery: a seat in a real session, taught in person or virtual, working through the material with an instructor and a cohort. A short free "Lightning Lesson" runs periodically as a preview of the format before any paid session — same content, shorter and live.

Tier	What it is	Price
Run it yourself	Everything on this site — the full exercise, self-guided	Free, always
Lightning Lesson	A short live preview session	Free
Full session	The complete workshop, taught live, in-person or virtual	Paid — dates announced per workshop

Authorized & lawful use only. All data in every scenario is synthetic and self-contained — no live systems are touched. Built on the open-source Anthropic Cybersecurity Skills library (Apache-2.0); not affiliated with Anthropic PBC. TollBooth/OpenDoor's source data is trimmed from BHUSA-Anthropic-CyberSecurity-Skills. Tailgate/GuestList and FastLane/SpeedBump feature entirely fictional companies and, where referenced, real publicly-documented incidents (CVE-2025-48757, the Moltbook breach, etc.) — cited for accuracy, not affiliated with or endorsed by those companies.