Immediate: legible triage notes
Analysts ship dispositions managers can skim between meetings. Rubrics catch vague language before it becomes queue debt, which is the fastest win we observe in the first two weeks of Origin Watchtower cohorts.
BlueTrace Academy · SOC simulations
Build analyst readiness with real SOC simulations
- Queue labs that reward crisp dispositions instead of heroic guesswork.
- Hunt missions with falsification steps so cold lanes still produce value.
- Bridge rehearsals that protect responders from overpromising timelines.
BlueTrace Academy is a subscription-style training platform for teams that want measurable progression without turning every lesson into a slide deck. Programs span alert triage, threat hunting, incident response, and SIEM investigations with facilitator feedback.
Milestone timeline
From first cohort to repeatable runbooks
We grew alongside customer SOCs: each launch hardened rubrics while enterprise teams pushed us toward calmer bridges and shorter handover packets.
-
2019 · Customer milestone
First 120 analysts scored on triage clarity
Early partners asked for evidence-friendly notes; we codified rubrics instead of adding more slides.
-
2021 · Product launch
Stream Hound cold-lane hunts shipped
Hunters wanted honest dead ends; we built missions that score closure writing as aggressively as catches.
-
2024 · Customer milestone
Enterprise renewals crossed 38 teams
Security managers asked for readiness dashboards without vanity metrics; we tightened exports to three inspectable behaviors.
Founding access
Join the early simulation lane
Early access is a working relationship, not a waiting list theater. You receive drafts of rubrics, sample bridge agendas, and a direct line to customer success while modules finish baking.
- •Priority seating when new hunt arcs open
- •Quarterly roadmap call with curriculum strategists
- •Shared worksheet pack for SOC managers
- •Option to co-brand internal runbooks you export
- •Transparent pricing sheet before you commit headcount
Product screenshot tour
Tabs mirror jobs analysts actually hold
Each tab is labeled as a job-to-be-done so teams can rehearse without translating marketing language into shift work.
Inside the lab shell
Stabilize the queue
- ✓Disposition drafts with explicit unknowns
- ✓Escalation packet stub before paging IR
- ✓Saved searches aligned to asset tiers
- ✓Shift overlap note auto-template
Screenshot stand-in
Interface chrome is stylized for training clarity. No live customer data appears in this pane; states reset between attempts so analysts can rehearse without fear of breaking production.
Progressive benefits
Measured wins, then compounding depth
Mid-flight: calmer hunts and bridges
Stream Hound and Bluebox Runbooks add falsification prompts and bridge roles so teams rehearse uncertainty without inventing synthetic heroics. The payoff is fewer thrashy pivots when telemetry is incomplete.
Long arc: policy-ready artifacts
Tabletop Bridge translates lab findings into three documented operational tweaks with owners. That is the long-game advantage: training outputs survive budget reviews because they read like operations, not motivational posters.
FAQ · objections
Direct answers in one glance
Structured table for buyers who want honesty without a sales script.
| Objection | Response |
|---|---|
| We already own vendor labs. | Vendor labs teach clicks; ours teach evidence packets, rubrics, and bridge comms you can paste into internal runbooks. |
| Our analysts are too senior. | Senior staff use modules to standardize notes and mentor juniors—scoring focuses on craft, not novelty TTPs. |
| Will this replace our SOC tools? | No. Hosted labs are synthetic; you map behaviors back to production tooling with your engineers. |
Partners & collaborators
Teams who rehearse with BlueTrace Academy
Han River MSSP Sejong Cyber Campus Pacific Gridworks Northern Tide Bank Atlas Mobility SOC