Skip to main content

Dynamic labs and live-scenario challenges. Build the instinct that matters—by doing.

Dynamic challenges · Instant labs · For teams and enterprises

STATUSOPERATIONAL
ACTIVE LABS
FLAGS CAPTURED
UPTIME0.00%
CONTEXT

Static labs don't keep up with real threats

Your training should match how fast the landscape moves.

STATIC PLATFORM — STALE FEED
CVE-2019-07082019-05-14

BlueKeep — patched 7 years ago

CVE-2020-14722020-08-11

Zerologon — retired from exams

CVE-2021-442282021-12-09

Log4Shell — every lab uses this

CVE-2021-345272021-07-01

PrintNightmare — memorised

CVE-2017-01442017-03-14

EternalBlue — a decade old

$ status --training-relevanceWARNING: 100% of scenarios last updated > 12 months ago
DUCKYARD — LIVE INTEL
CVE-2026-1337*
CRITICALJust now

Novel auth bypass — AI scenario generated

CVE-2026-1284*
HIGH2m ago

Kernel race condition — live topology

CVE-2026-0847*
CRITICAL14m ago

RCE chain — randomized every session

CVE-2026-0621*
HIGH1h ago

Container escape — ephemeral sandbox

CVE-2026-0399*
MEDIUM3h ago

SSRF pivoting — unique network map

*ready for input
FEATURES
GENAI_ENGINE

Dynamic challenges

Unique scenarios every time. No memorisation—build real instinct.

Unique scenarios
PROVISIONING

Instant provisioning

Labs in under a second. No wait, no config hassle.

<1s
Deploy time
RESEARCH

Research pipeline

Current threat intel. Always up to date.

24/7
Active feed
ISOLATION

Sandbox isolation

Isolated environments. No cross-contamination.

100%
Isolated
WHY_DUCKURITY

Built for teams

Unique scenarios, scalable labs, and API access. For individuals learning the craft and for SecOps teams levelling up together.

UPTIME

Platform uptime

Infrastructure reliability.

99.97%
SLA
THERMAL_VIS
HOW IT WORKS

From zero to operating in four steps

Deploy, attack, learn, repeat.

4 PHASES
01

Deploy your sandbox

Labs in under a second. No VPN, no config files.

Isolated environments spin up on demand and are destroyed on exit. Zero footprint.

02

Face dynamic scenarios

Every challenge is unique. No memorisation.

Scenarios change each session—real-world attack patterns, randomised so you build instinct, not walkthroughs.

03

Use live threat intel

Current CVEs and exploits. Real-time.

Training reflects today's threat landscape, not last year's.

04

Build on the API

Programmatic access. Labs, challenges, data.

Automate workflows or integrate with your toolchain. Custom training programs supported.

ARCHITECTURE

Isolation by design

Every lab runs in an isolated environment with its own network. No cross-contamination, no persistence. Destroyed on exit.

ISOLATION:Per-session
NETWORKING:Private
LIFECYCLE:Ephemeral — auto-destroy
OPERATORYour session
SECURE ACCESSEncrypted tunnel
ORCHESTRATORLab control
ISOLATED LABEphemeral instance
PRIVATE NETSandboxed
AUTO-CLEANUPZero footprint
UNDER THE HOOD

See the payloads.

Every challenge is a real configuration. Every lab is a real machine. Scroll to decrypt the artifacts that power the platform.

CHALLENGE CONFIG
ENCRYPTED
 
 
 
 
 
 
 
 
 
yaml · 9 lines · sha256:00000000...
DEPLOY FLOW
ENCRYPTED
 
 
 
 
 
 
 
bash · 7 lines · sha256:00000000...
THREAT FEED
ENCRYPTED
 
 
 
 
 
 
 
 
 
 
 
json · 11 lines · sha256:00000000...
LIVE DEMO

A live, read-only preview of the platform. Run commands like status, deploy, and scan to see how fast and predictable lab provisioning is—no signup required.

Try it

Type a command below or click one to run it. This demo shows real platform responses.

OPERATOR TERMINAL
SESSION: DEMO
DUCKYARD OPERATOR TERMINAL v2.1.0
Type 'help' to list available commands.
$
INTERFACE PREVIEW

Your command center: labs, challenges, and progress in one place.

Duckyard dashboard: service record, operator streak, activity chart, and threat capability signature

Your command center: progress, streaks, and threat capability at a glance.

