Home
Solutions
Academies & Training Centers Enterprise Government & Defense Partners
Platform
Cyberium Capture the Flag Learning Journey Programs Specto+ Awareness Certifications About Contact
Login Contact Sales
Captured, not written

The break-in your students
investigate actually happened.

Our own machines sit on the open internet and get attacked. We keep what the intruders did — the commands, the files, the timeline — and your students work that evidence. Every case is a real session, and we can tell you the date it happened.

cyberium  /  the film  /  0:45
CYBERIUM IN 45 SECONDS · press play for sound

The live dashboard your
students log into.

A look at Cyberium — resume your last lab, track your modules, see live threat intel, level up.

cyberium.academy  /  student  /  dashboard
RESUME LAB
Cyber Warfare · Active Directory
Module 04 · Lab 07 of 09
100%
TRAINER
David Shiffman
★ MASTER · 199 PTS
UsernameSample Learner
S-codes00
UnitDEMO-0000
SPECTO · LIVE
Live Threat Intel
PROBES ACTIVE · REAL-TIME 24/7
MARKETPLACE
0coins
Labs completed
0/ 144
Scenarios passed
0/ 28
Training hours
0h
Operations hours
0h
15+
Countries
25+
Programs
7
Levels
10
Years Active

A complete training ecosystem,
not a course library.

Cyberium is the unified platform behind every ThinkCyber deployment. Hands-on labs, live scenarios, AI assessment, and City & Guilds Assured certifications — all in one environment, branded as yours.

Multiple choice→Hands-on
Real commands, real systems
Every lab requires typing actual commands and solving real incidents. No multiple-choice shortcuts, no simulated outputs. Students build muscle memory the way they'll use it on the job.
Sandbox→Live internet
Real network conditions
Real machines, not simulated terminals. Students work with real tools and real services, and investigate real attacks we caught ourselves.
Textbook→Real attacks
Captured, not written
Specto-enhanced scenarios are generated from break-ins our own internet-facing sensors caught. Each Case File traces back to the capture it came from — material that cannot be written, only captured.
cyberium.academy  /  specto / live threat intelligence
Cyberium — the Specto live threat intelligence globe, with a live attack feed and counters for attacks, links, hostiles and active countries
SPECTO LIVE THREAT INTELLIGENCE · The attacks our own sensors catch, and the Case Files built from them.

A file to open.
Not a question to answer.

Every challenge hands the student something real — a config, a capture, a log — which they download, open, and are graded on what they get out of it. Timed, scored, ranked against their own class. It is what a student does on the five days the trainer is not there.

capture the flag
A student's Capture the Flag page: rank inside the unit and the division, flags captured, hours practised, a no-hint streak, and the gap to the student behind them
CAPTURE THE FLAG · Rank inside the class and across the academy, flags captured, hours practised, and a no-hint streak still running.

Three products. One mission.

Each product solves a distinct problem. Together they connect threat detection, hands-on skills training, and workforce awareness.

Cyberium
Training platform
The complete hands-on training environment. programs from foundations through to advanced — defense ops, offensive security, forensics, network security, Python, ICS/SCADA. White-labeled for every partner.
Explore Cyberium
Specto+
Network intelligence
Standalone network security intelligence platform. Deployed inside your network, it finds what is happening there. Its SOC drills come through a live integration with Cyberium.
Explore Specto+
Awareness
XE100 / non-technical staff
Lightweight cybersecurity awareness training for non-technical employees. Co-branded certificates, per-seat pricing, six-month term. Built for HR, compliance, and enterprise awareness programs.
Explore Awareness

From first login
to verified credential.

A single, structured path takes every student from program selection to internationally recognized certification.

1
Choose
Select a program matched to role and level — beginner to advanced specialist, across seven domains.
2
Learn
Work through video lessons, reference books, and hands-on labs on live, internet-connected systems.
3
Prove
Execute live scenarios built from real-world incidents and Specto-captured attack data. Timed, scored, monitored.
4
Certify
Pass a proctored scenario exam. Earn a City & Guilds Assured credential, priced separately.

Inside our projects.

Two detailed walkthroughs by ThinkCyber’s founder, David Shiffman — showing how each program’s hands-on project is approached, step by step.

youtube.com / watch?v=tz0vM5vnDr4
ZX301 · PENETRATION TESTING · project walkthrough by David Shiffman
youtube.com / watch?v=S4iktFeEnoE
NX212 · WINDOWS FORENSICS · project walkthrough by David Shiffman

City & Guilds Assured.
Earned in a live exam.

Seven programs carry City & Guilds Assured certification. The exam is priced per student, separately from the programme.

Awarded jointly by ThinkCyber and City & Guilds, with your academy named on it
Proctored live scenario exam — not multiple choice
Every certificate carries its own ID
Investigations labelled with MITRE ATT&CK techniques
CITY & GUILDS ASSURED
Established 1878 · 140+ years of assessment
Exam priced separately

Trusted at the
highest levels.

