Investigation Simulation Assessments
Not a quiz. A single realistic incident unfolds based on your decisions. Triage the alert, investigate the attack chain, contain the compromise, and write your findings — under time pressure.
How It Works
Triage
An alert fires. Classify the severity, identify the ATT&CK technique, select your first investigation step, and decide: investigate, escalate, or close.
Investigation
The incident branches based on your decisions. Evidence accumulates on your evidence board. Wrong choices cost points but don't dead-end — you continue with reduced score.
Response & Reporting
Select containment actions in the correct order. Write a CISO incident summary. Identify recommendations. Classify the severity for the formal report.
Available Assessments
Each attempt randomly selects a scenario. Retake with a different incident each time. Pass at 70/100. Distinction at 90/100.
40 minutes · 100 points · Certificate on pass
40 minutes · 100 points · Certificate on pass
40 minutes · 100 points · Certificate on pass
Not Another Multiple-Choice Quiz
Every other platform tests recall. Ridgeline tests judgment.
"What Event ID indicates a successful logon?" — tests whether you memorised a number. Disconnected questions. No investigation flow. No evidence. No decisions under pressure.
A single incident unfolds from alert to report. Your decisions reveal evidence. The evidence board builds as you investigate. You write the CISO summary. The score reflects investigation quality, not memorisation.