Haiku, Inc.

Turning Training Into a Game

Haiku, Inc. turns cybersecurity training into a video game. Its products teach hands-on, real-world skills through browser-based games and simulated networks, aligned with the NICE Framework and certification pathways, for individuals, businesses, and schools alike. The gameplay applies learning-engineering techniques from Carnegie Mellon’s Human-Computer Interaction Institute, and for classrooms it comes packaged as a full course: 16 modules of interactive instruction, five skills-test modules, practice drills, and quizzes played as labs. The company reports a 24 percent boost in measured practical cybersecurity skills after about 70 minutes of play, from research with San Diego State University, and roughly a 70 percent increase in Linux skills after about seven hours.

I joined in July 2021 to lead a single game. Four years later, I was a co-founder.

From Developer Lead to Co-Founder

• July 2021, Software Developer Lead. I led World of Haiku from its first build to its Steam release, and kept music, UX/UI, illustration, writing, programming, 3D, VFX, and management working toward one product vision.
• February 2023, Director of Engineering. I brought Haiku Pro to production readiness, hired a brand-new team to build it, launched Forge, and moved World of Haiku to a web-based subscription.
• January 2024, VP of Engineering. I direct all product software engineering for every Haiku product, across onshore and offshore teams, and oversee the full development cycle. Along the way, Haiku earned its SOC 2 Type II attestation.
• August 2025, Co-founder.

What I Built There

Every product at Haiku grew out of the one before it. The game made a network into a place; the tools let anyone build those places; and HADES finally let the adversary in.

2021World of HaikuThe learner plays a simulated network

scale it

2023Haiku Pro + ForgeRanges and missions become content

flip it

2026HADESThe adversary plays your network

• World of Haiku. The game that started it all: real hacking tools inside a simulated Linux desktop.
• Forge and Haiku Pro. Missions anyone can build, and ranges on real machines. Both are below.
• KONA. The project manager that replaced Asana, Linear, and Notion inside Haiku, now offered to every organization on the platform.
• HADES. The game turned inside out: trained adversaries playing a digital twin of your network, its drones, and its satellites. I’m its sole inventor.
• Orca. An evidence-checking layer for AI answers, built to support HADES’s onboard autonomy work.
• The platform. The web platform the game is played on, with the LMS and the admin panel around it. More on that below.

Forge

Forge shipped on July 21, 2023. It lets players build, remix, and share missions with the full in-game toolset, published through Steam Workshop. In January 2024, it became scriptable with MiniScript Anvil, our own language: it started as MiniScript, and then we rebuilt much of the compiler around what Forge needed. That April, Forge connected to learning-management systems—today, missions export as SCORM packages—and in July 2024 it began defining networks and file systems as portable JSON. By December, it was a publishing platform for community missions. Those JSON networks later became the HADES schema.

Forge hands the people who write training the same world the game runs on. You build a network by dragging devices onto a grid, and the simulation handles the addressing—netmasks, IPs, MAC addresses, and NAT. Everything else is in the documentation, and it adds up to a lot:

• Devices worth breaking into. Each device gets its own users, operating system, open ports, network interfaces, and files. Set a root password and players can escalate with sudo—until they hit a file marked Immutable, which even root can’t touch. That one attribute is a whole category of privilege-escalation puzzle.
• A terminal that behaves like one. More than 50 emulated Linux and Windows commands, from the file system basics to nmap, ssh, hydra, sqlmap, dirb, tshark, iptables, John the Ripper, and the aircrack-ng suite, with wildcards, brace and parameter expansion, output redirection, and three styles of quoting.
• Missions written as scripts. A mission is a MiniScript Anvil program, and it ends when the script does. Authors wait for the player’s commands and the feedback they produce—a cracked hash, a failed SSH login, a 404 in the browser—chain them into sequences, mark goals complete, run fail timers, drop hints, and talk to the player through Nitro, the in-game messenger, in the voices of characters like Rascal and Gungnir. Bigger missions can be built as a graph and exported to Graphviz.
• Apps of your own. Console applications with their own commands and manual pages, and windowed apps built in a visual web editor.
• Websites inside the world. Pages hosted on in-game web servers, with forms and login pages for players to get past.
• Data for analysts. A Kusto Query Language engine we built by hand, running inside the game. The Data Explorer turns CSV files into tables to query with search, filters, calculated columns, aggregations, unions, and joins.
• Multiplayer. Password-protected rooms with shared or competitive goals, countdowns, and progress that survives a player leaving and coming back.
• Classrooms. Missions export to SCORM for any learning-management system, with hooks for bookmarks, scores, status, and recorded interactions, plus lesson data collection for surveys.

