Data does not become instruction.
Retrieved content is classified and separated from system rules before generation.
CERT Learning & Research Advisor
AI mastery does not come from using a chatbot. It has to be built, tested and supervised.
CLARA is a hands-on learning environment for CERT professionals. Learners configure an AI capability, test it on synthetic data, use it in a bounded SOC mission, then support each decision with evidence.
See how it worksLearn→Build→Test→Attack→Mission→Debrief→Transfer
A complete chain, not a prompt demo
Learners build the system they will later have to challenge.
The curriculum covers the model and its route, prompts, RAG, agents, tools, permissions, guardrails, evals and observability. Components are handled separately before being assembled.
A model output remains a proposal. An action goes through a bounded tool; a claim cites its source; a sensitive decision waits for a human. Failures, missing evidence and disagreements stay visible.
- 01
Learn
Understand tokens, context, generation, embeddings, retrieval, agents and limits before configuring anything.
- 02
Build
Select a model route, version a prompt, build a RAG and define tools, permissions and stopping points.
- 03
Test
Compare variants on the same golden and adversarial cases; measure accuracy, robustness and cost.
- 04
Attack
Expose the system to hostile sources, prompt injections and invalid outputs, then correct it without hiding failure.
- 05
Run a mission
Use the capability in an isolated SOC lab with synthetic data, read-only actions and explicit approvals.
- 06
Debrief and transfer
Connect configuration, traces, evidence, corrections and rollback in a reusable artefact subject to human review.
One AI foundation, several CERT contexts
SOC first. Other perspectives come next.
01
Initial vertical · SOC
Qualify an alert without delegating judgement.
The learner queries a synthetic event set, develops competing hypotheses, cites supporting and contradicting elements, then writes a sourced escalation decision.
synthetic briefbounded queriescandidate evidencehuman debrief
02+
Planned extensions
OffSec, DFIR, CTI and VOC.
These perspectives will reuse the same eight AI mastery families. The cyber context changes; evidence, supervision and tool-control rules remain shared.
Guardrails are part of the exercise
An AI proposal never gains authority from its own text.
The model never touches a tool directly.
It produces a structured proposal; policy, allowlist and adapter decide whether execution is possible.
The human checkpoint is durable.
Refusal, approval and disagreement are recorded before any sensitive state change.
Evidence remains separate from score.
A successful quiz, trace or model output never proves acquired competence on its own.
Position in August 2026
A proven foundation. A product still under construction.
Today
The twelve-unit common core and first SOC vertical run on synthetic scenarios. Learners can build an AI capability, conduct a bounded investigation and connect conclusions to evidence and a debrief.
Next
Persistent progress, user management and the pilot experience still need to ship before opening. OffSec, DFIR, CTI and VOC perspectives will follow consolidation of the SOC path.
Pilot, partnership or technical discussion
Let’s discuss a specific need.
Describe your context, the people involved and what you want to test. Your message goes directly to the CERTSKILLS team.
contact@certskills.fr