September 2025 Content & Platform Update

September was a busy month here at OffSec. From new content mapping to exclusive platform and usage enhancements, there’s a bit of everything. Let’s dive in!

NIST NICE Mapping

We are continuously mapping our Learning Modules to the NIST | NICE work roles.

You can see this mapping reflected in the OffSec Learning Library by navigating to the Explore page, choosing any category of content (Attack, Defend, Build) and then see all of the NIST NICE work role tags listed. Clicking on any of the work roles will filter out the content by that work role.

MITRE ATT&CK Coverage Report

We are excited to share that we have released a new feature available exclusive to Admins: MITRE ATT&CK Coverage Report.

This new feature provides enterprises with visibility into their organization’s skills coverage: you can see which attack techniques your team is trained in and where any gaps are. There is also an added ability to drill down into a specific ATT&CK technique or sub-technique and see it split into 2 tabs:

Progress: The learners and their progress on the mapped content
Labs: The hands-on content (labs) that is mapped and is counted in the coverage calculation

This feature helps by giving Admins the following:

Visibility into learner engagement
- You see which learners are contributing to the coverage of a specific technique
- You can track progress and completion status on mapped content
- Helps identify skill gaps at the individual or team level
Gap & risk identification
- Spot techniques with low learner adoption or incomplete progress
- Prioritize or assign specific content where exposure is thin
Actionable insights
- Drill-down makes it clear who needs to upskill
Demonstrating ROI
- Show not only MITRE technique coverage but also how many people are proficient and which hands-on content backs that up
- Compare the coverage in time by using the “Achieved in” filter

User enhancements

We have introduced two quality-of-life updates that make it faster for learners to finish modules and access resources.

We understand learners can get stuck at 94–99% completion because it wasn’t obvious which item they’d missed. They had to hunt item-by-item, which was time-consuming. We’re fixing that!

What’s changing:

Clear “what’s missing” highlighting: In the Learning Module outline, incomplete items now appear in bold
“Jump to resources” button: For Learning Modules that require starting a resource or a machine, learners can now jump straight into the resources section at the bottom, start it, and then return to the top to continue.

Shiny Labs #1

Up until now, OffSec has offered learners hands-on experience to practice and refine skills via Challenge Labs as part of course content. This has enabled learners to get better not only at the process of learning itself, but also to become stronger thinkers, researchers, and analysts. However, while most OffSec content has second-order learning as an objective, it is not obvious or explicit to the learner.

Enter: Shiny Labs, OffSec’s way of making second-order learning an explicit objective, beginning with LumberCorp. Shiny Labs provide a learning environment where individuals and teams can apply a broad set of skills to realistic, challenging, and industry-driven environments for a wide range of job roles.

What is LumberCorp?

A lab where learners assume the role of an external red-team consultant tasked with assessing a business’ internet-facing assets and lateral-movement exposure. The lab mirrors a mid-sized manufacturer’s corporate networks, complete with DMZ, Active Directory forests, application servers and employee workstations.

Shiny Labs are currently available as part of the PEN-300 course.

SkillScope

SkillScope is a new feature in our Admin Reports section for Learn Enterprise Admins where you can get various insights about your team.

You can select any team member to view:

A Job-Role Affinity spider chart showing how the completed content a team member has gone through maps to roles.
A Skill Proficiency spider chart highlighting strengths and gaps.
Key Insights: Information about what the team member has done, what they could be doing more of, demonstrated strengths, and weaknesses.
Learning Behavior: Gives you insights on how the team member is learning by interacting with specific types of content on the platform, highlighting for example if a user is more theoretical than practical.
Content Recommendations: Provides information on how the team member can advance and suggests content for the team member to go through to improve their skills.

Why should you use SkillScope?

SkillScope can provide high-level and quick visibility into individual team member capabilities.
Actionable guidance lets managers better understand how to support their team members and coach more effectively
This analysis can be used to make data-driven decisions around promotions, and budget allocation
The analysis provides enhanced engagement by surfacing the most relevant content for each learner, unique to what they need at the moment

SkillScope is still in development and you should treat its insights as preliminary intelligence requiring validation. It is a newly released feature and will be receiving many updates in the coming months. Your feedback will mean a lot to us in this period!