The Cyber Range and the Machine

You can't defend what you haven't practiced.

A Cyber Range is the flight simulator of cybersecurity. Real scenarios, real infrastructure, real pressure. But building one from scratch - with isolated networks, virtual machines, adaptive exercises, and real-time scoring - requires an architecture most organizations don't have.

This book documents the real-world construction of a professional Cyber Range powered by artificial intelligence. From Proxmox orchestration and isolated workzones to agents that generate adaptive CTF scenarios and train red/blue/purple teams.

What will you learn?

• Design the architecture of a Cyber Range: three layers, workzones, VLAN-based isolation
• Orchestrate Proxmox VE: templates, snapshots, automated deployment with Ansible
• Build a professional CTF engine with dynamic flags, hints, and real-time scoring
• Design attack scenarios with real-world topologies: Active Directory, OT/IoT, SCADA
• Generate adaptive exercises with Claude Agent SDK that adjust difficulty to each participant
• Implement automated red teaming and AI coaching for blue teams
• Build a training SOC with assisted triage and threat hunting powered by LLMs
• Use the Cyber Range as a labeled data factory for detection models
• Deploy with Docker, Ansible, and FastAPI: real-time WebSocket, VNC consoles

28 technical chapters across 9 parts

Each chapter combines infrastructure architecture with applied AI. Design decisions with discarded alternatives, working code, and lessons from real-world operations.

Part I - What is a Cyber Range, cyber exercises, and the Claude ecosystem · Part II - Infrastructure: Proxmox, VLANs, pfSense, workzones · Part III - Backend: FastAPI, 90 models, Proxmox SDK · Part IV - Exercise engine: CTF, scenarios, teams, attack and defense · Part V - AI: scenario generation, coaching, autonomous red team · Part VI - The SOC of the future: alerts, triage, and AI-powered training · Part VII - Frontend: React, topology canvas, terminals, dashboards · Part VIII - Security and deployment: JWT, RBAC, Ansible, Docker · Part IX - Market, lessons learned, and the future of Cyber Ranges

From static lab to adaptive training

A Cyber Range without AI is just a set of preconfigured VMs. With Claude Agent SDK, scenarios are generated, deployed, and evaluated autonomously. The instructor defines the training objective; the platform builds the exercise.

Code available in the public repository: github.com/machinebooks

Who is this for?

• Organizations that want to build their own Cyber Range without relying on SimSpace or Cyberbit
• Cybersecurity instructors who need adaptive, scalable exercises
• SOC teams looking to train triage, threat hunting, and incident response
• Companies aiming to position themselves in the NATO/INCIBE/Locked Shields market

Book #4 in "The Professional and the Machine" series, which also includes The Architect and the Machine, The Pentester and the Machine, The CISO and the Machine, PQC-Day and the Machine, and The User and the Machine. Each book is standalone.

Includes glossary, reference appendices, and architecture diagrams.

About the authors: Carlos Pérez González, AI solutions architect with over two decades in offensive cybersecurity (OSCE, OSCP, OSWE, OSEP). Founder of ihacklabs, acquired by Telefónica in 2020. Juan Carlos Montes Senra, cybersecurity architect with a forensic and offensive profile (GCFA, GREM), published in PHRACK #65.