2.3 Get to Know Platform Features
Before you start designing, understand your toolkit. Together with the milestone logic described in the previous section, it is essential to create an exercise that builds on platform potential. This section shows what the platform can do—you can choose any features that serve your learning objectives. The selection and combination of features is creative work.
Note
The next phase, Phase 03: Prepare, contains specific tutorials on how to implement these features in the platform.
What you will find in this section:
- Channels – Where content appears
- General Injects – Information and instructions, universal inject option
- Emails – Communication simulation
- Multimedia – Documents, pictures, audio and video
- Document Storage – Persistent materials for trainees
- Forms – Questions and responses
- Tools – Abstractions of real tools and processes
- Confirmation Buttons – Acknowledging actions
- Overlays – Attention management + timer
- Scoring – Transforms trainee actions into measurable performance data
Channels – Where content appears
Channels are spaces where different types of content appear in the platform. Every inject appears in exactly one channel. Understanding channels helps you organize your exercise and set trainee expectations.
There are two types of channels:
Default channels are connected to specific functionality:
- Email channel – for email conversations
- Exercise Information channel – universal channel for information and any type of media
- Questions channel – for forms and interactive inputs
- Tools channel – for tools inputs and outputs
- Commands channel – for logs of commands executed within a sandbox environment
Custom channels can be created for specialized content. These function like Exercise Information channels—they display text, documents, and media—but you name them to match your scenario. When you rename a channel and post specific content in it, it can serve as a website, intranet, social media feed, or anything else your scenario requires.
If your exercise features significant content from a specific source (government agency, news outlet, internal department), creating a dedicated channel helps trainees immediately understand the context. Messages in a channel named "National Cyber Authority" are instantly recognized as coming from that source.
You can rename any channel to match your exercise needs.
General Injects – Information and instructions
General injects are a versatile feature. You can use them for text, images, audio, video, or documents. However, this section focuses on text-based injects—other media types are covered below in Multimedia.
General injects are useful for providing task instructions, contextual information, organizational details, insights, theory, or feedback. We typically use them for exercise introductions and conclusions as well.
General injects can be displayed in the Exercise Information channel or in any custom channel you create.
When no content is defined the behaviour changes – it is a specific feature, described in the Prepare phase.
Emails – Communication simulation
Emails work the same way as emails in the real world, except you don't use actual email infrastructure. Emails are displayed in a dedicated email channel. You send and receive emails only within the IXP environment. You can create any address you want for your exercise—trainees may receive emails from many different people or organizations with different communication styles.
Emails are usually sent automatically when specific milestones are activated. You can also include instructors in the communication loop—they can respond in their own words or select from predefined templates. Templates ease replying to emails for instructors; you can predefine answers for expected conversations with some email entity. Instructors can use and modify templates while replying to trainees. These templates can also be used for confirming reaching a milestone.
We received feedback from trainees who weren't sure if in-game emails were legitimate or phishing attempts (understandable in cybersecurity exercises where vigilance is encouraged). We added email certificates as a UI feature to help trainees distinguish trusted emails from in-exercise phishing or malicious mails.
Multimedia – Documents, pictures, audio and video
Multimedia injects deliver documents, images, audio, or video content. Use them for reports, analysis, briefings, internal procedures, or any information that enriches scenario context. Documents can also serve as tasks or frameworks that subsequent injects build upon.
Where multimedia appears: Multimedia can be displayed in the Exercise Information channel, in any custom channel you create, attached to emails, or as output from tools.
Document Storage – Persistent materials for trainees
The platform includes a storage feature—a space where you can upload documents and files that trainees might need throughout the exercise. Think of it as a SharePoint or internal wiki. Examples include internal policies, incident handling guides, or reference materials.
Important: Storage is a read-only repository of documents accessible to trainees from the beginning through the end of the exercise. It's not for collecting trainee outputs or submissions.
Forms – Questions and responses
Forms are interactive injects that collect input from trainees. They appear in the dedicated channel for questionnaires. You have several options:
Closed Questionnaires and Scales – Standard questionnaires with single-choice or multiple-choice options. Can also function as rating scales. Typical uses: assessing situation severity, rating probability or likelihood, answering factual questions about the scenario (legal, organizational, technical aspects, authority, etc.), checking understanding, etc.
Questionnaires Enhanced with Conditionals – When you connect questionnaire responses to milestones, questionnaires can function as decision points. The difference: some answer choices can trigger automatic platform responses. Example: "Do you want to communicate the situation publicly?" Options: Yes/No. If "No" is selected → Platform responds with an email from a curious journalist who learned about the situation, arriving within minutes.
