Operation Gilt Doctrine

The Story

Can your team prove what happened?

Wrenford Bank has been breached. What initially looks like a contained compromise soon raises a much bigger question: which payments can the bank still trust?

Red Team recreates the attack inside a controlled environment, while Blue Team investigates the real incident using the evidence left behind. If they cannot piece together what happened, Wrenford will activate Gilt Doctrine, an emergency protocol that freezes selected high-value payments to contain the threat.

The problem? Freezing those payments could disrupt payroll, supplier payments, and treasury operations across Wrenford's enterprise customers.

Wrenford Bank cyber incident investigation

Build Your Skills

Build skills across the full attack lifecycle

Operation Gilt Doctrine gives security teams a realistic environment to practise the technical and investigative skills needed to respond to a modern financial breach.

Offensive perspective

Red Team

Players take the attacker's perspective and work through the operation by identifying weaknesses, chaining attack paths, and exploring how technical access can lead to business impact.

✓

Web & application security

Identify and investigate weaknesses in exposed applications and services.

✓

Adversary emulation

Recreate realistic attack paths to understand how attackers move through an environment.

✓

Identity & privilege

Investigate compromised identities, permissions, and access to sensitive systems.

✓

Network security

Analyse network activity to identify suspicious behaviour and trace attacker movement.

✓

Business logic security

Identify weaknesses in how applications and processes handle critical business operations.

Will there still be exclusive content releases on HTB Enterprise Platform?

Instead of releasing monthly exclusive Machines, Sherlocks, and Challenges, we are introducing Campaigns. Still exclusive to organizations but wrapped around a story.

The goal is to help your team increase engagement by discussing scenarios, comparing findings, and building cross-functional awareness.

Do I need a separate subscription for this?

No, this is regularly released scenarios for all organizations on HTB Enterprise.

Can I explore content independently, or must an admin assign it?

Yes, you can. Either your admin will assign the released scenarios to a space, or you can access the announced scenarios of Operation Red Horizon through the HTB Enterprise Content Library.

The Operation Gilt Doctrine Glossary

Wrenford Bank: The fictional bank.

Gilt Doctrine: Wrenford's emergency protocol for freezing selected high-value payments when approval evidence can no longer be trusted.

Payment Callback: A message from a payment provider that tells the bank whether a payment has succeeded, failed, or changed status.

Reconciliation: The process of checking whether the bank's payment records match provider records and ledger entries.

Ledger Integrity: The bank's ability to prove that a payment instruction, its approval, and its final status all belong to the same real transaction.