diff --git a/scenarios/ctf/access_can_roll.xml b/scenarios/ctf/access_can_roll.xml
index fa122c34c..b1977ef0c 100644
--- a/scenarios/ctf/access_can_roll.xml
+++ b/scenarios/ctf/access_can_roll.xml
@@ -34,7 +34,7 @@ Your password on both systems is: tiaspbiqe2r
     <keyword>setuid/setgid</keyword>
     <keyword>Hardlink protections</keyword>
   </CyBOK>
-  <CyBOK KA="C" topic="Public-Key Cryptography">
+  <CyBOK KA="AC" topic="Public-Key Cryptography">
     <keyword>public-key signatures</keyword>
   </CyBOK>
 
diff --git a/scenarios/ctf/analyse_this.xml b/scenarios/ctf/analyse_this.xml
index 6e4ec1c22..231b2ff15 100644
--- a/scenarios/ctf/analyse_this.xml
+++ b/scenarios/ctf/analyse_this.xml
@@ -20,7 +20,7 @@
   <CyBOK KA="F" topic="Artifact Analysis">
     <keyword>Encoding and alternative data formats</keyword>
   </CyBOK>
-  <CyBOK KA="C" topic="Symmetric Cryptography">
+  <CyBOK KA="AC" topic="Symmetric Cryptography">
     <keyword>symmetric encryption and authentication</keyword>
   </CyBOK>
   <!-- pcap -->
diff --git a/scenarios/ctf/encoding_challenges.xml b/scenarios/ctf/encoding_challenges.xml
index a6a9cf850..78040c156 100644
--- a/scenarios/ctf/encoding_challenges.xml
+++ b/scenarios/ctf/encoding_challenges.xml
@@ -15,10 +15,10 @@
   <type>crypto-ctf</type>
   <difficulty>easy</difficulty>
 
-  <CyBOK KA="C" topic="Symmetric Cryptography">
+  <CyBOK KA="AC" topic="Symmetric Cryptography">
     <keyword>symmetric encryption and authentication</keyword>
   </CyBOK>
-  <CyBOK KA="C" topic="Public-Key Cryptography">
+  <CyBOK KA="AC" topic="Public-Key Cryptography">
     <keyword>public-key encryption</keyword>
   </CyBOK>
   <CyBOK KA="AAA" topic="Authentication">
diff --git a/scenarios/ctf/feeling_blu.xml b/scenarios/ctf/feeling_blu.xml
index 91f135042..ffe06d80d 100644
--- a/scenarios/ctf/feeling_blu.xml
+++ b/scenarios/ctf/feeling_blu.xml
@@ -59,7 +59,7 @@
   </CyBOK>
 
   <!-- decrypt zip file -->
-  <CyBOK KA="C" topic="Symmetric Cryptography">
+  <CyBOK KA="AC" topic="Symmetric Cryptography">
     <keyword>symmetric encryption and authentication</keyword>
   </CyBOK>
   <CyBOK KA="AAA" topic="Authentication">
diff --git a/scenarios/ctf/ff_decode_me.xml b/scenarios/ctf/ff_decode_me.xml
index 14383fe5c..f71c13862 100644
--- a/scenarios/ctf/ff_decode_me.xml
+++ b/scenarios/ctf/ff_decode_me.xml
@@ -15,7 +15,7 @@
   <type>pwn-ctf</type>
   <difficulty>intermediate</difficulty>
 
-  <CyBOK KA="C" topic="Symmetric Cryptography">
+  <CyBOK KA="AC" topic="Symmetric Cryptography">
     <keyword>symmetric encryption and authentication</keyword>
   </CyBOK>
   <CyBOK KA="F" topic="Artifact Analysis">
diff --git a/scenarios/ctf/ff_hackme_corp.xml b/scenarios/ctf/ff_hackme_corp.xml
index 7da224a23..5a5629b5d 100644
--- a/scenarios/ctf/ff_hackme_corp.xml
+++ b/scenarios/ctf/ff_hackme_corp.xml
@@ -18,7 +18,7 @@ Happy hacking!
   <type>pwn-ctf</type>
   <difficulty>easy</difficulty>
 
