Spartan-Labs: the story behind our platform

The course that didn't want to be just another one

In 2023, I decided to launch the Professional Pentesting Course for Juniors. The CPPJ. And from day one, I was clear about what I did NOT want it to be.

I didn't want just another course solving open source labs. There are already hundreds of creators making free content about Juice Shop, DVWA, Metasploitable, and HackTheBox machines. They do an excellent job, and that's what they're there for. Adding another video solving the same thing brought nothing new to the community.

I wanted to build something different. A unique experience.

So I set up an environment from scratch: ten servers distributed across two subnets, each with multiple chained vulnerabilities, and all accessible from public IPs. No VPN. Breaking the classic isolated lab model where the student connects through a tunnel and attacks machines on a private network.

Why public IPs? Because the reality of a pentest doesn't look like a VPN. I wanted my students to face a scenario closer to what they'll encounter when they're up against real infrastructure.

The course worked. But while building it, I discovered something more important.

The graph paper

When I was in school, I had a friend who, for privacy reasons, I'll refer to as Brayan throughout this story. And between classes, we'd sit down and do something that seemed pointless at the time: we drew mazes on graph paper.

Brayan taught me. The rule was simple: you placed a starting point, a goal, and in between, every possible route. False paths. Traps. Real paths, but longer ones. Hidden shortcuts you'd only spot if you looked at the whole maze from above.

The hard part wasn't solving the maze. The hard part was designing it. You had to imagine every decision the person trying to cross it would make. You had to think like an attacker and a defender at the same time. You had to know which paths would tempt someone in a hurry, and which ones only a patient person would ever find.

I spent years doing that without thinking much of it.

Until 2023, when I was designing the vulnerable machines for CPPJ and realized I was doing the exact same thing. I thought of each vulnerability as a path. Each misconfiguration as a trap. Each pivot between subnets as a fork in the maze. What I had learned drawing on graph paper with Brayan had quietly become the way I understood offensive security.

That night I sat down and wrote an idea. It wasn't just another course. It was a platform. A place where I could design mazes nonstop, and where thousands of hackers could walk through them.

The impossible dream

The problem was that my expertise wasn't software development. I'm a hacker. I know how to break systems, not necessarily how to build them at scale.

What I was imagining was a lab management platform, automated cloud infrastructure, access control, isolated sessions per student, metrics, scalability. It was a full architecture project. And I wasn't an architect.

But that same year, two things happened that changed everything. We were selected for Platzi Startups, where I absorbed more knowledge about product building than I could have learned on my own in years. And shortly after, that step became the bridge that led us into the AWS Startups program.

Suddenly, the idea no longer seemed impossible. Just distant.

The search

I started looking for a development shop to build the first version for me. I sat down with several teams. With the first one I made the most progress with, something curious happened: they kept insisting on asking me what my budget was. And my logic was different: they were the experts, they should know how much what I was asking for would cost.

We didn't move forward. And I made a decision.

If nobody was going to build this up to the standard of my vision, I was going to do it myself. I started studying application development on AWS. Serverless. Cloud architecture. Design patterns. Distributed databases. Everything I needed so I wouldn't depend on anyone.

Time, as always, moved much faster than my plans. Between courses, events, conferences, and the daily operations of Spartan-Cybersecurity, months turned into years. But every free evening, every weekend, the platform kept taking shape.

Spartan-Labs

Today, in 2026, I can finally tell you about it.

Spartan-Labs is the platform where we're going to centralize all the hands-on labs and resources our students will need to hack. Every machine, every subnet, every vulnerability chain I design from now on will live there.

Since 2023, we've launched several courses, each with its own environments. From now on, they'll all converge into a single experience. The platform goes into production alongside the relaunch of the CPPJ the course that started it all.

If you were a CPPJ student in any of its previous editions, you'll notice the difference from day one. If you're new, you'll be stepping into something that no other pentesting course in the Spanish-speaking world offers today.

The maze keeps growing

Fourteen years ago, I had no idea that drawing mazes on graph paper with Brandon would define what I'd end up building. But that logic that way of thinking about paths, decisions, and traps is exactly what makes the experience of hacking on Spartan-Labs unique.

Every lab is a maze designed with intention. Every vulnerability is where it is for a reason. Every path that seems obvious is probably not the right one.

Spartan-Labs is now available. The maze has finally opened its doors, and there is no turning back. You can explore the platform, see how it works, and watch the full launch recording here: