AI models do not operate in isolation. An agent consists of the model paired with host-side code that validates tool proposals, communicates with external systems, and controls when the execution loop terminates. Relying strictly on system prompts for security leaves systemic vulnerabilities that attackers can exploit.

In this new Medium-difficulty module available on HTB Academy and HTB Enterprise, you will construct that host-side orchestration code yourself. You will learn how to enforce safety decisions there, not in the prompt.

We integrated 191 modules from LetsDefend into the HTB Academy library to expand our defensive and foundational cybersecurity curriculum. This launch increases HTB Academy's defensive content by more than 500%, making comprehensive blue team skills accessible under Tier 0 and Tier 1 access.

Key Updates:

We have launched two new preparation tracks on HTB Labs to help you prepare for the HTB Certified Junior Cybersecurity Associate (HTB CJCA) and Certified Active Directory Pentesting Expert (HTB CAPE) examinations of HTB Academy. These tracks are designed to reinforce the practical skills taught in their respective job-role paths through targeted, hands-on environments.

This track helps you practice the core hands-on skills required for the HTB CJCA exam. You will face focused Machines that cover enumeration, exploitation, privilege escalation, and basic security analysis.

Built for advanced learners preparing for the HTB CAPE exam, this track features complex Active Directory labs. You will test your skills in advanced enumeration, lateral movement, privilege escalation, and full domain compromise.

The model layer is where modern AI systems are built, tuned, evaluated, and attacked. This module takes you inside it on a real model you run yourself, to see not just how it works but where it breaks.

We have introduced a range of AI-powered tools built to help you navigate complex cybersecurity content on HTB Academy.

Get contextual technical explanations, summaries, and quizzes based on the specific section you are currently reading.

Dynamically translate module content into Hindi, Arabic, Spanish, French, Chinese, Greek, and Japanese while preserving the correct code blocks and commands.

This is our first step into AI-augmented learning, designed to reduce learning burnout and help you level up faster.

These features will soon also be live for HTB Enterprise teams.

We have launched a new medium-difficulty defensive module, Introduction to Detection Engineering, on Hack The Box (HTB) Academy. This module introduces the foundational and advanced concepts required to think and operate like a modern detection engineer.

The sections explain how attackers operate within Windows environments and how operating system telemetry exposes those specific behaviors. Through hands-on tasks, you will simulate real-world attack techniques and design functional detection queries to convert raw telemetry into actionable alerts.

We have released a new medium-difficulty module on HTB Academy, designed to introduce you to the operational and strategic realities of adversary simulation. The Red Team Mindset module covers the foundational concepts of red teaming, explaining how these engagements differ from traditional penetration testing and how they are executed from kickoff to completion.

You will explore the specific roles and responsibilities of red, blue, and white teams during an engagement. The course also addresses critical ethical boundaries, communication protocols with stakeholders, and how artificial intelligence is shifting the landscape of modern adversary simulation.

We have introduced XP and Activity Streaks directly to the HTB Profile. This update allows you to highlight your continuous learning and hands-on skills to the community and potential employers.

Hack The Box (HTB) Academy and Enterprise users undertaking certificate exams can now select Australian VPN servers for their connection. This infrastructure update reduces latency and provides a significantly smoother exam-taking experience for users based in the APAC region, across both individual and enterprise plans.

This new module delivers an in-depth, defense-focused study of Windows credential access. It explains how adversaries steal credentials via dumping and abuse of sensitive stores, then breaks down authentication flows, cryptographic protections, and both live-memory and offline extraction to understand tool behavior and build robust detection rules. It also covers DPAPI, Windows Credential Manager, browser credential stores, including App-Bound encryption, and Credential Guard bypass techniques with their detection opportunities.