>>> Access Control
Free to Learn.
Paid to Operate.
Courses, tools and community are free forever. Unlock the intelligence, research and doctrine with Operator - add every hands-on lab and certificate with Pro.
Choose_Your_Clearance
- Full course library (5G · LTE · GSM · IMS)
- Arsenal tools, calculators & projects
- Community, leaderboard & ranks
- Intelligence · Research · Defense · Governance
- Path certificates
- ProLabs execution
- Everything in Recruit
- Intelligence & OSINT briefings
- Research protocols & reproductions
- Defense & Governance doctrine
- Theory-path certificates
- Standard labs — à la carte add-on
- Everything in Operator
- All standard ProLabs included
- All certificates (lab capstone)
- 1 flagship lab rotation included
- Priority lab infrastructure
- Early access to new labs
Prices exclude VAT · Cancel anytime, access holds until period end · Need seats or SSO? Enterprise & teams →
Standard_Lab_Catalog
All standard labs are included with Pro. Prefer to run just one? Buy it à la carte - a dedicated, cloud-isolated environment with VPN credentials, a per-user SIM profile, and the challenge board that unlocks your path certificate.
LTE eNB Security Lab
Hands-on exploitation and hardening of a live LTE eNodeB using srsRAN.
- Dedicated isolated node - VPN access included
- Per-user SIM profile (IMSI/K/OPc via HMAC)
- Challenge board → path certificate on completion
- Included free with a Pro subscription
5G SA Core Security Lab
Audit and attack a standalone 5G core network with Open5GS and UERANSIM.
- Dedicated isolated node - VPN access included
- Per-user SIM profile (IMSI/K/OPc via HMAC)
- Challenge board → path certificate on completion
- Included free with a Pro subscription
Baseband Research Lab
Reverse-engineer and fuzz baseband firmware in a hardware-backed range.
- Dedicated isolated node - VPN access included
- Per-user SIM profile (IMSI/K/OPc via HMAC)
- Challenge board → path certificate on completion
- Included free with a Pro subscription
IoT SIM Security Lab
Clone, authenticate, and analyze IoT SIM profiles in a controlled environment.
- Dedicated isolated node - VPN access included
- Per-user SIM profile (IMSI/K/OPc via HMAC)
- Challenge board → path certificate on completion
- Included free with a Pro subscription
Multi-machine red-team ranges - like the full 5G SA Core - are priced by their dimension: a one-time unlock plus a small monthly retention fee to keep the environment live. Pro includes one flagship rotation.
Enterprise_&_Teams
Institutional Access
For telecom operators, MSSPs, and training institutions requiring bulk lab seats, private nodes, NIS2 compliance tooling, or SAML/SSO integration.
- Bulk lab seat allocation (team/cohort)
- 20+ dedicated isolated research nodes
- SAML / SSO integration
- Custom institutional learning paths
- NIS2 & GSMA NESAS compliance audit tooling
- Dedicated account manager + SLA
Intelligence_Briefing_FAQ
What is free?
The full course library (5G, LTE, GSM, PSTN, IMS), the Arsenal tooling and calculators, and the whole community layer - leaderboard, ranks and discussions - are free forever, no card required.
What do the Operator and Pro plans unlock?
Operator unlocks the knowledge depth - Intelligence, OSINT, Research protocol deep-dives and reproductions, Defense and Governance - plus theory-path certificates. Pro includes everything in Operator and adds execution access to every standard ProLab and all lab-capstone certificates.
How do certificates work?
Each learning path ends with a ProLab as its practical capstone. Completing that lab is required to earn the path certificate - the lab is the exam. Theory-path certificates come with Operator; lab-capstone certificates require Pro or the individual lab.
Can I buy a single lab instead of subscribing?
Yes. Standard labs are sold à la carte for a fixed active window if you only need one. Pro includes every standard lab while active, so it pays off from the second lab onward.
What are Flagship Pro Labs?
Large multi-machine red-team ranges (like the full 5G SA Core) priced by their dimension - a one-time unlock plus a small monthly retention fee to keep the environment live. Pro includes one flagship rotation; additional flagships are add-ons.
What infrastructure backs the labs?
Labs run on dedicated cloud-isolated nodes provisioned per user - LTE eNB via srsRAN, 5G SA core via Open5GS/UERANSIM, baseband via hardware-backed firmware environments, and IoT SIM via JavaCard toolchains.
Is there an enterprise or team option?
Yes. For organizations requiring bulk seats, private lab nodes, SAML/SSO, NIS2 compliance tooling, or institutional learning paths, contact us for an ARR quote.