-  <CyBOK KA="C" topic="Symmetric Cryptography">
+  <CyBOK KA="AC" topic="Symmetric Cryptography">
     <keyword>symmetric encryption and authentication</keyword>
   </CyBOK>
   <CyBOK KA="F" topic="Artifact Analysis">
diff --git a/scenarios/ctf/ff_in_the_wild.xml b/scenarios/ctf/ff_in_the_wild.xml
index 80306e5dd..cc16026a4 100644
--- a/scenarios/ctf/ff_in_the_wild.xml
+++ b/scenarios/ctf/ff_in_the_wild.xml
@@ -15,7 +15,7 @@
   <type>pwn-ctf</type>
   <difficulty>intermediate</difficulty>
 
-  <CyBOK KA="C" topic="Symmetric Cryptography">
+  <CyBOK KA="AC" topic="Symmetric Cryptography">
     <keyword>symmetric encryption and authentication</keyword>
   </CyBOK>
   <CyBOK KA="F" topic="Artifact Analysis">
diff --git a/scenarios/ctf/flawed_fortress.xml b/scenarios/ctf/flawed_fortress.xml
index c11933bb6..b9c7b6ac5 100644
--- a/scenarios/ctf/flawed_fortress.xml
+++ b/scenarios/ctf/flawed_fortress.xml
@@ -17,7 +17,7 @@
   <type>pwn-ctf</type>
   <difficulty>intermediate</difficulty>
 
-  <CyBOK KA="C" topic="Symmetric Cryptography">
+  <CyBOK KA="AC" topic="Symmetric Cryptography">
     <keyword>symmetric encryption and authentication</keyword>
   </CyBOK>
   <CyBOK KA="F" topic="Artifact Analysis">
diff --git a/scenarios/ctf/nw_cyber_games.xml b/scenarios/ctf/nw_cyber_games.xml
index a169fb888..e0b5ada19 100644
--- a/scenarios/ctf/nw_cyber_games.xml
+++ b/scenarios/ctf/nw_cyber_games.xml
@@ -15,7 +15,7 @@
   <type>web-hints</type>
   <difficulty>easy</difficulty>
 
-  <CyBOK KA="C" topic="Symmetric Cryptography">
+  <CyBOK KA="AC" topic="Symmetric Cryptography">
     <keyword>symmetric encryption and authentication</keyword>
   </CyBOK>
   <CyBOK KA="AAA" topic="Authentication">
diff --git a/scenarios/ctf/performance_peril.xml b/scenarios/ctf/performance_peril.xml
index 76d3aecc9..a761b1c48 100644
--- a/scenarios/ctf/performance_peril.xml
+++ b/scenarios/ctf/performance_peril.xml
@@ -37,7 +37,7 @@
     <CyBOK KA="F" topic="Artifact Analysis">
         <keyword>Encoding and alternative data formats</keyword>
     </CyBOK>
-    <CyBOK KA="C" topic="Symmetric Cryptography">
+    <CyBOK KA="AC" topic="Symmetric Cryptography">
         <keyword>symmetric encryption and authentication</keyword>
     </CyBOK>
 
diff --git a/scenarios/ctf/post_it.xml b/scenarios/ctf/post_it.xml
index d01935a15..6c0757ec0 100644
--- a/scenarios/ctf/post_it.xml
+++ b/scenarios/ctf/post_it.xml
@@ -39,7 +39,7 @@
     <keyword>Post-exploitation: pivoting attacks, information gathering</keyword>
   </CyBOK>
   <!-- decrypt zip file -->
-  <CyBOK KA="C" topic="Symmetric Cryptography">
+  <CyBOK KA="AC" topic="Symmetric Cryptography">
     <keyword>symmetric encryption and authentication</keyword>
   </CyBOK>
   <CyBOK KA="AAA" topic="Authentication">
diff --git a/scenarios/ctf/rooting_for_a_win.xml b/scenarios/ctf/rooting_for_a_win.xml
index 6b9eab529..b269cd04f 100644
--- a/scenarios/ctf/rooting_for_a_win.xml
+++ b/scenarios/ctf/rooting_for_a_win.xml
@@ -35,7 +35,7 @@
   <CyBOK KA="F" topic="Artifact Analysis">
     <keyword>Encoding and alternative data formats</keyword>
   </CyBOK>
-  <CyBOK KA="C" topic="Symmetric Cryptography">
+  <CyBOK KA="AC" topic="Symmetric Cryptography">
     <keyword>symmetric encryption and authentication</keyword>
   </CyBOK>
 
diff --git a/scenarios/ctf/time_to_patch.xml b/scenarios/ctf/time_to_patch.xml
index bc984921e..c003fe678 100644
--- a/scenarios/ctf/time_to_patch.xml
+++ b/scenarios/ctf/time_to_patch.xml
@@ -63,7 +63,7 @@
   </CyBOK>
 
