System and method for the secure evaluation of cyber detection products

A system for secure evaluation of cybersecurity tools is disclosed, comprising:

• a computing device comprising a memory and a processor;
• a sandbox environment manager comprising a first plurality of programming instructions stored in the memory and operating on the processor, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to:
• receive a configuration for a virtual computer network, the virtual computer network representing an actual computer network of a client and comprising one or more virtual domain controllers, one or more member servers, one or more endpoint machines, and a first set of cybersecurity defense tools operating on the client's actual computer network;
• create a first sandbox environment for the testing of the virtual computer network, wherein the sandbox environment is provided with a set of controlled computing resources of the computing device for its operation and is prevented from accessing any other computing resources of the computing device;
• and
• create an observed system within the sandbox environment, the observed system comprising compartmentalized instance of the virtual computer network as a second sandbox within the first sandbox, a second set of cybersecurity defense tools for testing against the first set of cybersecurity defense tools, and one or more instances of malware;
• create a secure tunnel from the observed system to the client's actual computer network for the client to observe testing of the first set of cybersecurity defense tools and the second set of cybersecurity defense tools on the observed system;
• and
• an observed system manager comprising a second plurality of programming instructions stored in the memory and operating on the processor, wherein the second plurality of programming instructions, when operating on the processor, cause the computing device to:
• operate the observed system as an instance of the virtual computer network;
• initiate the one or more instances of malware on the observed system;
• apply the first set of cybersecurity defense tools against the malware and return a first set of results to the client via the secure tunnel;
• and
• apply the second set of cybersecurity defense tools against the malware and return a second set of results to the client via the secure tunnel.