Teach Me to Think Like an Operator

Zoom image will be displayed

By John O’Boyle, Ashwin Wariar, Noah Alexander, Franco Garcia, Sophia Martinez, and Jude Canady

When we began building PhantomShift, our focus was on reducing friction during live red team operations. We wanted a system that could observe terminal activity, understand what had already been done, and suggest useful, structured next steps — without requiring constant context switching between notes, tools, and outdated playbooks.

But in sharing early demos and talking with interested folks in the security community, another use case started to surface: training. Specifically, the idea that PhantomShift could help support the development of new operators who are still learning to think tactically under pressure. We didn’t build it as a training platform — but we’re starting to believe it could play a valuable role in that space.

Most red team training environments fall into two categories: guided labs and capture-the-flag style exercises. In the first, you’re walked step-by-step through a predefined scenario with limited deviation. In the second, you’re dropped into a vulnerable box and told to find the flags.

These models are effective at introducing tools and techniques. They teach the “what” — what commands to run, what vulnerabilities to look for, what tool to reach for in a given phase. But they often skip the “when” and the “why.” There’s little focus on decision-making, sequencing, or adapting to unexpected results in real-time.

Once operators step outside the bounds of structured challenges, many realize how little training time was spent building actual operational judgment. The question isn’t just what you can do — it’s what you should do next, and why.

PhantomShift isn’t a tutor and it doesn’t hand out answers or walk you through a lesson plan. Instead, it sits beside you during a live engagement, observing your shell, capturing your session history, and offering next-step recommendations based on what’s actually happening in your environment.

This makes it feel less like a classroom assistant and more like a sparring partner. It doesn’t take control — it pushes back. It suggests options, explains rationale, and lets you decide what path to take next. Because PhantomShift understands your terminal state, it can offer context-aware recommendations that are grounded in what you’ve already done and what phase you’re likely in. It doesn’t repeat the top 10 escalation tactics. It surfaces what makes sense now.

Every PhantomShift suggestion is structured in the same way, designed for clarity and fast triage. Each includes:

• A proposed shell command tailored to your current phase
• An explanation of its purpose
• A summary of potential impacts, such as noise, instability, or alert triggers
• Key indicators to watch for in the output
• A basic risk assessment and operational context

While this structure was originally meant to reduce friction during real ops, it also creates a valuable training layer. Newer operators aren’t just seeing what they could do — they’re seeing why a particular move makes sense in the current context, what the tradeoffs are, and how it fits into the flow of a live engagement. Over time, these suggestions help reinforce good habits. They model the kinds of questions experienced operators ask themselves instinctively: “Have I already enumerated this vector?” “Am I risking detection if I launch this?” “What does this tool’s output actually tell me?”

We’re careful not to position PhantomShift as a way to bypass skill-building. You still need to assess the situation, read the output, and make decisions. But it does create tighter feedback loops — especially valuable in environments where mentorship is limited or slow. PhantomShift encourages critical thinking by showing reasoning alongside its suggestions. It doesn’t replace real-world experience, but it can simulate aspects of it in a way that scales — surfacing next steps and consequences in the moment they matter most.

PhantomShift is still early as a research prototype. But the potential to embed this kind of system in cybersecurity training — CTF prep, university labs, onboarding environments — is something we’re taking seriously.

We’ve spoken with team leads who want a way to show not just how to run a tool, but how to think like an operator. PhantomShift isn’t the whole solution, but it might be one piece of the puzzle: a system that makes learning tactical decision-making a little less abstract.

🧠 How it works under the hood
📬 Check us out here!

If you’re working on red team education, cybersecurity training, or just care about building the next generation of operators — we’d love your feedback.