   <!-- decrypt zip file -->
-  <CyBOK KA="C" topic="Symmetric Cryptography">
+  <CyBOK KA="AC" topic="Symmetric Cryptography">
     <keyword>symmetric encryption and authentication</keyword>
   </CyBOK>
   <CyBOK KA="AAA" topic="Authentication">
diff --git a/scenarios/examples/cybok_example.xml b/scenarios/examples/cybok_example.xml
index 94b25e03d..643f0b4c5 100644
--- a/scenarios/examples/cybok_example.xml
+++ b/scenarios/examples/cybok_example.xml
@@ -21,7 +21,7 @@
 		<keyword>ACCESS CONTROL - DAC (DISCRETIONARY ACCESS CONTROL)</keyword>
 		<keyword>Unix File Permissions</keyword>
 	</CyBOK>
-	<CyBOK KA="C" topic="Cryptography">
+	<CyBOK KA="AC" topic="Cryptography">
 		<keyword>stream ciphers</keyword>
 		<keyword>substitution ciphers</keyword>
 	</CyBOK>
diff --git a/scenarios/labs/cyber_security_landscape/3_phishing.xml b/scenarios/labs/cyber_security_landscape/3_phishing.xml
index e09a8222d..fe1ee9fc6 100644
--- a/scenarios/labs/cyber_security_landscape/3_phishing.xml
+++ b/scenarios/labs/cyber_security_landscape/3_phishing.xml
@@ -29,7 +29,12 @@
     <keyword>MALCODE/MALWARE - SOCIAL ENGINEERING - BAITING</keyword>
     <keyword>MALCODE/MALWARE - SOCIAL ENGINEERING - PRETEXTING</keyword>
     <keyword>MALCODE/MALWARE - VIRUSES - COUNTERMEASUMALCODE/MALWARE - VIRUSES - MACRO VIRUSES</keyword>
-    <keyword>MALCODE/MALWARE - SPAM . . . . .MALCODE/MALWARE - SPOOFING</keyword>
+    <keyword>MALCODE/MALWARE - SPAM</keyword>
+    <keyword>MALCODE/MALWARE - SPOOFING</keyword>
+  </CyBOK>
+  <CyBOK KA="WAM" topic="Client-Side Vulnerabilities and Mitigations">
+    <keyword>E-MAIL - PHISHING</keyword>
+    <keyword>E-MAIL - SPOOFING</keyword>
   </CyBOK>
 
   <system>
diff --git a/scenarios/labs/cyber_security_landscape/4_encoding_encryption.xml b/scenarios/labs/cyber_security_landscape/4_encoding_encryption.xml
index b9174c640..af3483a5a 100644
--- a/scenarios/labs/cyber_security_landscape/4_encoding_encryption.xml
+++ b/scenarios/labs/cyber_security_landscape/4_encoding_encryption.xml
@@ -31,6 +31,10 @@
   <CyBOK KA="F" topic="Artifact Analysis">
     <keyword>Encoding and alternative data formats</keyword>
   </CyBOK>
+  <CyBOK KA="WAM" topic="Fundamental Concepts and Approaches">
+    <keyword>ENCODING</keyword>
+    <keyword>BASE64</keyword>
+  </CyBOK>
 
   <system>
     <system_name>desktop</system_name>
diff --git a/scenarios/labs/cyber_security_landscape/6_symmetric_enc_aes.xml b/scenarios/labs/cyber_security_landscape/6_symmetric_enc_aes.xml
index ed9a2d725..b164a0ce5 100644
--- a/scenarios/labs/cyber_security_landscape/6_symmetric_enc_aes.xml
+++ b/scenarios/labs/cyber_security_landscape/6_symmetric_enc_aes.xml
@@ -19,6 +19,20 @@
   <type>lab-sheet</type>
   <difficulty>intermediate</difficulty>
 
