Module 5.6 — Variant Scenarios and Lab Platform

Day 5 capstone · Section 6 of 6

Why variants

The course runs multiple times per year at SANS events. The Verdancy Health / PROMETHEUS-7 scenario stays fresh for the first ~6 deliveries; after that, repeat students and instructor familiarity create a stale-content risk. Three pre-built variants swap the org and the Stage-3 attack surface while preserving the four-stage kill-chain shape and the Mirror Twist.

Instructor effort to swap a variant: approximately 1 day of content reseeding (regenerating the synthetic alert pack, NoraBot equivalents, CloudTrail equivalents). The facilitation script is materially the same across all three variants.

Variant A — “Hollow Mirror: Fintech”

Target organization: Halgrove Capital Partners, a regional bank with ~5,500 employees and $40B in assets under management.

Stage-3 surface change: Instead of a customer-facing chatbot (NoraBot), the prompt-injection target is an internal copilot (“HalgroveGPT”) used by the wealth-advisor team for client research and portfolio analysis. The adversary plants poisoned content in a public investor-relations document that gets ingested into the copilot’s RAG corpus.

Adversary handle: STYX-4

Stage-4 impact: Exfiltration of high-net-worth client portfolio data (~2,800 client records, including SSNs, wire instructions, and trust beneficiary information). Estimated regulatory exposure: ~$220M in CFPB and state fines.

Distinctive elements:

Realism: Halgrove Capital Partners is fictional. The scenario draws on documented patterns from regulatory disclosures of financial-services AI deployments (most fintechs have NDAs that prevent public AI-incident detail).

Variant B — “Hollow Mirror: OT / Manufacturing”

Target organization: Brackenwell Industrial Systems, a specialty chemicals manufacturer with operations across 7 facilities.

Stage-3 surface change: The prompt-injection target is a maintenance-scheduling agent (“BrackenwellOps”) that controls work-order dispatch to OT (operational technology) systems. The adversary plants a poisoned maintenance instruction that, when retrieved, modifies the work-order in a way that has physical-system implications.

Adversary handle: CINDERHOOK

Stage-4 impact: Instead of data exfiltration, this variant has physical-system sabotage — Stage 4 reveals that the work-order modification caused a misconfiguration of a specialty-chemical reactor, leading to off-spec product over a 6-hour production window. Estimated impact: $48M in product write-offs and a near-miss safety event.

Distinctive elements:

Realism: OT scenarios are particularly hard to find authentic published material for. Instructors delivering this variant should be paired with an OT-domain SME for credibility.

Variant C — “Hollow Mirror: Public Sector / DMV”

Target organization: State of Lincoln Department of Motor Vehicles, 4,800 employees serving 11.2 million citizens.

Stage-3 surface change: The prompt-injection target is a citizen-facing chatbot (“LincolnAssist”) that helps with license renewals, registration questions, and appointment scheduling. The adversary plants poisoned content in a publicly-indexed FAQ document.

Adversary handle: PALEHORSE-9

Stage-4 impact: Instead of data exfiltration alone, this variant adds journalist-leak parallel comms exposure — during Stage 4, the adversary leaks fabricated documents to a regional journalist suggesting (incorrectly) that the DMV has been spying on citizens with the AI system. The SOC’s IR response must coordinate with public-affairs and legal in real-time, not just technical remediation. Estimated impact: ~$30M in incident-response costs and a 3-year regulatory consent decree.

Distinctive elements:

Realism: Public-sector AI deployments are increasingly common; this variant is grounded in documented patterns from state-government chatbot deployments and the political risks they encounter.

Cross-variant common elements

All three variants share:

Lab platform setup

Per-student environment

Each student receives a browser-accessible isolated EC2 instance:

Shared lab services

Beyond per-student instances:

Infrastructure cost guidance

For SANS delivery economics:

The g5.xlarge requirement is the largest cost driver. For environments where GPU isn’t required (e.g., a variant that excludes the audio-detection phase), the m6i.2xlarge reduces per-student cost to ~$5/student.

Variant data regeneration

When swapping to a variant (Fintech, OT, Public Sector), the instructor regenerates the four synthetic data files:

python3 generate_capstone_data.py --variant fintech --output /lab/variants/fintech/
python3 generate_capstone_data.py --variant ot --output /lab/variants/ot/
python3 generate_capstone_data.py --variant public_sector --output /lab/variants/public_sector/

The generate_capstone_data.py script is a meta-tool that re-runs the Codex prompts (Phase 1 alerts, NoraBot/equivalent trace, CloudTrail/equivalent logs, deepfake audio) with the variant-specific scenario substitutions. Effort to produce: ~1 day of content reseeding plus instructor review.

Why this capstone design

The design decisions for the capstone derive from the course’s overall thesis:

A student who passes the capstone has demonstrated competence across:

That competence is the deliverable the course produces. The 700-pt pass bar exists to enforce it.

Closing the course

Day 5 closes the SEC5xx course. Students leave with:

The architectural insight running through all five days: the threat surface moved up the stack. Day 1’s adversary was at the gateway. Day 5’s adversary studied the defender’s stack. The detection engineer’s response moves with it — every layer needs operational controls, and no layer can be trusted in isolation.

Welcome to detection engineering in 2026.