AES (Koi) Quest CTF Cortex AES · Attack surface range
Simulation

Cortex AES / Koi · Agentic Endpoint Security

One defender. One attacker campaign. Sixty seconds a call.

AES (Koi) Quest is a solo arcade range built on real classes of software and AI attack surface — malicious browser extensions, RCE-vulnerable packages, hijacked publishers, unregistered MCP servers. A simulated attacker campaign runs a meter against you every round. Read the evidence, make the call a strong security program would make, and take the high-score board.

  • 12K unique items across 1,602 endpoints
  • 35 malware detections on 277 endpoints
  • 52% of the software estate governed

Findings are modelled on live Koi lab tenant data. The attacker campaign is a simulation scripted for this game — not live telemetry, not customer data.

How a run plays

3 acts · randomized rounds · covers the whole product over multiple runs.

Every run is reshuffled — a seed is stamped on each run.

Defender ranks

Earned per run

Your final score sets your title on the high-score board.

Live lab access

Required for Act 2 · 3 live rounds

AES (Koi) Quest runs alongside a live Koi lab tenant. Act 2 of every run is a guided discovery mission inside that tenant, and the optional Field missions add more. Every live round has an offline evidence fallback for half credit, so nothing dead-ends — but the real thing is the point. You need your own authenticated learning-center session before the launch link works.

  1. 1

    Authenticate to the Palo Alto Networks learning center

    Sign in with your own lab credentials / SSO. Do this first — the launch link fails without an authenticated session.

  2. 2

    Open the live lab session

    Launches straight into the Koi dashboard for the lab tenant.

    Launch live Koi lab

    launch.paloaltonetworks.com/palo-alto-networks/iocmetbdrsp45fsw2i67be

  3. 3

    Acknowledge the cloned-environment notice

    Land on Dashboard and keep the tab open: every scenario has a "Verify it live" pointer into Dashboard insights, Inventory, or Governance → Remediation.

What the game proves

Five outcomes a Koi buyer cares about, mapped to what you do on screen.

Lab tenant shape

Scenario metadata is modelled on these figures. Demo data — modelled on live Koi lab findings.

Risk categories in play

Handle a category well and you earn its badge.

Scenario packs

New run

Take the range

Pick a handle, choose your pack and run length, then go. Round 1 is a tutorial.

Your run

2–24 characters. Shown on the global high-score board.

Run length

2 timed · 3 live · 1 boss · 45s per timed round · Act 2 live rounds are untimed and shuffled every run

Scenario pack

No accounts, no storage. Scores are only sent to the leaderboard when you choose to post them.

How scoring works

    Round — of —

    Arena

    x1 Containment combo
    --

    No run in progress

    Start a run and the first scenario lands here with a simulated attacker campaign already moving.

    Debrief

    Run summary

    What you just did, translated into the outcomes a Koi buyer is funding.

    Finish a run to see your debrief.

    Global standings

    High scores

    Loading…

    Untimed · live Koi tenant

    Field missions

    Untimed. Open the live Koi tenant and find the answer — this is the product doing for real what the game simulated.

    Secondary · optional

    Facilitator tools

    Running this in a room? Everyone plays their own solo run on their own device. These are the few controls a facilitator needs.