Training cyber defenders in government, law enforcement, military, and private sectors | Please don't DM for support | Gamified training @BlueLabsOnline
United Kingdom
Joined March 2020
- Tweets1.5K
- Following38
- Followers15.5K
- Likes2K
Pinned Tweet
Today’s the day. Security Blue Team is now Centri.
An important milestone in the journey we’ve been on together over the past few years.
From the early days of Josh, our CEO, building practical blue team training, the business has evolved significantly. Today, we support a global community of learners, practitioners, and organisations across a much broader range of cybersecurity capability, and this marks the next chapter in the journey.
You’ll now start to see Centri across our platform, website, communications, and community spaces as we complete the transition over the next few days. From today, you’ll access the platform via elearning.centri.org, and existing Security Blue Team domains will automatically redirect.
Our name might be changing but other things remain the same
✅ Your account stays the same
✅ Your progress stays the same
✅ Your certifications remain fully valid
✅ Your platform experience continues as normal
✅ Access to our online communities on LinkedIn and Discord
You may see both names for a short period while we complete the move.
Most importantly, thank you.
To everyone who has supported us, trained with us, taught with us, partnered with us, and been part of this amazing community along the way, thank you for helping shape the last few year and what Centri becomes next.
Welcome to Centri.
Detecting a threat is only the beginning.
For security operations teams, the real challenge often starts after an alert is triggered.
What happened before the detection? How did the attacker gain access? Which systems were affected? And has the threat actually been contained?
Answering these questions requires more than alert triage. It takes the ability to correlate evidence, reconstruct attack timelines and understand attacker behaviour across an environment.
As SOC teams mature, developing these advanced investigation skills becomes essential to improving incident response and making more informed security decisions.
That's where practical, advanced training such as Blue Team Level 2 (BTL2) can help defenders develop the deeper investigative capability needed to tackle complex incidents.
How is your organisation developing analysts beyond initial alert triage?
👉 Explore how BTL2 can help strengthen your team's advanced investigation and incident response capabilities: centri.org/certifications/bl…
18th out of 42 teams at the European Cyber Security Challenge 2026!
A huge congratulations to UK Cyber Team on representing the UK at this year's competition in Germany.
Taking on some of Europe's brightest emerging cybersecurity talent is no small achievement. The competition brings together young cyber professionals to put their technical skills, problem-solving abilities and teamwork to the test.
As a proud sponsor of UK Cyber Team, it's fantastic to see the team competing on an international stage and demonstrating the talent coming through the UK's cybersecurity community.
Competitions like ECSC highlight just how important it is to create opportunities for the next generation to develop and demonstrate practical cybersecurity skills.
Congratulations to everyone involved. We're proud to support you!
Cybersecurity Awareness Month isn't just about understanding cyber threats. It's also about developing the people who defend against them.
Whether you're exploring your first cybersecurity role, considering a career change or looking to progress within the industry, knowing which skills to develop and where to focus can make all the difference.
Our Cybersecurity Careers Playbook is designed to help you navigate the opportunities available, understand different cybersecurity roles and explore practical pathways for career development.
From SOC operations to essential skills and career progression, it's a useful resource wherever you are in your journey.
👉 Download your copy today: marketing.centri.org/cyberse…
ALT The image shows an open booklet titled "Cybersecurity Careers Playbook" by Centri. It features abstract digital designs and a person looking at the camera. A call-to-action button reads "Ready to Download Now.
SOC analysts, you're up. 👀
An employee logs in from London. Just 10 minutes later, there's another login from New York.
🚩 Suspicious? Absolutely worth investigating.
But what's the FIRST thing you'd do?
Would you check the authentication logs, investigate the IP addresses, contact the user, or take another approach?
We want to hear how you'd handle it.
👇 Drop your first move in the comments. Bonus points if you explain why!
How can digital forensics investigators analyse Windows evidence on macOS?
When investigating a security incident, piecing together activity across different forensic artefacts is essential. But switching between tools, converting files and working across operating systems can slow down the investigation.
That's where IRFlow Timeline comes in.
This free, open-source forensic timeline tool allows investigators to examine Windows event logs, file system artefacts and other evidence directly on macOS, bringing multiple sources together into one searchable timeline.
From tracing lateral movement and identifying suspicious processes to investigating persistence techniques, IRFlow Timeline helps DFIR professionals connect the dots and build a clearer picture of attacker activity.
In this month's Tool Spotlight, we're highlighting how IRFlow Timeline can simplify forensic analysis and support more efficient incident investigations.
💬 What's your go-to tool for forensic timeline analysis?
ALT The image shows a digital advertisement for a tool named "IRFlow Timeline" by Centri. It highlights the tool as "Tool of the Month" and describes it as a free, open-source forensic timeline tool for macOS, allowing examination of Windows evidence. The background features a stylized digital globe.
