Varonis Launches Free Entra ID Training Game to Teach Cloud Identity Attacks
Breach at the Beach is a browser-based challenge that walks defenders through the kind of Microsoft Entra ID attacks Varonis researchers say they see in real customer environments.
Key points
- Varonis Threat Labs released a free online training challenge called Breach at the Beach, focused on attacks against Microsoft Entra ID, the identity system that controls who can log in to a company's cloud apps.
- Each of the four stages earns players one CPE credit, a professional training credit recognised by security certification bodies, plus a certificate at the end.
- Researchers Doron Kapah and Mark Vaitsman say every scenario is based on real attacks they investigated, not invented examples.
- The challenge runs in person at Black Hat USA (3 to 6 August 2026) and DEF CON 34 (6 to 9 August 2026) in Las Vegas.
- Players who finish online or on site by 6 August enter a draw for a $2,000 Marriott gift card.
Varonis has published a free browser-based training game aimed at teaching defenders how attacks against Microsoft Entra ID actually unfold.
Entra ID is Microsoft's cloud identity service: it decides who gets to sign in to company email and business apps. If an attacker takes it over, they can move almost anywhere.
The game is called Breach at the Beach. Players follow a cartoon cat named Pixel through a fictional intrusion, working from raw log data to figure out what the attacker stole.
What is this training actually trying to teach?
It teaches defenders to spot attacks that abuse features working exactly as designed, rather than obvious misconfigurations.
That matters because most Entra ID break-ins don't involve a broken setting. They involve an attacker using a legitimate feature in a way the company never intended, and spotting that is much harder than finding a checkbox someone forgot to tick.
Doron Kapah and Mark Vaitsman of Varonis Threat Labs say the scenarios come from real cases they worked on. One focus is what the industry calls non-human identities: logins that belong to software rather than people, covering automated scripts and the AI assistants that act on a user's behalf. Companies now have far more of these than they have staff, a trend we've tracked across six stories since 15 June, including our report on AI agent logins multiplying inside company directories.
"In today's AI era, a lot of identities are non-human identities," Vaitsman told BleepingComputer. "If there is a compromise in Entra, a threat actor can pivot themselves into a non-human identity, and it can quickly turn into a stealthy and scalable data exfiltration attempt."
Once inside, in other words, an attacker can hop from a human account onto a machine account and pull data out quietly at scale, because nobody watches a script the way they watch a person.
How the challenge works
Players sift through Entra ID audit logs, the timestamped records of who did what, to reconstruct an attack. The logs are noisy on purpose, mimicking what a real analyst faces on a Monday morning.
The designers also blocked one shortcut: they built the puzzles so pasting them into an AI chatbot won't surface the answer. Kapah and Vaitsman say they want players to learn the technique rather than speed-run it.
There are four stages. Each awards one CPE credit and a themed badge; finishing all four earns a certificate shareable on LinkedIn. Anyone chasing CPE credits needs to register with a working email address.
The game is free at breachatthebeach.com. BleepingComputer noted the release as a sponsored launch from Varonis.
Who is it aimed at?
Both offensive testers (red teamers, who simulate attacks) and defenders (blue teamers, who stop them). Kapah says it's also useful for CISOs and threat intelligence staff who rarely touch Entra audit logs day to day but need to understand what their teams are seeing.
"There is no way you can be a good red teamer if you're not familiar with the blue team side," Vaitsman told BleepingComputer.
Varonis will run the challenge in person at Black Hat USA at booth 2948 from 3 to 6 August, and at the Cloud Village at DEF CON 34 from 6 to 9 August. Players who complete it online or in person by 6 August go into the draw for that $2,000 Marriott gift card.
The honest read on this: it's a vendor marketing exercise built around a real skills gap. The AI-resistance design is the detail worth watching: if CTF designers are already engineering around LLM shortcuts, the training tools that don't will age badly, fast.
