What is a KC7 event?
What a KC7 event is, who hosts them, and what participants do
A KC7 event is a hands-on cybersecurity experience where participants become investigators, working through a realistic (but fictional) cyber mystery using the same tools that professional analysts rely on every day. You bring the people and the setting. KC7 provides the game, the training, and the content, so you don't need a cybersecurity background to host.
A cybersecurity mystery game built for beginners
KC7 is a story-driven cybersecurity game where players step into the role of investigators solving a cyber incident. They analyze simulated computer and network activity, look for suspicious patterns, and answer questions that move the story forward. The experience is designed from the ground up for people with no prior cybersecurity knowledge. Early questions teach the fundamentals, and each new challenge builds naturally on what came before. By the end, participants have practiced real skills like building a timeline of events, thinking logically about evidence, and explaining what happened in plain language.
Your role as host: set the stage, not the curriculum
Hosting a KC7 event means gathering a group, whether students, employees, or community members, and giving them a shared space to learn together. You provide the time, the venue (physical or virtual), and the encouragement. KC7 handles everything instructional, including the game, the training content, and the built-in support that keeps participants moving forward.
Your event might be a 90-minute classroom activity, a 3-hour team-building session, or a full-day workshop, in a computer lab, a conference room, or over Zoom. During the event, you circulate the room, answer logistical questions, keep energy up, and celebrate discoveries as they happen.
Educators, trainers, and community leaders run these events
Educators use KC7 to introduce students to cybersecurity careers and computational thinking without having to teach the technical material themselves. The platform handles the instruction, freeing you to focus on facilitation and encouragement.
HR and corporate trainers use it for security awareness training that doubles as team building. Employees learn to think like both attackers and defenders, and the interactive format sticks far better than slide decks.
Community organizers and student leaders use it to bring people together around technology in an accessible, low-barrier way. No expensive equipment and no specialized instructors, just computers and an internet connection.
People building a cybersecurity program use KC7 as a low-friction starting point. Run one successful event, gauge interest, and expand from there.
How the game works for participants
Every participant follows the same path through the experience:
Open the participant link in their browser
Read the scenario briefing that sets up the mystery
Investigate using real security analysis tools embedded in the platform
Analyze log data to piece together what happened
Submit findings to the scoreboard as they progress
Pick up cybersecurity concepts naturally through the work itself
There's nothing to install, no accounts to create ahead of time, and no prerequisites to worry about.
The tools are real
Under the hood, participants work with the same technology stack that professional security analysts use daily:
Azure Data Explorer (ADX) stores and serves the security logs participants investigate
Kusto Query Language (KQL) is how they filter, search, and analyze the data
KC7 Scoreboard tracks progress and validates their answers in real time
Built-in tutorials are woven directly into the scenario, teaching concepts exactly when they're needed
You don't need a cybersecurity background
The game teaches participants directly. KC7 scenarios assume zero prior knowledge. Early questions introduce the basics, later challenges build on those foundations, and your role is keeping people motivated rather than explaining technical concepts.
The story carries the engagement. Participants stay invested because they genuinely want to find out what happens next.
Hints are built into the platform. When someone gets stuck, the game offers progressive hints that guide them forward without giving away the answer. You don't need to debug their queries or explain log formats. The platform handles that.
KC7 runs from a 45-minute taster to a full-day workshop, played competitively, collaboratively, or learning-focused. See Pick a format to choose one.
Skills participants walk away with
Participants practice the same skills professional security analysts use day to day:
Log analysis — reading and interpreting security event data
Query writing — using KQL to search and filter large datasets
Pattern recognition — spotting anomalies that point to suspicious activity
Threat hunting — following evidence trails to uncover what happened
Critical thinking — making judgments under uncertainty with incomplete information
The thinking transfers beyond cybersecurity too: analyzing complex information, reasoning from evidence, and explaining technical findings in plain language.
Your first scenario: A Scandal in Valdoria
Every host's first event runs KC7's flagship scenario — a mysterious security incident in the Kingdom of Valdoria, layered with political intrigue and digital evidence. The questions ramp up gradually: early ones teach basic log analysis and querying, middle ones apply those skills to deeper investigations, and later ones ask participants to synthesize evidence and draw conclusions.
Most participants won't finish the entire scenario in a single session, and that's perfectly fine. Whether someone completes five questions or fifteen, they've had a meaningful learning experience. Everyone walks away having practiced real investigation skills, regardless of where they stop.
What you'll need to get started
For you:
A free KC7 account, which gets created automatically when you request your event
About 1 to 2 days for your event request to be approved
A venue — either a physical space or a virtual meeting platform
For your participants:
A computer with a modern browser (Chrome, Firefox, Edge, or Safari)
An internet connection
A willingness to try something new
If someone can browse the web, they can play KC7.
Start with one event and grow from there
Most hosts run their first event as a trial. Run a single event and stop, or build KC7 into an ongoing program. Your account supports both, and the tenant guide covers the platform once you want more.
Ready to host?
Last updated