The integrated platform
Learning, exercise and assurance — connected by evidence.
CLIP preserves the systems that already work and adds the identity, policy, orchestration, competency, telemetry and evidence services required to turn them into one mission-readiness platform.
CLIP · Platform layers
Illustrative view- L5Unified experience
- L4Learning, competency and exercise control
- L3Orchestration and policy
- L2Isolated range
- L1Evidence and analytics
Layers scale independently: control plane apart from range compute and telemetry.
Product boundary
Not only an LMS. Not only a range.
Both are necessary. Neither, on its own, connects a role requirement to a defensible readiness decision.
A learning system
Courses, enrolment, completion records
No observed performance, no exercise evidence, no readiness view
A standalone range
Isolated environments and practice
No competency model, no assessment traceability, no organizational view
CLIP
One governed journey across both
Adds identity, policy, competency, evidence and readiness services
Operating model
Learn, practise, exercise, assess, improve.
- 01LearnStructured courses and pathways.
- 02PracticeGuided laboratories and challenges.
- 03ExerciseMulti-team scenarios under control.
- 04AssessEvidence, rubrics and adjudication.
- 05ImproveOwned actions and updated records.
In sequence: Structured learning builds knowledge, practice applies it in a guided environment, exercises test it under realistic conditions, assessment converts observed performance into evidence, and improvement actions close the loop.
Platform layers
Five layers with clear authority boundaries.
Each layer has an explicit responsibility, so a failure in analytics never compromises a running exercise and a compromised range workload never reaches the control plane.
Unified experience
Portal, workspace, search and role-specific dashboards.
Learning, competency and exercise control
Pathways, role profiles, scenario execution and adjudication.
Orchestration and policy
Identity, authorization, approvals and target binding.
Isolated range
Approved templates, per-exercise isolation, default-deny egress.
Evidence and analytics
Normalisation, provenance, immutable artifacts and replay.
Operations and supply chain
Configuration, observability, updates and component assurance.
Systems of record
Clear authority, no circular ownership.
Every business object has exactly one authoritative source. CLIP integrates rather than duplicates, so records never diverge between systems.
| Capability or data | Authoritative system |
|---|---|
| Identity and authentication | Approved identity provider |
| Structured course enrolment and completion | Open edX |
| Tabletop scenario and inject state | INJECT MUNI |
| Competency and readiness record | CLIP Competency Service |
| Lab and range lifecycle | CLIP Range Orchestrator |
| Exercise evidence and immutable artifacts | CLIP Evidence Service |
| Operational HR assignment | External workforce system |
CLIP provides recommendations and evidence for workforce assignment. It does not make the assignment decision.
Composable content
Everything reusable is a governed asset.
Courses, labs, scenarios, injects, datasets, detection rules and rubrics are versioned assets with owner, licence, classification, dependencies and review status.
- Versioned with lineage when cloned or adapted
- Signed and traceable to source, licence and SBOM where applicable
- Quarantined on import until validation completes
- Revocable — blocked from new launches while prior evidence is preserved
- Promotable between development, review and approved repositories under policy
- Exportable in open, documented formats
Evidence-first competency
One claim, traced all the way down.
A competency claim is only as good as what supports it. Every claim in CLIP exposes the observed events, the evidence artifacts, the assessor who adjudicated it, the framework version it was assessed against, and how fresh it still is.
How readiness is calculated- ClaimCan lead containment for an identity compromise
- Observed eventsExercise EX-2026-014 · 9 correlated actions
- EvidenceCase record, decision log, recovery verification
- AssessorHuman adjudicated with recorded rationale
- FreshnessCurrent · expires in 7 months
Readiness levels
Individual to organization.
The same evidence rolls up without being re-entered, and each level shows scope, freshness and confidence.
- 01IndividualRole competence with supporting evidence.
- 02TeamCoordination, handoffs and collective performance.
- 03CohortProgramme progression and gap distribution.
- 04OrganizationCapability risk and readiness trend.
In sequence: Individual competence aggregates into team capability, team capability into cohort readiness, and cohort readiness into an organizational view — each level carrying its own scope and freshness.
Product boundary
What CLIP is, and what it is not.
Being explicit about the boundary is part of the product. It prevents CLIP being deployed into a role it should not hold.
CLIP is
- A governed environment for developing and verifying cyber competence
- An integration layer over selected systems of record
- A source of traceable assessment and readiness evidence
- A controlled environment for offensive practice and bounded AI
CLIP is not
- A replacement for your production SOC, SIEM, SOAR or case management
- Operational command-and-control for real-world cyber operations
- A general-purpose penetration-testing service against external targets
- An authority that issues regulated competency certification on its own
See the reference architecture.
Technical and procurement evaluators can review layers, integration boundaries, trust zones and deployment models.