+  <CyBOK KA="AC" topic="Algorithms, Schemes and Protocols">
+    <keyword>ADVANCED ENCRYPTION STANDARD (AES)</keyword>
+    <keyword>ECB (ELECTRONIC CODE BOOK) BLOCK CIPHER MODE</keyword>
+  </CyBOK>
+  <CyBOK KA="AC" topic="Symmetric Cryptography">
+    <keyword>symmetric primitives</keyword>
+    <keyword>symmetric encryption and authentication</keyword>
+  </CyBOK>
+  <CyBOK KA="AC" topic="Cryptographic Implementation">
+    <keyword>Cryptographic Libraries</keyword>
+    <keyword>ENCRYPTION - TOOLS</keyword>
+  </CyBOK>
+  
+
   <system>
     <system_name>desktop</system_name>
     <base distro="Debian 10" type="desktop" name="KDE"/>
diff --git a/scenarios/labs/cyber_security_landscape/7_asymmetric_enc_rsa.xml b/scenarios/labs/cyber_security_landscape/7_asymmetric_enc_rsa.xml
index 953c509ce..1b3b9892a 100644
--- a/scenarios/labs/cyber_security_landscape/7_asymmetric_enc_rsa.xml
+++ b/scenarios/labs/cyber_security_landscape/7_asymmetric_enc_rsa.xml
@@ -19,6 +19,25 @@
   <type>lab-sheet</type>
   <difficulty>intermediate</difficulty>
 
+  <CyBOK KA="AC" topic="Algorithms, Schemes and Protocols">
+    <keyword>CRYPTOGRAPHY - ASYMMETRIC - RSA</keyword>
+    <keyword>DIFFIE-HELLMAN ALGORITHM</keyword>
+  </CyBOK>
+  <CyBOK KA="AC" topic="Public-Key Cryptography">
+    <keyword>public-key encryption</keyword>
+    <keyword>public-key signatures</keyword>
+    <keyword>RSA MODULUS</keyword>
+    <keyword>RSA PROBLEM</keyword>
+    <keyword>RSA TRANSFORM</keyword>
+  </CyBOK>
+  <CyBOK KA="AC" topic="Key Management">
+    <keyword>key generation</keyword>
+  </CyBOK>
+  <CyBOK KA="AC" topic="Cryptographic Implementation">
+    <keyword>Cryptographic Libraries</keyword>
+    <keyword>ENCRYPTION - TOOLS</keyword>
+  </CyBOK>
+
   <system>
     <system_name>desktop</system_name>
     <base distro="Debian 10" type="desktop" name="KDE"/>
diff --git a/scenarios/labs/labtainers/cyberciege.xml b/scenarios/labs/labtainers/cyberciege.xml
index f837f9cfa..3a9fde06d 100644
--- a/scenarios/labs/labtainers/cyberciege.xml
+++ b/scenarios/labs/labtainers/cyberciege.xml
@@ -19,7 +19,7 @@
   <CyBOK KA="AAA" topic="Authorisation">
     <keyword>ACCESS CONTROL - MAC (MANDATORY ACCESS CONTROL)</keyword>
   </CyBOK>
-  <CyBOK KA="C" topic="Schemes">
+  <CyBOK KA="AC" topic="Algorithms, Schemes and Protocols">
     <keyword>TLS</keyword>
   </CyBOK>
   <CyBOK KA="CPS" topic="Cyber-Physical Systems">
diff --git a/scenarios/labs/labtainers/macs-hash.xml b/scenarios/labs/labtainers/macs-hash.xml
index fe10c1aa0..abbb27c73 100644
--- a/scenarios/labs/labtainers/macs-hash.xml
+++ b/scenarios/labs/labtainers/macs-hash.xml
@@ -16,7 +16,7 @@
     <keyword>user authentication</keyword>
     <keyword>Cryptography and authentication (hashes and attacks against authentication schemes / passwords)</keyword>
   </CyBOK>
-  <CyBOK KA="C" topic="Public-Key Cryptography">
+  <CyBOK KA="AC" topic="Public-Key Cryptography">
     <keyword>symmetric encryption and authentication</keyword>
     <keyword>MESSAGE AUTHENTICATION CODE (MAC)</keyword>
     <keyword>HASHED MESSAGE AUTHENTICATION CODE (HMAC)</keyword>
diff --git a/scenarios/labs/labtainers/onewayhash.xml b/scenarios/labs/labtainers/onewayhash.xml
index 19a85f98b..7b88649de 100644
--- a/scenarios/labs/labtainers/onewayhash.xml
+++ b/scenarios/labs/labtainers/onewayhash.xml
@@ -16,7 +16,7 @@
     <keyword>user authentication</keyword>
     <keyword>Cryptography and authentication (hashes and attacks against authentication schemes / passwords)</keyword>
   </CyBOK>
-  <CyBOK KA="C" topic="Public-Key Cryptography">
+  <CyBOK KA="AC" topic="Public-Key Cryptography">
     <keyword>symmetric encryption and authentication</keyword>
     <keyword>MESSAGE AUTHENTICATION CODE (MAC)</keyword>
   </CyBOK>
diff --git a/scenarios/labs/labtainers/pubkey.xml b/scenarios/labs/labtainers/pubkey.xml
index 82a781d43..858058888 100644
--- a/scenarios/labs/labtainers/pubkey.xml
+++ b/scenarios/labs/labtainers/pubkey.xml
@@ -12,7 +12,7 @@
   <type>lab-sheet</type>
   <difficulty>intermediate</difficulty>
 