Government and defense organizations use ThinkCyber to train and qualify their cyber units. Below: a look at one such national championship, run on the Cyberium platform.

youtube.com / watch?v=IA0mOUJ0vNE
A NATIONAL CYBER CHAMPIONSHIP · 2019 · English subtitles · recorded on a prior Cyberium platform release

Powered by partners,
everywhere.

Academies, training centers, universities, and enterprises deliver ThinkCyber under their own brand. We provide the platform — partners own the relationship.

1
Full white-label environment
Your logo, your domain, your branded student experience. Students see your brand.
2
Complete program catalog
programs from foundations through to advanced, plus the trainer tools to build proprietary content. Curriculum grows with you.
3
Dedicated operational support
Onboarding, trainer enablement, technical support, and certification administration. We handle infrastructure — you focus on students.
4
Aligned incentives
B2B only. We never sell directly to individuals, and we never compete with our partners. Your students stay your students.
15+
Countries deployed
25+
Programs
7
Levels
10
Years
Common questions

Frequently asked questions

Everything academy directors, CISOs, and government procurement teams ask before a first conversation.

How does the hands-on training actually work?

Students train inside the Cyberium — where they work with real tools and real network traffic. Every lab requires typing actual commands, analyzing real packets, and solving real incidents. There are no multiple-choice shortcuts. Students build muscle memory the same way they'll use it on the job.

What types of scenarios do students face?

Two types. Standard scenarios reproduce significant real-world cyber incidents — ransomware outbreaks, lateral movement chains, data exfiltration events — designed to validate skills taught in each program. Specto-enhanced scenarios are generated from live attack data our own internet-facing sensors caught, so students work break-ins that actually happened rather than textbook examples.

What programs and levels are available?

Over a full catalogue of programs across 7 levels, covering defense operations, offensive security, digital forensics, network security, Python automation, and ICS/SCADA. Programs range from absolute beginner (no prior IT knowledge required) to advanced specialist. Each program includes video lessons, reference books, hands-on labs, lab tests, and live scenarios.

Are programs certified?

Seven programs carry City & Guilds Assured certification — an internationally recognized credential backed by over 140 years of assessment expertise. Students who pass a separate, live proctored exam receive a certificate awarded jointly by ThinkCyber and City & Guilds, with its own ID. The exam is priced per student, separately from the programme.

How do employers verify a credential?

Every certificate carries its own ID and names the academy that taught it. It stays valid permanently, including after the academy's agreement with us ends. The exam is priced per student, separately from the programme.

Is the platform available 24/7?

Yes. The Cyberium runs on dedicated infrastructure and is accessible around the clock. Students can train on their own schedule. Technical support is available during business hours.

What equipment do students need?

A stable internet connection (minimum 10 Mbps) and a modern web browser. All training environments run in the cloud — no powerful hardware required. A computer with at least 8 GB of RAM is recommended for optimal performance.

What is ThinkCyber's partnership model?

ThinkCyber provides the technology platform, training content, certification pathways, and operational support. Partners — academies, training centers, universities, and enterprises — deliver the training under their own brand using our infrastructure. Partners get a fully white-labeled environment, dedicated support, and access to the complete program catalog. We grow together.

Can we white-label the platform with our brand?

Yes. Every partner division gets its own branding: logo, organization name, and branded student experience. Students see your brand, not ours. The platform is designed from the ground up for multi-tenant white-label deployment.

How is ThinkCyber different from other cyber ranges?

Three things set us apart. First, our labs run on live internet connections — not isolated sandboxes. Students work in real network conditions. Second, our Specto technology captures real attack techniques on our own internet-facing sensors, and the Case Files students work are built from what it catches. Third, everything is integrated into one platform: labs, scenarios, AI assessment, certifications, gamification, student analytics, and instructor tools. No stitching together separate vendors.

What is Specto+ and how does it connect to training?

Specto+ is a standalone network security intelligence platform that organizations deploy inside their own network to detect threats. Specto+ finds what is happening in your network, and its SOC drills come through a live integration with Cyberium. Our training cases come from attacks we caught ourselves on our own decoy servers. Two products, one company: detection and training from the same team.

What is the Awareness product?

ThinkCyber Awareness is a lightweight cybersecurity awareness training solution designed for organizations that need to train large numbers of non-technical employees. It runs independently of the full Cyberium platform, includes co-branded certificates, and is priced per seat, for a six-month term. It's built for HR departments, compliance teams, and enterprise security awareness programs.

How do we get started?

Contact us to schedule a platform demonstration tailored to your organization type. We'll walk you through the relevant capabilities — whether you're an academy exploring white-label deployment, an enterprise building SOC team skills, or a government organization standing up a national training program. A class can be on the platform within 24 hours of a yes.

Ready to get started?
Talk to us.

A tailored conversation — whether you're an academy, enterprise, government, or future partner. A class can be on the platform within 24 hours of a yes.

Contact Sales Browse Solutions