AI exercise builder

The Exercise builder turns a short description of a scenario into an interactive exercise, built from the same 3D office, fake websites, emails, chats and phone apps as RansomLeak’s own exercises. You review the plan before anything is built, and nothing reaches learners until you make it available.

The builder is off until RansomLeak turns it on for your organization: ask RansomLeak support to enable it. Once it’s on, the default Admin role can use it. To give it to people with a custom role, grant the Use the AI Exercise Builder permission under User Management → Roles.

1. Write a brief

Go to Content Management → Exercise builder and fill in New exercise:

Field	What to enter
Topic	The threat, for example Invoice fraud.
Focus (optional)	What learners should practise spotting or doing.
Audience role and Technical level	Who the exercise is for.
Start from an existing exercise (optional)	The new exercise follows that exercise’s structure with a new story.
Language	Steps, pages and voiced dialogs are written in this language.
View	3D room puts the learner in a room with people and props such as a printer, a whiteboard or a cafe table. 2D screens shows only the screens: the computer, the phone and the attacker’s monitor. Pick 2D for technical topics that happen entirely on screen. When you start from an existing exercise, the new one keeps that exercise’s view.

Click Generate outline. One generation runs at a time for your organization.

2. Review the outline

The outline is the plan: a fictional story company, the steps with the actions in each, the fake pages, and the quiz. Before approving you can:

• rename, reorder, add or remove steps and actions;
• edit the quiz plan;
• edit the Description for learners, shown before learners start.

Programming language (code exercises)

When the exercise shows code in a code editor, as secure-coding exercises do, the outline shows a Programming language field. All of the exercise’s code is written in that one language. Supporting files such as a Dockerfile or SQL can appear alongside it.

• If the issue isn’t tied to one language, for example SQL injection, pick the language your developers use. TypeScript is the default.
• If the issue exists only in one language, for example a PHP deserialization flaw, the language is fixed and shown with a note.

Exercises without code don’t show this field.

Documents

When the story needs a realistic business document, the outline lists it under Documents: an invoice, a payslip, an HR record, a contract, a policy, a memo, a bank-details change form or a report. Each shows where it appears: a file on the learner’s computer, an email attachment, a download from a file-sharing page, or the document every file opens as (a ransom note). Learners open it in the document viewer, where steps can have them spot, edit, redact or reveal parts of it. You can edit what each document should show; the builder writes its content to match the steps. With Brand Mode on, documents carry your colours and logo.

An outline can have at most six calls, voicemails or meetings. Click Save outline, then Approve and generate.

3. Check the draft

The builder writes every step, page and dialog, then checks that a learner can complete the exercise: every click target exists, apps are open before they are used, and steps happen in an order the player supports. Problems it finds are repaired automatically. When the draft is ready you see an Advisory review with notes that don’t block publishing.

Pictures

Generated exercises can include drawn pictures: a company logo on an email or a document, a product shot in a sales email, an ID card, a scanned page, a chart, a QR poster, a website screenshot or a profile picture. They are illustrations drawn for each exercise, not photos, and they never show a real person. With Brand Mode on, the fictional company’s logo shows your organization’s name in the colour scheme closest to your brand colour. To change a picture, ask for it under Ask for a change.

To change something, type it under Ask for a change, for example make the caller in step 2 more insistent. The draft is revised in place and checked again. Requests that use real company names or domains are refused.

If a generation fails, nothing is published. Delete the run and try again with a narrower brief.

4. Publish and make it available

Publish adds the exercise to the Your exercises course, switched off. Click Preview to play it, then turn on Make available to learners. Until then learners can’t see it and it can’t be assigned.

Exercises are written about a fictional company. If Brand Mode is on for your organization, the fictional company, its domains and its lookalike domains are replaced with your organization’s when learners play.

Page library

Fake sites of your own company (an intranet, a sign-in page, an HR portal) are saved to the Page library when you publish, so later exercises reuse the same site name and navigation. Each update creates a new version:

• new exercises use the latest version;
• an existing exercise moves to a newer version only when you choose Update on the page, and only if it still works;
• Archive stops new exercises from reusing a page; exercises that already use it keep it.

Limits

• Exercises use the builder’s built-in apps and page templates. A brief that needs something the builder can’t show (for example a physical device it doesn’t model) is taught the closest honest way.
• If the builder declines a brief, describe the topic from the defender’s side: what learners should notice and do. A brief written as instructions for carrying out an attack is more likely to be declined.
• Images in generated emails are drawn by the player (a photo placeholder, a logo from initials, or a QR-style code), not uploaded.