-  <CyBOK KA="C" topic="Schemes">
+  <CyBOK KA="AC" topic="Algorithms, Schemes and Protocols">
     <keyword>TLS</keyword>
   </CyBOK>
   <CyBOK KA="NS" topic="Internet Architecture">
diff --git a/scenarios/labs/labtainers/ssh-agent.xml b/scenarios/labs/labtainers/ssh-agent.xml
index 5664b750f..9a066315e 100644
--- a/scenarios/labs/labtainers/ssh-agent.xml
+++ b/scenarios/labs/labtainers/ssh-agent.xml
@@ -12,7 +12,7 @@
   <type>lab-sheet</type>
   <difficulty>intermediate</difficulty>
 
-  <CyBOK KA="C" topic="Public-Key Cryptography">
+  <CyBOK KA="AC" topic="Public-Key Cryptography">
     <keyword>public-key encryption</keyword>
     <keyword>public-key signatures</keyword>
   </CyBOK>
diff --git a/scenarios/labs/labtainers/sshlab.xml b/scenarios/labs/labtainers/sshlab.xml
index e68f0bb40..388308692 100644
--- a/scenarios/labs/labtainers/sshlab.xml
+++ b/scenarios/labs/labtainers/sshlab.xml
@@ -12,7 +12,7 @@
   <type>lab-sheet</type>
   <difficulty>intermediate</difficulty>
 
-  <CyBOK KA="C" topic="Public-Key Cryptography">
+  <CyBOK KA="AC" topic="Public-Key Cryptography">
     <keyword>public-key encryption</keyword>
     <keyword>public-key signatures</keyword>
   </CyBOK>
diff --git a/scenarios/labs/labtainers/ssl.xml b/scenarios/labs/labtainers/ssl.xml
index 2ca6c720d..e948bdd06 100644
--- a/scenarios/labs/labtainers/ssl.xml
+++ b/scenarios/labs/labtainers/ssl.xml
@@ -12,7 +12,7 @@
   <type>lab-sheet</type>
   <difficulty>intermediate</difficulty>
 
-  <CyBOK KA="C" topic="Public-Key Cryptography">
+  <CyBOK KA="AC" topic="Public-Key Cryptography">
     <keyword>public-key encryption</keyword>
     <keyword>public-key signatures</keyword>
   </CyBOK>
diff --git a/scenarios/labs/labtainers/symkeylab.xml b/scenarios/labs/labtainers/symkeylab.xml
index fcd5d8fc9..c642c19b8 100644
--- a/scenarios/labs/labtainers/symkeylab.xml
+++ b/scenarios/labs/labtainers/symkeylab.xml
@@ -12,11 +12,11 @@
   <type>lab-sheet</type>
   <difficulty>intermediate</difficulty>
 
-  <CyBOK KA="C" topic="Schemes">
+  <CyBOK KA="AC" topic="Algorithms, Schemes and Protocols">
     <keyword>AES</keyword>
   </CyBOK>
 
