ScenarioLab helps hiring teams see how candidates actually think — critiquing AI-generated cyber analysis, making incident decisions under pressure, and designing secure architectures — on scenarios built from real-world incidents.
Candidates review a deliberately flawed AI-generated report set against a named real-world attack (SolarWinds, Log4Shell, Colonial Pipeline and more), under time pressure.
Free trial · no credit card required
AI Security Analysis — Network Scan
CVSS 9.8 · Apply input sanitisation immediately.
Recommendation: disable TLS 1.2 and below.
Candidate must identify
Hiring assessments use structured scoring and fixed rubrics for consistent candidate evaluation. Every response is evaluated against a deterministic rubric — no LLMs in the scoring loop.
Three ways to assess
Candidates critique a deliberately flawed AI-generated report on a real attack — spotting unsupported conclusions and explaining evidence-based decisions.
A branching incident response: triage, containment and escalation decisions, scored against a fixed rubric at every step.
Candidates review the evidence, make design decisions and write up their architecture, from Foundation to Advanced — you see every decision and the written answer.
The hiring gap
AI-generated security reports are increasingly polished — and increasingly wrong. Candidates who can't distinguish confident AI prose from sound analysis are a liability.
Technical screens test memorised CVEs and syntax. Scenario-based assessments reveal whether candidates actually reason through an analysis or just pattern-match.
Most soft-skill assessments rely on interviewer opinion. ScenarioLab scores against a fixed key — same standard for every candidate, every time.
How it works
Shown here for an AI critical analysis assessment — incident management and security architecture assessments work the same way: pick a scenario, invite candidates by link, review the report.
Pick a real-world incident — SolarWinds, Log4Shell, Colonial Pipeline and more. Each is paired with an AI-generated report containing embedded analytical flaws, scored against a fixed rubric.
Paste a candidate email and we send them a private assessment link. They authenticate with a one-time code — no account creation needed.
Each submission produces a detailed evaluation report: per-question scores, reasoning quality, and an overall band. Export as PDF for your records.
Sample report
Every completed assessment generates a full evaluation — per-dimension scores, a critical thinking profile, and a hiring recommendation. No interpretation needed.
Alex M.
a7f3...c91e@candidate
Senior SOC Analyst Screening · Phishing Campaign Attribution
MIDSubmitted 10 Apr 2026 · Time taken 17m 42s
68 / 100
ProficientCritical thinking profile
Strongest area
Threat attribution
Weakest area
Remediation reasoning
Summary
Strong attribution instincts; remediation steps lack precision under time pressure.
Evaluation narrative
Alex correctly identified the misattributed threat actor and flagged the CVSS inconsistency on Q2. Remediation responses were directionally correct but lacked the specificity expected at mid level — particularly around lateral movement containment. Overall reasoning is sound; gaps are addressable with structured mentorship.
Next steps: ready for more complex scenarios; focus on incident response depth.
Dimension breakdown
Strong
Strong
Adequate
Weak
| Dimension | Score | Max | Band |
|---|---|---|---|
| Threat attribution | 17 | 20 | Strong |
| Evidence evaluation | 18 | 25 | Strong |
| Risk prioritisation | 15 | 25 | Adequate |
| Remediation reasoning | 18 | 30 | Weak |
Built for security teams
Every response is evaluated against a deterministic rubric. Scoring is a pure function — reproducible and auditable.
20-minute sessions. Realistic pressure without the noise of open-book take-homes.
Per-question scoring with overall bands. Clear signal on where a candidate's reasoning breaks down.
Candidates receive background on the real-world attack before they begin — so they assess the report in context, not in a vacuum.
Candidate emails are hashed after OTP verification. Raw answers are never written to the database.
Incident judgment assessments
Candidates walk a branching incident response grounded in a real-world attack — triage an alert, weigh a (sometimes flawed) AI-generated analysis, and choose how to contain, escalate or investigate further. Every path is scored against the same deterministic rubric, so candidates are compared fairly.
The candidate sees the incident unfold from a specific seat — SOC analyst, incident manager or executive.
Each decision branches the incident. There's no single correct path — only better and worse judgment.
You get the full decision path with a score for each dimension, ready to compare candidates.
Pricing
Free during early access — pricing will be introduced later.