Introduction

Cybersecurity often mirrors the ocean—calm on the surface but hidden threats lurk beneath. Varonis Threat Labs researchers Doron Kapah and Mark Vaitsman turned this metaphor into reality with Breach at the Beach, a unique Entra ID Capture the Flag (CTF) experience that immerses defenders in realistic data‑exfiltration scenarios.

Why Entra ID Matters

Entra ID is more than an identity provider; it serves as the control plane for an entire enterprise, linking users, applications, permissions, automation, and increasingly AI‑powered workflows. The surge of non‑human identities—AI agents, service principals, automated bots—has reshaped what a compromise looks like. As Vaitsman notes, “In today’s AI era, a breach in Entra can let a threat actor pivot to a non‑human identity, turning the attack into a stealthy, scalable data exfiltration effort.”

Challenges Grounded in Real Cases

The techniques embedded in the CTF are not hypothetical. Kapah and Vaitsman have witnessed these attack patterns directly in customer environments, making each challenge a reflection of today’s frontline threats. “Non‑human identities are outgrowing human ones, expanding the attack surface,” Kapah explains, underscoring the urgent need for defenders to monitor AI‑driven entities as closely as traditional accounts.

Hands‑On Learning Over Theory

Vaitsman stresses that “reading is not enough; you must be at the keyboard, clicking, and seeing how things work.” Participants navigate raw Entra logs, filter noise, and trace attacker footprints without the aid of large language models (LLMs). By deliberately removing AI assistance, the CTF forces learners to internalize detection techniques rather than shortcut them.

Designed for All Security Roles

Whether you are on a red team, blue team, or serve as a CISO, the experience is built to be universally valuable. “You cannot be an effective red‑teamer without blue‑team insight, and a good CISO must understand the attacker’s perspective,” Vaitsman says. Kapah adds that many professionals have limited exposure to audit logs from AI‑centric services like Dataverse or Copilot, and the CTF bridges that knowledge gap.

How to Participate and What’s in It for You

Breach at the Beach is completely free and can be played online at breachatthebeach.com. Participants gain hands‑on skills, a deeper appreciation of identity hygiene, and the opportunity to earn Continuing Professional Education (CPE) credits. Varonis aims to raise awareness of AI‑driven identity risks and equip the security community with practical, battle‑tested techniques to defend modern Entra ID environments.