Free Form Responses – Open-ended questions where trainees respond with free text. The prompt can be text, image, or video. Trainees answer in their own words. Typical uses: requesting arguments, summaries, situation assessments, analysis, reflections, etc. See Section 2.5 Experience Enhancement for tips on designing effective free-form structures.
Tools – Abstractions of real tools and processes
Tools are abstractions of real systems or processes – INJECT does not connect to any services outside the platform. Tools are one of INJECT's unique features for tabletop exercises. The tool activation is simple, but its impact on the scenario can feel as real as if the actual process or technology usage happened. In other words, trainees focus on WHEN and WHY to act.
Tools can be triggered by buttons or require specific arguments trainees discover during the exercise—meaning they can't use the tool at the beginning without proper context.
Tool output always displays in the Tools channel and can take various forms: text confirmations, pictures (like screenshots or reports from real tools), multimedia or documents.
Some examples:
- Block IP Address
- Network Traffic Analysis
- Malware/Antivirus Scan
- DNS Lookup
- Backup System Check
- Update Management
- Organization-Wide User Warning
- Report Incident to Authority
- Issue Press Release
- Activate Crisis Team
- Contact Database
As a designer, you define tool outputs and their consequences. For example, when trainees block an IP address, the tool confirms the action AND activates a milestone that triggers a complaint email from an angry user whose system was affected. In other words, tool usage can be tracked via milestones.
Confirmation Buttons – Acknowledging actions
Confirmation buttons are the simplest way to mark activities complete. Essentially, it's an instruction paired with a confirmation button. Trainees click to acknowledge they've finished something. A button (labeled "Analyzed," "Done," "Continue," "Acknowledged," "Completed," etc.—you can choose your own caption). The platform records the click and can trigger the next element by activating a related milestone.
Sometimes exercises benefit greatly from including learning activities that are not easy to log in the platform—like activities outside the platform. This expands your creative possibilities for designing engaging scenarios.
Examples:
- "Discuss what three action steps you could implement this month in your organization. When you're done, click the button."
- "Trainees analyze a document and you want them to mark when they've finished the analysis."
- "Go verify your solution with the subject matter expert, then continue."
- Simply discuss something, give consent, or acknowledge—anything you can imagine.
Don't overuse this element: if everything is just "click to continue," trainees will click without thinking. Also, if the activity happens outside the platform, think about whether you need to plan some form of evaluation.
Overlays – Attention management + timer
Think of overlays as spotlight moments in your exercise. They say "stop everything and pay attention to this." Technically, an overlay is an interface element that directly influences exercise dynamics. It appears over all other content, inject appears centered and prominent. The overlay can also include a timer. Trainees must interact with it before continuing.
While a questionnaire would normally display in its preset channel, when set as an overlay, it appears above everything else—the rest of the interface darkens and the inject displays in the center of the screen. This interrupts trainees' current activity and captures their attention.
Overlays create interruption. Use interruption purposefully. Typical uses are:
- Hints and warnings – When trainees need correction or guidance.
- Feedback – Confirming actions or redirecting behavior.
- Exceptional events – Major scenario developments that change everything.
- Step-by-step activities – Some designers use overlays to create tutorials or guided experiences.
- Version with timer – Has specific use-cases; in general they are about creating a sense of urgency.
Discussion-based exercises may even consist entirely of injects presented through overlays, creating a structured, guided experience. However, their overuse reduces impact. Generally, overlays should be the seasoning of your exercise, not the main ingredient.
Always test the final impression and impact of your overlays. What feels dramatic on paper might feel annoying in practice, or vice versa.
Scoring – Measurable performance data
Scoring transforms trainee actions into measurable performance data. Why does it matter?
- It gives you quantifiable assessment alongside qualitative observation.
- It creates accountability—trainees know their actions matter and are being measured.
- It enables comparison across teams, helping you identify which groups excelled and which struggled.
- It provides data for post-exercise analysis, showing exactly where teams succeeded or failed.
- It offers trainees immediate feedback on their performance.
The platform assigns points to trainee actions through two mechanisms:
Pre-designed scoring automatically connects points to milestones during exercise design.
When you create a Learning Activity (LA), you connect it to a milestone.
When trainees activate that milestone, they earn the associated points.
For example, the LA "Report incident to CISO" connects to milestone ciso_notified worth
2 points.
When trainees send the notification email, they activate the milestone and earn 2 points.
Ad-hoc scoring allows instructors to award additional points during the exercise. When instructors evaluate emails or free-form responses, they can assign extra points based on quality. A team that sends a thorough incident report might earn the base 2 points automatically, plus 2 bonus points from the instructor for exceptional detail.
The Performance Overview feature is described in the Reflection phase.