ALT A digital slide with the title "Centri" at the top left corner. The slide lists features of a software tool, including reading Windows event logs without converting them, opening specific files in the same view, identifying suspicious processes using MITRE ATT&CK, following logons and RDP sessions for lateral movement, and checking for persistence techniques. The visual style is sleek with a dark background and geometric patterns.
New Lab Drop! 💼🔍 - Shortlisted
A promising job opportunity. A recruitment brief. And a hidden threat.
In Shortlisted, an analyst at EZ-CERT receives what appears to be a legitimate job opportunity from a recruiter. He opens the attached brief, reads the description, and carries on with his day.
But behind the scenes, something else is happening.
When suspicious activity is detected on his workstation, a live triage collection is captured. Now it's your turn to investigate.
Trace how the malicious document arrived, uncover what happened when it was opened, identify persistence mechanisms, and determine just how far the attacker got.
Can you uncover what was hiding behind the job offer?
🔍 Log in or sign up to BTLO to investigate: blueteamlabs.online
ALT Poster for Blue Team Labs Online featuring text 'New Investigation' and 'Shortlisted'. Image includes a figure looking at a laptop displaying a 'Job Offer'. Tags read 'Medium' and 'Digital Forensics'. Background has abstract digital-themed design.
Got a cybersecurity question you’ve been wanting to ask? 👀
Join us in the Centri Discord on 28 October for a live Ask Me Anything with Sebastian Hague, our Director of Content & Training, and Aditya, our Defensive Content Engineer.
From offensive and defensive security to cybersecurity careers, practical skills, training, certifications, labs and the work that goes into creating our content, this is your chance to put your questions directly to the team.
Whether you’re just starting out or already working in cybersecurity, bring your questions and join the conversation.
📅 28 October
🕒 15:00 UTC
📍 Centri Discord
👉 Join the Discord: discord.gg/33AnKAX9s
ALT A promotional image for a Centri Discord event titled "Got a Cybersecurity Question? Ask Us Anything." Scheduled for 28 October at 15:00 UTC. Includes pictures of two individuals: Aditya Rai, Defensive Content Engineer, and Sabastian Hague, Director of Content & Training. The background features dark blue colors with subtle digital-themed graphics.
We have our CPTA giveaway winners! 🎉
To celebrate Cybersecurity Awareness Month, we gave one lucky winner and their chosen friend the chance to take on the Certified Penetration Testing Associate (CPTA) together.
A huge congratulations to Michele B and Andrea Z! 👏
You’ve both won access to CPTA, where you’ll be able to put your offensive security skills to the test across hands-on labs and realistic penetration testing scenarios.
Thank you to everyone who entered, reposted and got tagging. We loved seeing so many of you wanting to take on CPTA together!
Congratulations again to our winners, and good luck with CPTA!
ALT The image features confetti with a dark background. The text reads: "Centri CPTA Giveaway Winners. Certified Penetration Testing Associate. Congratulations Michele B and Andrea Z.
There’s a whole new way to train with Centri.
And we’ve been waiting to share this one.
Live, instructor led Centri training is coming to the US, through our new, exclusive partnership with Applied Technology Academy (ATA).
That means BTL1, BTL2, CDEA and CSOM are moving into the classroom, with live training available for individuals and teams.
The format might be new, but the focus is exactly the same: practical training built around realistic scenarios, hands on labs and skills you can actually put to work.
For organisations, this gives you another way to invest in your security teams. Bring people together, learn live with an experienced instructor and put practical skills at the centre of their development.
ATA has been delivering instructor led technology and cybersecurity training across the US for more than 20 years, bringing a huge amount of experience to the partnership.
Real world training has always been at the heart of Centri. Now we’re adding a whole new way to experience it.
Find out more about live training in the US and what’s available for you or your team: appliedtechnologyacademy.com…
ALT A classroom setting with several people facing a screen. The image includes the logos of Centri and Applied Technology Academy at the top. Text in the center reads: "Live Instructor Led Training Now available in the US" against a blue background.
True or False?
A “backup completed successfully” message confirms that the data can be recovered when needed.
Let us know!
Blue Team Challenge of the Week - MFA Fatigue
It's the last five minutes of the match you've been waiting all week to watch.
Your phone buzzes:
"Approve sign-in?"
You tap Deny. It buzzes again. Then again, four times in under a minute.
What's the right call?
A) Approve one prompt so you can watch the game in peace, then sort it out after
B) Deny every prompt, since never approving means no harm is done
C) Put the phone face down and deal with it in the morning
D) Deny every prompt and report it right away
ALT The image is titled "MFA Fatigue." It presents a scenario about receiving sign-in notifications during a game. The text is framed like a decision-making challenge, with options including "Approve once" and "Deny every prompt." The background features a "Blue Team Challenge of the Week" badge. There's an emoji in the lower right corner with a thinking expression.
Challenge complete! 💪
Throughout September, 18 of us at Centri have been walking, running and swimming towards a combined 3,685 km, the equivalent of travelling the length of the Mississippi River, all in support of Mind.
