Coming soon!
Microsoft CTF: Blind Spot
When 'Lumina AI,' a free unsanctioned browser assistant, spreads through Whirlwind Wealth's advisory team, a productivity shortcut evades DLP and escalates into regulated-data exposure with insider-trading and books-and-records risk. As cloud-discovery and endpoint signals flag anomalous use, the SOC pivots across MDCA, Purview, Defender XDR, Entra ID, and Sentinel to determine what left, through whom, and whether it was negligent or deliberate.
Game architect
Pre-requisites
The challenge
Employees are adopting AI tools faster than security and compliance teams can track them. In regulated industries, an unsanctioned AI assistant quietly handling client data isn't just a policy violation, it's a potential regulatory and insider-trading exposure most SOC teams have never had to investigate.
The experience
Microsoft Blind Spot is a four-hour, live, proctor-led Cyber Range event. Your team investigates Whirlwind Wealth, a SEC- and FINRA-regulated wealth management firm, after Lumina AI, an unsanctioned browser-based AI assistant, spreads quietly through its advisory team. Working in teams of 3-4, participants:
- Investigate a live shadow AI exposure. Unsanctioned AI usage, DLP bypass, and potential regulated-data exposure with insider-trading implications.
- Validate modern cloud, identity, and compliance controls in action.
- Use Microsoft Defender for Cloud Apps to discover shadow IT and Microsoft Purview to classify data and investigate DLP events.
- Investigate the full incident timeline in Microsoft Sentinel, using Microsoft Defender XDR and Microsoft Entra ID to correlate endpoint and identity signals, building the detection instincts regulated industries demand.
- Leave with a scored readiness report mapped to MITRE ATT&CK and NIST NICE.
Business outcomes
- A clear, evidence-based picture of shadow AI usage and regulated-data exposure.
- Proof of whether your controls detect and contain unsanctioned AI activity.
- A measurable readiness baseline for your compliance and security teams.
Who should attend
SOC analysts, incident responders, compliance and risk officers, cloud and identity security engineers, and security architects. Intermediate difficulty; the scenario is financial services, and the skills apply to every industry.