Threat Range events are now more flexible.

Admins and Event managers can now customize alert dispatch pacing and response-time SLAs, making it easier to tailor exercises to different team skill levels, operational workflows, and event durations.

What's new?

Use HTB's recommended defaults or align timings with your organization's internal SLAs and operating procedures.

AI models do not operate in isolation. An agent consists of the model paired with host-side code that validates tool proposals, communicates with external systems, and controls when the execution loop terminates. Relying strictly on system prompts for security leaves systemic vulnerabilities that attackers can exploit.

In this new Medium-difficulty module available on HTB Academy and HTB Enterprise, you will construct that host-side orchestration code yourself. You will learn how to enforce safety decisions there, not in the prompt.

Administrators can now control the sequence of content assigned to a Space, making it easier to build structured workforce development programs that guide learners through deliberate, role-aligned skills journeys.

From the Space’s Content tab, open Assigned Content. Enter mode to drag and drop content cards or update their numeric position fields, then make sure to Save your order selection.

Create deliberate learning paths across modules, challenges, labs, and Sherlocks.

We integrated 191 modules from LetsDefend into the HTB Academy library to expand our defensive and foundational cybersecurity curriculum. This launch increases HTB Academy's defensive content by more than 500%, making comprehensive blue team skills accessible under Tier 0 and Tier 1 access.

Key Updates:

A compromised mission operations environment has exposed weaknesses across cloud infrastructure, application security, and containerized workloads.

Deploy into Zeek, a new Linux Machine where you'll enumerate AWS resources, investigate LocalStack services, exploit a vulnerable Lambda function, and pivot from cloud access to full host compromise through Docker.

Continue Act I: Gridfall Signals and uncover the next piece of Arodor's campaign.

Following the acquisition of LetsDefend, we have massively expanded your defensive security training.

You can now develop and validate defensive capabilities through a broader combination of structured learning paths, hands-on investigations, and realistic SOC simulations across every stage of the cyber workforce journey.

CertForge is a compromised small company following a public WingFTP foothold.

The incident response team faces a critical security challenge after alerts reveal signs of a coordinated intrusion across public-facing Linux services and the internal Windows domain. They must quickly determine which events represent genuine attacker activity and which are expected administrator or deployment actions.

Your team must defend CertForge by:

Defensive players can now level up and maintain active streaks through HTB Labs. We have integrated our Sherlocks defensive investigations into the HTB XP and streaks ecosystem.

What changed:

This update rewards incremental learning and provides defensive players with more ways to maintain their platform progression. For a full breakdown of how points and streaks accumulate, read our HTB XP system documentation.

The mission continues with a Sherlock.

Following the events of Safety Off (Challenge), Team Phoenix has intercepted new intelligence linked to FrostyGoop, a real-world ICS malware used to manipulate industrial systems through Modbus commands.

This update gives organizations a practical way to support players before and after a Threat Range experience by combining hands-on scenarios with structured learning content.

Admins can use the new Content pane to view the Academy modules related to each Threat Range scenario, and assign this content to their teams' Spaces within HTB Enterprise Platform