Haiku Pro

Where World of Haiku teaches through missions, Haiku Pro taught through ranges: hosted machines, mostly Kali Linux boxes, that you used right in the browser to work through realistic scenarios with real tools. As Director of Engineering, I brought the existing Haiku Pro assets to production and hired a brand-new team to build it.

Each range opened with staged goals—reconnaissance, say, then web application enumeration, then cracking a password from a low-privilege foothold—along with hints, an answer box, a countdown timer, and a score, next to a leaderboard and a dashboard.

Full size ⤢

Haiku’s range database tracked 104 ranges, more than 50 of them completed or released. Most were short labs of 15 to 100 minutes, rated Easy or Medium, and most were offensive. Others were defensive, forensic, or “mirror” ranges, where you exploit a vulnerability first, then switch sides to review the attack and patch it. Together they taught the stages of an attack on Linux and web targets:

• Recon and enumeration. Network and port scanning and service enumeration, mostly with nmap and netcat.
• Web applications. The OWASP Top Ten, from broken access control and injection to server-side request forgery, session management, and vulnerable components.
• Known vulnerabilities. Finding and adapting public exploits for content management systems and other services.
• Getting in and staying in. Password cracking and brute force, reverse shells, Linux privilege escalation, and covering your tracks.
• The rest. Binary exploitation and debugging with GDB, hardware signal analysis, firewall implementation, incident response, and forensics on packet captures and disk images.

The ranges were grouped into learning paths: preparation for the CEH and OSCP certifications, Web App Sec, Cybersecurity Analyst Basics, Linux Basics, Introduction to Ethical Hacker, Pentesting Basics, Incident Response, and SOC Analyst Basics. Haiku mapped the content to the NICE Framework’s task, knowledge, and skill statements, and issued skill badges through Badgr, each earned by completing at least one challenge that required that knowledge or skill. Seventeen ranges earned validated mappings, to roughly 80 statements and four work roles: Security Control Assessor, Cyber Operator, Vulnerability Assessment Analyst, and Cyber Defense Analyst.

The premium tier was about getting hired. Job Connect matched learners to jobs that needed the skills they had actually demonstrated, and the Haiku Skillz Résumé showed employers verified badges along with the learner’s own hands-on command history.

A May 2025 build folded Haiku Pro, Haiku Online, and the Admin Panel into one platform, and Haiku deprecated Haiku Pro in September 2025.

The Platform

Everything above lives on one web platform: where the game is played, where courses are built, and where an organization watches its people learn. I lead its engineering, it’s a team effort, and a good share of it is mine.

World of Haiku runs right in the browser, as a Brotli-compressed Unity WebGL build that talks to the page in both directions—the page can load a save or hand the game code to run, and the game reports progress and finished lessons back. In Forge mode, code from the game opens in an editor on the page itself.

Around the game sits the LMS. A learning path is chapters of steps: a range, a mission, a dojo, a Forge lesson, a video, a PDF, an article, or a quiz, each with a time estimate, a narrative, and a flag for whether it’s required, reordered by dragging. Quizzes mix single and multiple choice with short and long answers, in a fixed order, a random one, or drawn from a pool, with a review queue for answers that need a human. Finishing a path earns its badge, and challenges are tagged by specialty, difficulty, and duration, and mapped to NICE work roles and ENISA’s tasks and skills.

For an organization, it’s an admin panel. Workspaces have seats and dates; learners come in bulk, from a form or a CSV; learning paths are assigned to a workspace, with statistics on sessions, top learners, and time spent. Each organization can put its own name, logos, and colors on the platform, in light and dark, and gets its own public page, and product codes hand out access with a duration, a redemption cap, chosen learning paths, and a role. TrustNoOne lives here, too: a turn-based social-engineering game where players take roles from HR and the CEO to IT and the hacker, trading texts, calls, and emails, while departments see who stopped attacks, who missed them, and can nudge everyone who hasn’t finished their training.

What People Did With It

The awards are nice, but the part I care about is what people did once the game was in their hands.

A certificate built around the game. San Diego State University’s Cyber Tech Academy chose World of Haiku and Haiku Pro for its new Ethical Hacking in Cybersecurity Certificate, with Haiku Pro as the foundation of the course. The academy wanted something online and asynchronous that still gave students real guidance—and a way to predict cybersecurity success that it could show employers.

