Project Aether

Project AETHER is a self-hosted, real-time "purple range" cyber simulator that makes the value of proactive security measurable rather than asserted.

A Blue Team defends a seven-node corporate network — with the Core Database sitting behind a Jump Host chokepoint — against an adversary that establishes a foothold, pivots laterally, and tries to collapse core integrity inside a five-minute engagement. Every defensive control changes the detection mathematics live, and the range reports the result as measured MTTD and MTTR, graded against industry benchmarks. It runs as a single Node process serving a React console on one port, so setup is a double-click and a second player joins by opening a URL. You can play Blue against an LLM-driven threat actor (three personas, with a deterministic fallback so no API key is required), play Red against an automated SOC at three maturity levels, run a three-mission campaign, or go human-versus-human locally or over the network — with fog of war enforced server-side, not in the UI.

Project AETHER simulates the full detection-and-response loop rather than just an attack path: alerts surface as untriaged and may be genuine intrusions or benign anomalies, so players must decide whether to spend on triage or respond blind, while intrusions left un-evicted for 45 seconds entrench — inflicting heavier damage, costing more to remove, and sometimes re-entering after a supposedly successful eviction. Blue can buy proactive logging, tune SIEM correlation, deploy honeypots whose effectiveness depends on the adversary's doctrine, micro-segment the chokepoint at a real uptime cost, and hunt proactively to surface adversaries that haven't yet tripped a threshold. Red works an action economy across phishing, stealth reconnaissance, living-off-the-land execution, lateral movement and ransomware, under its own fog of war. Supporting all of it: multi-provider LLM orchestration (Anthropic, OpenAI, Gemini, or a local endpoint) with a timeout-guarded connection test, a randomised topology and stochastic adversary so no two matches repeat, a declassified adversary decision log released at debrief, and a headless balance harness that plays the real engine across five skill levels to verify outcomes stay genuinely contested.

Project AETHER's core benefit is that it makes the proactive-security business case with evidence rather than assertion: a team that does nothing wins 0% of engagements, competent reactive response reaches ~44%, and adding proactive threat hunting roughly doubles that to 88% — numbers stakeholders watch generate from their own decisions. Beneath that, it teaches detection economics rather than just detection, because finite Action Points force the trade every SOC actually faces: triage this alert or respond blind, buy more visibility or the capacity to use it, contain at the chokepoint and eat the uptime hit or leave the path open. Entrenchment at 45 seconds — heavier damage, costlier eviction, possible re-entry after a supposedly successful remediation — turns MTTD and MTTR from reported metrics into consequences players feel, and taking the Red seat lets defenders watch an automated SOC notice and evict them, which builds intuition they rarely get from the blue side alone.

Practically, it deploys in about a minute (double-click, one URL, one port, no API key or internet required), stays interesting on repeat thanks to three adversary personas plus randomised topology and detection jitter, and produces assessable output — benchmark-graded MTTD/MTTR, triage precision, and a declassified adversary decision log for structured debrief. Two honest limits: it trains decision-making, not hands-on technique, so it complements rather than replaces a CTF or live range; and triage currently performs about the same as blind response on average, so don't pitch that specific lesson without raising the false-positive rate first. Its strongest use is precisely where technical ranges are weakest — making the strategic case to people who don't work in a terminal.