The v1 curriculum spent this day on deepfake audio/video detection. The 2026 evidence says the daily problem lives elsewhere: 82% of detections are malware-free (CrowdStrike GTR 2026), credential abuse appears in 39% of breaches (DBIR 2026), and voice phishing is now the #2 initial infection vector at 11% of intrusions — the top entry into cloud environments (M-Trends 2026). The adversary's AI shows up here as fluent pretexts and cloned voices aimed at help desks, not as cinema-grade video. So Day 2 now trains the identity-first kill chain end to end, and synthetic media takes its correctly-sized place: one module, anchored to the help-desk workflow where it actually bites.
By end of Day 2, students leave with:
| # | Module | Focus |
|---|---|---|
| 2.1 | The identity-first kill chain | Infostealer → initial-access broker → operator hand-off (22 seconds, M-Trends 2026); malware-free tradecraft; where detection opportunities survive |
| 2.2 | Vishing & help-desk impersonation | The M-Trends #2 vector; Scattered-Spider-style MFA-reset fraud; cloned voices (Pindrop: 1 attempt/month → 7/day); Arup as the ceiling case; verification workflows that don't depend on human ears |
| 2.3 | MFA bypass, session hijack & token theft | AiTM phishing kits, OAuth token harvesting, long-lived session abuse; detection engineering on identity-provider telemetry |
| 2.4 | Valid-account abuse in cloud | 35% of cloud incidents (CrowdStrike); cloud-conscious intrusions +37%; separating legitimate admin behaviour from adversary use of the same credentials |
| 2.5 | Precursor hunting: the 95-day window | Hunting credential-exposure and infostealer signals before ransomware lands; LLM-assisted correlation of exposure feeds with identity telemetry |
| 2.6 | IR playbook: identity compromise | Out-of-band verification, token revocation sequencing, session inventory, comms; drafting the incident report with the Day 1 copilot — with evidence-integrity rules |
Students receive replayed identity-provider telemetry (Entra ID / Okta-style logs) covering a compressed attack: an infostealer exposure 60 days earlier, a vishing call transcript against the help desk, an MFA reset, AiTM session capture, and valid-account cloud activity. Tasks: build and tune the session-hijack and token-theft detections (Sigma), hunt the precursor signals backwards, run the identity-compromise IR playbook forward — including a live out-of-band verification drill where one call in three uses a cloned voice. Scoring: time-to-verdict per stage, false-positive rate of the shipped detections, and completeness of the revocation sequence.
The cloned-voice element is deliberately un-detectable by ear — the lab's lesson is that the control is the verification workflow, not human perception.