Lab environments
A company, its evidence, and everything wrong with it
Most GRC training explains a control and then asks whether you were listening. A lab gives you a fictional organisation's actual documents and asks the question the job asks: what is wrong here, how bad is it, and how would you write it up?
The flaws are real ones — an offboarding checklist that never removes clinical system access, a backup log presented as proof of recoverability, a supplier network trusted for both authentication and firewall rules. Each is discoverable from the evidence alone, and most need you to read two documents against each other.
How a lab works
You get the organisation's own evidence
Policies, risk and asset registers, supplier contracts, helpdesk tickets, identity and cloud configuration exports, an org chart, a network diagram. Real formats — CSV, JSON, Markdown — rendered so you can put two documents side by side, because most of the findings only exist in the gap between two.
Nothing is annotated and nothing hints
There are no callouts, no highlighted rows and no 'notice anything?' prompts. The evidence says what it says. A date that is seven months too late, a policy that contradicts another, an account that signed in after its owner left — you find them by reading, the way you would on an engagement.
You answer as an assessor, not a quiz-taker
Structured questions — which accounts, which control, what rating — are marked against a key. Written prompts ask you to draft the finding, argue how you would structure a report, or reply to a manager pushing back. Those are assessed against a rubric written for that question.
You get told what you missed, not what the answer was
Feedback names the evidence you did not use and the point you did not reach. It never hands you the answer, because re-reading the evidence is the exercise. Re-attempts are unlimited and your best score is the one that counts.
The organisations
Each environment is one company, built as a whole. Its policies refer to its systems, its systems appear in its registers, and its staff appear in its identity exports — which is what makes a finding traceable across several documents instead of sitting in one.
Open the labs
A paid membership opens every environment, its evidence and its marking.
Every organisation in the labs is fictional. The companies, staff, systems and documents were written for the exercise — any resemblance to a real organisation is coincidental.