Cybersecurity is not visual. It’s hard to answer, ‘What is cybersecurity?’ World of Haiku provides that visualization.

— John Callahan, Director, Cyber Tech Academy, San Diego State University

Five hundred Girl Scouts. Since 2019, the San Diego Cyber Center of Excellence and Girl Scouts San Diego have run annual hands-on cybersecurity workshops with Haiku, for more than 500 Scouts from fourth grade through high school. They play World of Haiku and earn their Basics, Safeguards, and Investigator badges, and Haiku gives them free licenses so they can keep learning at home. The October 2025 workshop alone brought in 100 Scouts for three hours of badge sessions, led by twelve cybersecurity professionals.

My favorite part of the event was the World of Haiku game because it was fun.

— Junior Girl Scout, October 2025

A hackathon in Baltimore. In June 2025, Agile Care Enterprises and The Agility Network ran CyberQuest, their first youth cybersecurity hackathon, on Haiku’s capture-the-flag platform: eight students, ages 11 to 18, through eight increasingly advanced modules, from Linux navigation and network scanning to password cracking and forensics. Every one of them finished, many within 24 hours. An 11-year-old placed in the top three, and three of the students are now pursuing cybersecurity degrees or certifications. Agile Care plans to run it twice a year and take it across Baltimore’s public schools.

students finished every module

8 / 8

age of a top-three finisher

11

now pursuing cyber degrees or certifications

3

We were astounded by the depth and rigor of the platform.

— Tasha Sharif Vanzie, Chief Strategy Officer, Agile Care Enterprises

Three players.

Joshua A. was working an IT help desk and studying for Security+ when he found World of Haiku through its Steam trailer. He passed Security+ in July 2022, and with Haiku’s help landed a job as a SOC analyst. “You see! I’m starting to think like a hacker,” he told us.

John D., a Marine Corps veteran with two decades in aerospace and defense, finished World of Haiku alongside his EC-Council coursework, then passed the Certified Ethical Hacker exam on his first attempt with a 93.6 percent. “I get a visceral endorphin rush every time I achieve a goal,” he said.

And Julio G., a counselor in New York City, had given up on classroom and video courses that couldn’t hold his attention—until he found the game through Reddit, downloaded the Steam demo, and finally got a handle on Linux.

Who We’ve Worked With

Haiku’s training has reached Air Force squadrons, the Navy, the Marine Corps, two city governments, universities and community colleges, school districts from Pennsylvania to Florida, a health system, and a software company. Some of those relationships run for years; some were a trial that ended when priorities changed. This is the whole list, current and past.

Cyber Center of Excellence (CCOE) selected the Haiku Pro cybersecurity training tool for the San Diego Regional Cyber Lab because of its customizability and real-world cybersecurity simulations. Haiku Pro is designed by hackers, for hackers and is the cybersecurity equivalent of a flight simulator where users of all levels can develop real-world skills in a gamified virtual environment.

— Lisa Easterly, CEO, San Diego Cyber Center of Excellence

What Happened

World of Haiku won Fast Company’s 2023 Innovation by Design Award in the Security category, and Haiku ranked seventh on Fast Company’s 2025 list of the most innovative AR and VR companies. In 2024, Haiku was one of six winners, from over 230 entrants, of DARPA’s Building an Adaptive and Competitive Workforce tools competition, for 5G wireless training. A $1.8M AFWERX Phase II award funds advanced training paths for Airmen. The company holds a SOC 2 Type II attestation, and it reports about 40,000 users. Haiku products have reached 16 public-sector organizations—8 Department of War units, 3 federal and local agencies, and 5 schools—through use, evaluation, or licensed access.

DARPA tools winners, from 230+

1 of 6

Fast Company AR/VR, 2025

#7

Type II

SOC 2

public-sector organizations

16

2026 has been the busiest year yet. HADES is listed on the U.S. Army Air Marketplace. In August, I co-presented AI-driven cybersecurity training research with the Air Force Institute of Technology at DAFITC 2026. In October, the University of Dayton announced a two-year, $500,000 National Security Agency grant to build a K-12 curriculum that teaches AI literacy and cybersecurity through game-based scenarios, with Haiku as a named partner.

Players never play the game as designed. Neither does the adversary. At Haiku, I’ve gotten to build for both.