Hands-on Training Goes Beyond Attacking — Learning Design in the CODE BLUE 2026 Programme
On 19 October 2026, the CODE BLUE organising committee published the full programme for CODE BLUE 2026 in Tokyo in November. Hands-on training extends beyond advanced offensive techniques to detection, forensics, threat hunting, blue-team operations and AI agents for application security.
Five training courses and practical activities
The official site lists five courses from 11 to 15 November as confirmed and open: advanced Windows exploit development; detection engineering and threat hunting; browser forensics and AI-assisted investigation; building AI agents for AppSec; and modern defensive operations. Availability can change, so applicants should check the live status on the official site.
The conference on 17 and 18 November also plans practical villages covering space, healthcare, automotive and critical infrastructure, together with CTFs, an incident response competition and an introductory threat intelligence workshop. The published deadlines are 8 November for training and 10 November for conference advance registration.
Why this matters to Cyber Hiroshima
When using SudoRange, the number and difficulty of labs matter less than a clear statement of which action and judgement each role is practising. CODE BLUE offers a useful example of presenting red-team, blue-team, DFIR, development and AI practice as distinct purposes. It does not imply a partnership with Cyber Hiroshima or access to the same course material.
How exercises could be connected
- Use a CyBOK Knowledge Area as the starting point, then state whether the learner will practise attack, detection, investigation or recovery.
- For AI-enabled tasks, assess input data, evidence, correction of errors and human accountability as well as output quality.
- After the exercise, ask learners to justify decisions from logs or evidence and point them to the next source and lab.
One incident can be revisited from the perspectives of an attacker, a SOC analyst, an investigator and a decision-maker. That sequence can turn an isolated practical task into a continuing learning route.
Next to read
Practise Cybersecurity with SudoRange