After plenty of kilometres, tired legs and a huge team effort, we’ve officially made it to the finish line!
There’s still time to support the challenge. Centri will be matching every donation we receive, meaning whatever you give will have double the impact for Mind and the vital mental health support they provide.
A huge thank you to everyone who has donated, shared and supported us along the way.
👉 Last chance to donate and have your contribution matched by Centri: justgiving.com/page/centri-s…
Tools don’t create consistent performance.
Training does.
Organisations that invest in structured, hands-on development tend to see:
- Fewer unnecessary escalations
- Faster investigations
- More confident decisions
It starts with strong fundamentals.
👉 See how BTL1 supports consistent SOC capability: centri.org/certifications/bl…
ALT The image shows a blurred background of hands typing on a keyboard, overlaid with digital padlock icons and the text "Consistency comes from practice. Not tools." The Centri logo is displayed at the top.
Want to win CPTA for you AND a friend? 👀
To celebrate Cybersecurity Awareness Month, we’re giving one lucky pair a Certified Penetration Testing Associate (CPTA) certification each.
The giveaway is happening over on our LinkedIn page, and entries are unlimited, so the more you tag, the more chances you have to win.
👉 Head over to LinkedIn to enter, and get tagging: linkedin.com/feed/update/urn…
📅 Entries close 12 October
🏆 Winners announced 14 October
New Lab Drop! 🏦🔍 - Inherited
Unauthorised payments. Weeks of access. And all the evidence was sitting in the logs.
In Inherited, payments have left a business account without either signatory authorising them. By the time the bank noticed, the attacker had already been inside its systems for weeks.
You’ve got eight data exports spanning authentication, web traffic, banking activity, administrative access, and database logs. Your first job? Work out how they got in.
From there, follow the evidence and reconstruct the attack from initial access to the fraudulent transactions.
Can you find the detail everyone else missed?
🔍 Log in or sign up to BTLO to investigate: blueteamlabs.online
Can offensive cybersecurity training make your SOC team stronger?
Understanding an alert is one thing. Understanding what an attacker is trying to achieve, how they might progress through your environment, and what they could do next is another.
Giving SOC analysts practical exposure to offensive techniques like exploitation, privilege escalation and lateral movement can help them see suspicious activity in a wider context. That can lead to stronger detection, more informed investigations and better decisions during an incident.
And it doesn’t mean turning every defender into a penetration tester.
In our latest blog, we explore how developing offensive security skills can strengthen existing defensive capability, improve collaboration across security teams and help analysts better understand the full attack lifecycle.
👉 Read the full blog: centri.org/blog/posts/how-of…
What difference can practical cybersecurity training make?
For individuals, it can mean greater confidence and new career opportunities. For organisations, it ensures stronger skills development and more capable security teams.
See what our learners and clients have to say.
👉 Find out more: centri.org/training?utm_sour…
Building cyber capability takes more than technology. It takes people.
Earlier this month, our Global Account Director, Adam Jones and Sebastian Hague, our Director of Content and Training, spent three days in Tbilisi with Georgia's Operative-Technical Agency, alongside colleagues from the Ministry of Defence and the Ministry of Justice.
The focus was national cyber capability, how to build it and how to sustain it. Sebastian ran practical sessions with the teams, and what stood out was the commitment in the room. These are people responsible for protecting critical infrastructure, clear about the capability they want and focused on the hands on skills to deliver it.
Security leaders everywhere will recognise the challenge. Having the technology in place is one thing. Knowing your people can use it effectively when it matters is another.
National cyber resilience takes time. It means investing in people, building practical skills and creating capability that can be demonstrated, not assumed.
Our work in Georgia continues, and we're looking forward to building on what these three days started.
Thank you to Giorgi and everyone at the OTA for the openness, the collaboration and a very warm Georgian welcome.
ALT Two photos are shown. The top photo features four individuals seated around a conference table with laptops and documents. The bottom photo shows four individuals standing in front of a wall displaying an emblem. Text on the image reads "Building Cyber Capability" and "Tbilisi, Georgia.
We have our first CPTA pass 🎉
Congratulations to Raymond Pompa, the first person to pass our newly launched Certified Penetration Testing Associate certification.
CPTA only launched two weeks ago, so it’s fantastic to already see someone complete the training, take on the practical exam and earn the certification.
Raymond came to CPTA with existing cybersecurity experience and qualifications, and it’s great to hear that the training still challenged him, gave him practical experience and identified areas he wants to keep developing.
Want to know what Raymond thought of CPTA? Read about his experience in our latest blog: centri.org/blog/posts/cpta-f…
ALT Advertisement for Centri's Certified Penetration Testing Associate (CPTA). Features a badge and the text 'Celebrating the first CPTA exam pass' with a quote about the exam emphasizing skill application over memorization, attributed to Raymond P. Contains a 'Learn More' button.