Truffle Camp

Can a new AE, SDR, SA, or partner explain detection versus verification, and practice a handoff, before they ride along on a live deal?

Try one example: First Expedition: separate a finding from verification

Synthetic walkthrough

Independent practice exercise with fictional evidence. No credential is provided or checked. Progress stays in this page session; this is not an employer course or certification.

Step 1 of 4

Understand the scenario

A synthetic GitHub token is described as appearing in a public commit. No token value is shown. The goal is to explain what is observed and what still needs review.

Built with

Confirmed in the repository that renders this page. Planned tools stay in the case study and are not shown as logos.

What was used in the field

Discovery frameworks, onboarding material, industry training, and playbooks that teams used.

What is not built

Truffle Camp: Trailhead, one Dig Site mission, Verification Lab, Risk Room, Handoff Desk, and a Field Brief. Curriculum designed. No public repository.

Where it stands

Designed, with a sample module on this page. The Darktrace ramp result belongs to the training I created there, not to Camp.

The First Expedition write-up and one synthetic knowledge check on the case study. Teams have used discovery frameworks, playbooks, and Darktrace industry training. Those are not a course app.

Sample module

First Expedition — accidental commit

A learner journey for the designed Truffle Camp curriculum. Not a live course, and not the onboarding assets teams already use.

Who it is for: A new AE or SDR. An SA or partner can take the same mission with a harder handoff.
Path: Trailhead (the secret lifecycle) → Dig Site (one synthetic finding) → explain it to a Head of AppSec → manager check.
Product concepts: Detection versus verification, who owns the repo, and what “not evaluated” means. No live secret and no live provider call.
Practice scenario: A synthetic GitHub token shows up in a public commit. The learner says what was observed, what is still unknown, and the next step. They do not paste a real credential.
How a manager scores it: Ready if the learner names the lifecycle step, refuses to call an unreviewed detector a gap, and writes a next step. Speed does not count.

The Darktrace training and the Truffle onboarding resource are field work. Truffle Camp is the later design. Camp has no learner data.

Explore related work

Back to all projects