DUCKYARD
MALLARD
ACTIVE LABS0
PRIV-ESC-V2
RUNNING02:14:33
CUSTOM-AI-C2-RECON
RUNNING00:45:12
CVE-SIM-REPRO
PAUSED01:22:00
CHALLENGE QUEUE12
Privilege Escalation
Network Forensics
Kernel Exploitation

+4 more

RESEARCH FEEDLIVE
CVE-2026-1337*
CRITICALJust now
CVE-2026-1284
HIGH2m ago
CVE-2026-1199
MEDIUM14m ago
*ready for input
TRUST VERIFICATION

Don't trust our marketing.
Verify our infrastructure.

Security claims without evidence are just words. Here are the receipts — operator testimonials, audit posture, and live infrastructure metrics.

OPERATOR FIELD REPORTS

SPECTER
VERIFIED
We retired our previous lab vendor within two weeks. The AI-generated scenarios surfaced gaps our internal red team missed for months.
Red Team LeadFortune 100 Financial
PGP: 7A2B:9C3E:1D4F:8A6B2026-01-18
WRAITH
VERIFIED
Sub-second provisioning changed how I train. I go through 12-15 unique scenarios per session now. Nothing else comes close.
Security ResearcherIndependent
PGP: 4E0C:2D9F:7B1A:3E8C2026-02-03
CONDUIT
VERIFIED
The ephemeral architecture gave our compliance team confidence we couldn't get from shared lab environments. Zero persistence, verifiable destruction.
CISOSeries B SaaS
PGP: 6F4D:0A5B:8C2E:1F7A2026-01-29

SECURITY POSTURE

ENCRYPTION AT RESTSTANDARDAll data volumes
ENCRYPTION IN TRANSITTLSStrict transport
VM ISOLATIONPER-SESSIONEphemeral labs
KEY MANAGEMENTHARDENEDSecure storage
PENETRATION TESTINGQUARTERLYExternal auditor
DATA RESIDENCYCONFIGURABLEMultiple regions

LIVE INFRASTRUCTURE READOUT

SYS.METRICSPOLLING: 5s
MEAN TIME TO DEPLOY0.8s
ENVIRONMENTS DESTROYED (24H)14,291
UNIQUE SCENARIOS GENERATED
CROSS-CONTAMINATION INCIDENTS0ever
SECURITY CLEARANCE

AI-native labs. Resume-ready certs. Verifiable skill — prove it with paths, certificates, and the public leaderboard.

MONTHLY / ANNUAL
HATCHLING
$0/mo
Recon phase. Get your bearings.
  • *5 lab deploys per month
  • *1 concurrent lab
  • *2-hour sessions
  • *VPN-only connection (no browser terminal)
  • *Community challenges
  • *Public leaderboard
MALLARD
2 MONTHS FREE
MOST DEPLOYED
$29$28/mo

billed annually at $336

Standard operating procedure.
  • *Unlimited lab deploys
  • *3 concurrent labs
  • *4-hour sessions
  • *1 Persistent Standard Bunker
  • *VPN + Browser terminal
  • *MCP (AI) access — 20 RPM Pro
  • *API access
  • *Priority queue
  • *AI-generated challenges
  • *Advanced analytics
APEX
2 MONTHS FREE
$99$89/mo

billed annually at $1068

Full operational authority.
  • *Everything in Mallard
  • *5 concurrent labs
  • *8-hour sessions
  • *1 Persistent Heavy Bunker (4 vCPU, 4GB)
  • *MCP (AI) access — 60 RPM Elite
  • *Custom network topologies
  • *Team management (1 seat)
  • *Dedicated infrastructure pool
  • *Priority support SLA
CADET.edu REQUIREDSTUDENTS

Academic clearance. Built for students. Unlimited deploys, 2 concurrent labs, 3hr sessions, AI challenges.

$9$8/mo

$96/yr

Verify & deploy
*

60-DAY MONEY-BACK GUARANTEE

No free trials. Full access from day one. If Duckyard doesn't make you dangerous, get every cent back.

FAQ

Technical questions

Infrastructure, security, and operational details for technical operators.

Ready to train your team?

Start free or book a demo. We'll get you up and running quickly.

FREE TIER · 60-DAY MONEY-BACK · INSTANT UPGRADES