Live range methodology Australian cyber security training
Hacktivity1 trains you inside an enterprise-style cyber range you build and understand. From the bare-metal hypervisor to identity, endpoints and the SIEM, every lesson ends in work you can repeat.
The capability gap
Cyber security theory matters. It gives language to the work and explains why controls exist. But theory without repeated practice leaves a dangerous gap between recognising the right answer and producing it under pressure.
Hacktivity1 closes that gap by moving from explanation to configuration, observation, attack simulation, investigation and evidence-led response.
Two very different outcomes
We keep the theory you need, then make the environment answer back. If a control fails, you troubleshoot it. If an alert fires, you follow the evidence. If the evidence is weak, you improve the visibility.
Our practical path
Four role-aligned pathways
Cyber security is not one job. Each pathway develops a different kind of judgement while using the same connected environment to show how technical and business decisions affect one another.
Learn how defenders collect telemetry, investigate alerts, validate incidents and improve controls across endpoints, identity, network and cloud-connected services.
Work through authorised reconnaissance, vulnerability discovery, exploitation and lateral movement inside a contained range, then trace the evidence each action leaves behind.
Develop the operational and leadership judgement needed to manage security teams, programmes, incidents, stakeholders and risk-informed decisions.
Learn how governance, risk and compliance work becomes stronger when policies, access reviews, audit logs, incidents and technical evidence are understood together.
The connected cyber range
A firewall on its own is a configuration exercise. Connect it to segmented networks, Active Directory, identity provisioning, endpoints, applications and centralised logging, and it becomes part of an enterprise story.
That story is where meaningful learning begins. You see which system produced the event, how the control changed the outcome, what the analyst can prove and what the business needs to know.
Inspect the complete range
Identity becomes evidence
The new architecture view makes the identity and telemetry chain explicit. HR data initiates provisioning. IAM and RBAC shape access. Active Directory connects users to endpoints and services. Defender, privileged access and packet activity then produce evidence for Splunk to correlate.
The practical range fieldbook
These are the actual architecture views behind the practical training model. They are presented directly on the page, uncropped and without hiding detail behind a lightbox.
Build the enterprise
Start with controlled access, a real firewall and a type-1 hypervisor. Add segmented networks, Windows domain services, endpoints and the applications that give the environment believable activity.
Make it observable
Connect the people systems to access controls, privileged administration, endpoint telemetry, vulnerability discovery, packet analysis, audit logs and a central security operations view.
Put it under pressure
Run authorised adversary activity, examine what the tools can see, validate the alert and continue through containment, eradication, recovery and lessons learned.
The engineering appendix
The reference plates expose the denser relationships behind provisioning, authentication, role-based access, SSH keys, applications, virtual machines and centralised audit data.
Before the first virtual machine
Where the learning path calls for it, we begin with compatible hardware, memory, storage and networking. From there, VMware ESXi is installed directly on the host and the virtual environment is built with an understanding of the physical constraints underneath it.
What you assemble
You learn how the environment fits together because you participate in building it. Each layer becomes the foundation for the next, and every later alert can be traced back through that architecture.
Prepare suitable hardware, expand memory where required and install VMware ESXi as a type-1 hypervisor.
Configure pfSense or OPNsense, VLANs, routing, DNS, DHCP, VPN access and traffic controls.
Build Windows Server Active Directory, join endpoints and connect HR-driven provisioning, IAM, RBAC, SSO and MFA.
Forward Windows, Defender, firewall, Linux and application events into Splunk, Wazuh or Security Onion for analysis.
Use Kali Linux, Nmap and Wireshark in controlled scenarios, investigate the resulting evidence and complete the response cycle.
Guided, not spoon-fed
One-to-one and small group sessions give you room to ask why, test an assumption and troubleshoot properly. The instructor can see how you approach the problem, not only whether you reached the expected screen.
Your next move
Tell us the role you are moving toward, the experience you already have and the practical areas where you need confidence. We will help you identify a sensible path.
Discuss your training path