Real defensive judgment — built one piece of evidence at a time.
A mission-based cyber training grid for people who have been failed by certification theatre. Plain language. Click-based reasoning. Zero shells, zero VMs. 100% defensive.
Not “what's in the catalog” — what comes out the other side. Four concrete capabilities you can show, defend and prove with evidence after working through the Phase 1 catalog.
In plain English — no jargon, no acronyms-as-explanation. You can point to the headers, the lure, the brand spoof and the request, link them together as evidence, and write the one-paragraph triage note a SOC lead actually wants to read.
Read the alert, pull the supporting evidence, reason about the false-positive surface, and make the call — with a defensible reasoning trail attached. The kind of work that gets you off the L1 queue.
Given a real-looking incident, identify the tactics and techniques in play, reason about adversary motive, and produce the ATT&CK-mapped narrative a TI team or board update actually consumes.
Translate your defensive program into the language finance speaks — cost of breach, insurance posture, deal velocity, regulatory exposure. The Business & Architecture pillar gives you the frame, the metrics and the narrative.
A training grid for the next generation of defenders — opinionated, evidence-first, written in plain language so non-English speakers and zero-IT beginners can start on day one.
No certification theatre. No memorising acronyms. Learners build real defensive judgment through scenarios they actually have to reason about, with evidence they can collect, link and explain.
A library of click-based labs, case briefs and terminal-style exercises that produce portable evidence the learner owns — not a badge a third party owns on their behalf.
Zero offensive content. Zero glamourised attack tradecraft. The curriculum is built for blue-team work and security operations — the people who clean up the mess.
Catalog, labs, evidence vault, achievement records and the AI tutor workspace coming in Phase 2 — all in a single command-center surface.
45 courses across 8 pillars, 529 lessons, 114 labs — browseable, filterable, plain-language summaries on every entry.
Capstone scenarios that pull together a pillar end-to-end — reason about evidence, build a verdict, defend your reasoning.
Local achievement vault in Phase 1; signed registry with Open Badges 3.0 portability in Phase 2.
Workspace primitives already in place so the Phase 2 AI tutor, cohort room and instructor reporting plug straight in.
Every course, every lab, every case brief follows the same three-beat rhythm — so the cognitive load goes into the reasoning, not into figuring out the platform.
You are given primary sources — log lines, email headers, network captures, change tickets, screenshots, policy documents. Real-looking, never running.
Click-based decisions surface alternative interpretations. No multiple choice tricks. The platform asks you to defend each step.
Your reasoning, your evidence links and your final verdict drop into your achievement vault — a portable record of how you actually think.
Why CyberMODE Grid instead of the existing bootcamps and big-name certs — tradeoffs called out honestly, not hidden.
| CYBERMODE GRIDPHASE 1 MVP | BOOTCAMPS8–24 WEEKS | BIG-NAME CERTSCISSP / OSCP / SEC+ | |
|---|---|---|---|
| Format | Click-based reasoning labs | Live cohorts + VMs | Multiple choice exam |
| Audience | Non-English speakers · zero-IT beginners | Mid-career switchers | Industry insiders |
| Time-to-first-win | ~1 hour | ~2 weeks | ~3+ months |
| Records | Portable evidence vault · Open Badges 3.0 in P2 | Bootcamp brand on CV | Cert number + expiry |
| Defensive focus | ✓100% defensive | ~Mixed | ~Varies |
| VMs / shells | ×Never | ✓Yes | ~OSCP only |
| Plain language | ✓Day one | ~Instructor-dep | ×Acronym-heavy |
| Business modeling | ✓Pillar 08 · built-in | ×Rare | ×Separate (CISM) |
| Pricing | $19 solo · $149 team · $399 academy | $8k–$20k upfront | $300–$1.5k per attempt |
| Refund | ✓14 days · no Qs | ~3-7 days | ×None |
A tiny taste of the mock-tools the platform uses. Click in, type help, hit enter. No shell, no VM, no risk.
Filter by pillar to see what's in each track. Phase 1 ships all 45 courses, all 529 lessons, all 1,575 evidence artefacts — nothing locked.
Phase 1 MVP catalog. Full course content unlocks on signup · 14-day refund.
Every other course assumes vocabulary. This one teaches it — the terms, the mental models, the way defenders actually think and talk about systems.
The defender’s workbench. Five modes that match real defender jobs. Every answer cited from authoritative sources. Every concept linked to a hands-on Grid lesson.
Successful SSH login from 185.220.101.18 (known Tor exit node [1]) immediately after a failed brute-force attempt against multiple accounts. Pattern matches a credential-stuffing success.
Next steps: isolate the operator account, force credential rotation, audit other auth-log sources for the same IP, review last 24h of operator activity.
Four tiers, monthly or yearly billing, 14-day refund. No surprise add-ons in Phase 1.
For one operator. Full catalog access, evidence vault, achievement record.
5 seats included. Team progress view + shared evidence library.
25 learner seats + 3 instructor seats. Cohort-friendly.
SSO, DPA, SOC2 path. Sized for orgs that need their own grid.
All tiers include the 14-day refund · we ask for feedback.
One profile unlocks the full Phase 1 catalog. Email + password, or a magic link.
Live signup creates a real account at /access.
// VERIFY ENDPOINT · PUBLIC
Paste a credential ID or verify URL. We check signature, issuer, and revocation status.
// Real verification ships with Phase 2 (signed registry).
If your question is not here, the team is one email away.
Enterprise demos, partnership questions, accessibility requests, anything else — one email and the team will pick it up.
For Enterprise demos, partnerships, accessibility or anything else, write to hello@cybermode.grid. The team replies within one business day.
What is the single strongest piece of evidence that this is a phishing attempt?