Coverage against role targets
For each role, the share of required capabilities the team masters, and which ones are missing.
SOC analyst L2
82%
Incident responder
64%
Pentester
58%
Cloud security eng.
37%
For security teams · Early accessQ4 cohort
Know what your security team can actually do.
Cyber Bench turns hands-on labs into skill KPIs: per person, per team, per capability. Measured on real work, not certificates or self-assessments.
No production access needed. People see their own results first.
app.cyberbench.app/teams/blue
Blue team · Q3 readiness
LiveRole coverage
71%
+6 pts this quarter
Capabilities mastered
128
+14 this quarter
Single points of failure
3
3 critical
Fading skills
9
no practice for 120 days
Mastery by person and capability6 people · 8 capabilities
Inès M.
Sarah K.
Hugo L.
Yanis B.
Camille R.
Léo D.
Web exploitAD attackAD forensicsCloud IAMK8s RBACPhishingMalwareReportingNot yetMasteredsingle point of failure
Hover or tap a cell.
Team coverage, last 12 weeks71%
The problem
You can't manage what you can't see.
Most teams know their headcount and their certificates. Almost none know who can actually investigate their Active Directory tonight.
01 · certificates
Certificates age badly
A certification says what someone passed years ago, on a syllabus that wasn't yours. It doesn't say what they can do on your stack today.
02 · self-assessment
Self-assessments flatter
Skills matrices filled in by the team are optimistic where it matters least and silent on the gaps that hurt.
03 · incidents
Gaps show up in incidents
The day you find out only one person can investigate your Active Directory is the day they're on holiday.
How it works
From the work people do to the numbers you report.
Three steps, no surveys. Every number traces back to a lab someone solved.
Map roles to capabilities
Pick the roles you staff (SOC analyst, pentester, cloud engineer) and the capabilities each needs, from a shared skills graph: actions on the technologies you actually run.
Your team practises on real labs
Realistic red and blue team labs run on each person's machine. Every lab exercises precise capabilities and is proven with per-person evidence that can't be copied.
Get live KPIs
Mastery is tracked per person and capability, decays without practice, and rolls up into team coverage, gaps and trends you can show your board.
KPIs
The numbers a CISO actually needs.
Six views, all computed from evidence. Each gap links to the lesson or lab that closes it.
Single points of failure
Critical capabilities only one person masters. The bus factor of your security team, made visible.
- AD forensicsInès M.
- Kubernetes RBACHugo L.
- Phishing triage4 people
Skill decay alerts
Mastery fades without practice. Know which capabilities need a refresh before you need them.
Time to mastery
How long people take to master a capability, so training plans rest on data, not hopes.
- Phishing triage9 days
- AD attack paths34 days
- Cloud IAM51 days
Training that targets gaps
Each gap links to the right Cyber Courses lesson or lab. Spend your training budget where it moves the numbers.
Kerberos attacks
for Yanis B. · closes 2 gaps
for Yanis B. · closes 2 gaps
Hiring benchmark
Candidates take the same labs as your team. Compare on the same scale, at the capability level.
Team median
61
Candidate A
72
Candidate B
44
Method
Measured, not declared.
Every number comes from evidence: a lab is passed by bringing back an artefact that only exploiting or investigating the system reveals, unique to each person.
- Capabilities, not buzzwords
- A capability is a precise action on a precise technology, e.g. exploiting blind SQL injection on PostgreSQL. That is the unit we measure.
- Bayesian knowledge tracing
- Each person has a mastery probability per capability, updated with every attempt. One lucky success doesn't make an expert.
- Mastery fades
- Without practice, the estimate decays. Your dashboard shows today's level, not last year's.
- Related skills inform each other
- Mastering a capability on one technology raises the estimate on its neighbours, so the map fills in faster than people take labs.
Try it · one capability
Blind SQL injection · PostgreSQL
30% mastery
Start at 30%: we assume a little prior knowledge. Each attempt updates the estimate.
Trust
Built for teams, not surveillance.
Measurement only works if people trust it. These are defaults, not settings you have to find.
- People see their own results first.
- You decide which views managers get: team-level by default.
- Labs run on your people's machines; no production access needed.
See your team's real level.
Cyber Bench is in early access with a small number of security teams. Tell us about yours.