Your exercise is yours alone.

Cyber Ambush holds no independent certification, audit report or attestation: no SOC 2, ISO/IEC 27001 or HITRUST. Control mappings here are a self-assessment by Sterling Readiness Group, LLC, not reviewed by an independent auditor — treat them as vendor statements, not assured evidence. We answer questionnaires (SIG Lite, CSA CAIQ, your own template) directly and say plainly where a control is planned rather than in place. Our SOC 2 Type I examination is in progress; we claim no certification until it's issued. Request a security review.

• Lovable

  Lovable Labs Incorporated · United States

  Application hosting, build and content delivery for cyberambush.com

  Data: Application code and every request served to the application

• Supabase

  Supabase, Inc. · United States

  Postgres database, authentication (including multi-factor authentication) and file storage

  Data: Organizations, accounts, exercises, injects, responses, decisions, after-action reports

• Amazon Web Services

  Amazon Web Services, Inc. · United States

  Cloud infrastructure beneath the database and storage provider

  Data: The same records at rest, encrypted by the platform

• Lovable AI gateway

  Lovable Labs Incorporated · United States

  Routes AI requests to the model provider for the planning assistant, response assessment and after-action report drafting

  Data: Scenario and inject text, planning guidance, Participant responses

• Google (Gemini models)

  Google LLC · United States

  Large language model inference reached through the AI gateway

  Data: The exercise text listed in the row above, for the duration of the request

• Resend

  Resend, Inc. · United States

  Transactional email delivery (invitations, reminders, after-action notices)

  Data: Recipient name and email address, exercise name, join link

• The planning assistant, response assessment and AAR drafting send scenario text, injects, guidance and Participant responses to Google Gemini models, reached through the Lovable AI gateway. No other model provider receives exercise content.
• Cyber Ambush does not train any model on customer exercise content; text is sent only for the duration of the request. Terms in force are available on request.
• The platform is designed for synthetic content — don't enter regulated personal data, live case material or production secrets.
• AI assessment output is advisory; a human Sponsor or Operator owns every final rating.

• Exercise records, decisions and AARs are retained for as long as your organization keeps its account, so they remain available as audit evidence. An AAR can be exported at any time.
• On written request — during the subscription or after termination — we permanently delete an organization's exercise data and personal data within 30 days and confirm when it's done.
• We retain data beyond that only where applicable law requires it, and only as long as required.

Cyber Ambush is operated by Sterling Readiness Group, LLC. Report a vulnerability to support@sterlingllc.com or use the form if you prefer: Report a security vulnerability.

• We acknowledge reports within two business days. We don't currently operate a paid bug bounty.
• If a personal data breach affects data we process for your organization, we'll notify you without undue delay, per our Data Processing Addendum.
• Machine-readable contact details are published at /.well-known/security.txt.

• AC-2 / AC-3Account management & access enforcement

  Accounts are provisioned per organization with a single role each, enforced server-side on every request.

• AC-6Least privilege

  Participants get the narrowest view that still lets them play; only Sponsors and Operators can plan, approve, release or score.

• AU-2 / AU-3Audit events & content

  Exercise records keep who released each inject, committed each response, approved guidance and called ENDEX, and when.

• IA-2 / IA-5 / IA-2(1) / IA-2(2)Identification & authenticator management

  Email and password sign-in with enforced MFA (TOTP) for every account, checked by the database on every request. Passwords are never stored by the application.

• IR-2 / IR-3 / IR-8IR training, testing and plan

  Each completed exercise is documented, scored evidence of IR training and annual testing against your plan.

• SC-8 / SC-13Transmission confidentiality & cryptography

  All traffic is served over HTTPS; data at rest is encrypted by the managed cloud platform.

• CA-7 / RA-5Continuous monitoring & vulnerability management

  Automated access-rule and dependency scans run against the platform; findings are triaged on a risk basis.

Our own analysis, not an auditor's opinion — these certify neither your program nor ours.

• Use a distinct account per person — shared logins destroy the audit trail.
• Treat join codes as short-lived: share them where Participants already trust, and issue a new one rather than reusing an old code.
• Keep real casework out of injects — use realistic but synthetic names, systems and data.
• Nominate a Sponsor genuinely authorized to make the scenario's decisions, or the escalation test proves nothing.
• Export the AAR at the end of the exercise and file it with your compliance evidence while fresh.
• Close corrective actions in your own tracker with an owner and a date.
• Register two authenticator devices per person so a lost phone doesn't lock anyone out.

• SOC 2 — In progress; we claim no certification until the report is issued.
• Not a certification — Cyber Ambush produces supporting evidence. It doesn't issue an attestation, and no platform can certify your program for you.
• Not a legal opinion — Notification clocks and regulatory references are exercise material for practice. Confirm real obligations with counsel.
• Exercise data only — Designed for synthetic scenario content. Don't enter live case material, regulated personal data or production secrets.
• Demo mode is a sample — The DEMO toggle shows a fixed sample exercise, not written to your organization's records.