This certifies that the participant has successfully completed Operation Blueprint Diffusion, demonstrating strong capability in investigating and responding to realistic, multi-stage attacks across a modern enterprise environment.

During the exercise, the participant worked through identifying initial access, tracking attacker activity across systems, and understanding how persistence, lateral movement, and credential abuse played out in practice.

The participant showed the ability to piece together activity from different data sources, investigate compromised infrastructure and endpoints, and assess the impact of attacks on both internal systems and development pipelines.

The scenario also covered investigation of threats targeting CI/CD environments and software supply chains, reflecting current adversary tradecraft focused on long-term access and subtle manipulation.

Overall, the exercise validated the participant’s ability to independently investigate complex incidents, understand attacker behavior, and respond effectively across both Windows and Linux environments.