This phase develops operational Blue Team capabilities, equipping trainees to function effectively within real-world security operations environments. Trainees operate within SOC workflows, triage alerts efficiently, investigate phishing campaigns, write and tune detection rules, and execute the full Incident Response lifecycle. They also conduct Windows, Linux, and network forensics, perform memory analysis, triage malware, run hypothesis-driven threat hunts, detect Active Directory abuse, and investigate hybrid cloud compromise — with AI integrated throughout. The phase culminates in a full hybrid Blue Team simulation, delivering a comprehensive incident response report with timeline reconstruction, root cause analysis, and detection improvement recommendations.