-  <CyBOK KA="C" topic="Symmetric Cryptography">
+  <CyBOK KA="AC" topic="Symmetric Cryptography">
     <keyword>symmetric primitives</keyword>
     <keyword>symmetric encryption and authentication</keyword>
   </CyBOK>
diff --git a/scenarios/labs/web_security/1_intro_web_security.xml b/scenarios/labs/web_security/1_intro_web_security.xml
index 121360265..23e263c5c 100644
--- a/scenarios/labs/web_security/1_intro_web_security.xml
+++ b/scenarios/labs/web_security/1_intro_web_security.xml
@@ -18,6 +18,25 @@ Throughout this lab, you will learn by doing, actively engaging in activities. A
     <type>lab-sheet</type>
     <difficulty>intermediate</difficulty>
 
+    <CyBOK KA="WAM" topic="Fundamental Concepts and Approaches">
+        <keyword>JAVASCRIPT</keyword>
+        <keyword>HYPERTEXT MARKUP LANGUAGE (HTML)</keyword>
+        <keyword>CASCADING STYLE SHEETS (CSS)</keyword>
+        <keyword>HYPERTEXT TRANSFER PROTOCOL (HTTP)</keyword>
+        <keyword>HYPERTEXT TRANSFER PROTOCOL (HTTP) - PROXYING</keyword>
+        <keyword>Broken Access Control / Insecure Direct Object References</keyword>
+        <keyword>CLIENT-SERVER MODELS</keyword>
+    </CyBOK>
+    <CyBOK KA="WAM" topic="Server-Side Vulnerabilities and Mitigations">
+        <keyword>server-side misconfiguration and vulnerable components</keyword>
+    </CyBOK>
+    <CyBOK KA="SS" topic="Categories of Vulnerabilities">
+        <keyword>Web vulnerabilities / OWASP Top 10</keyword>
+    </CyBOK>
+    <CyBOK KA="SS" topic="Detection of Vulnerabilities">
+        <keyword>dynamic detection</keyword>
+    </CyBOK>
+
     <system>
         <system_name>web_server</system_name>
         <base distro="Debian 10 Buster" />
diff --git a/scenarios/labs/web_security/2_sessions_and_cookies.xml b/scenarios/labs/web_security/2_sessions_and_cookies.xml
index 47155419a..6079ec21a 100644
--- a/scenarios/labs/web_security/2_sessions_and_cookies.xml
+++ b/scenarios/labs/web_security/2_sessions_and_cookies.xml
@@ -16,6 +16,28 @@ Throughout the lab, you will learn to self-host PHP pages, use OWASP Zap to anal
     <type>lab-environment</type>
     <type>ctf-lab</type>
 
+    <CyBOK KA="WAM" topic="Fundamental Concepts and Approaches">
+        <keyword>cookies</keyword>
+        <keyword>HYPERTEXT MARKUP LANGUAGE (HTML)</keyword>
+        <keyword>HYPERTEXT TRANSFER PROTOCOL (HTTP)</keyword>
+        <keyword>HYPERTEXT TRANSFER PROTOCOL (HTTP) - PROXYING</keyword>
+        <keyword>Broken Access Control / Insecure Direct Object References</keyword>
+        <keyword>SESSION HIJACKING</keyword>
+        <keyword>CLIENT-SERVER MODELS</keyword>
+    </CyBOK>
+    <CyBOK KA="WAM" topic="Client-Side Vulnerabilities and Mitigations">
+        <keyword>client-side storage</keyword>
+    </CyBOK>
+    <CyBOK KA="WAM" topic="Server-Side Vulnerabilities and Mitigations">
+        <keyword>server-side misconfiguration and vulnerable components</keyword>
+    </CyBOK>
+    <CyBOK KA="SS" topic="Categories of Vulnerabilities">
+        <keyword>Web vulnerabilities / OWASP Top 10</keyword>
+    </CyBOK>
+    <CyBOK KA="SS" topic="Detection of Vulnerabilities">
+        <keyword>dynamic detection</keyword>
+    </CyBOK>
+
     <system>
         <system_name>web_server</system_name>
         <base distro="Debian 10 Buster amd64" />
diff --git a/scenarios/labs/web_security/3_xss.xml b/scenarios/labs/web_security/3_xss.xml
index b8bce4754..b5e7b81db 100644
--- a/scenarios/labs/web_security/3_xss.xml
+++ b/scenarios/labs/web_security/3_xss.xml
@@ -17,6 +17,35 @@ Throughout this lab, you will engage with various learning resources, including
     <type>lab-environment</type>
     <type>ctf-lab</type>
 
+    <CyBOK KA="WAM" topic="Fundamental Concepts and Approaches">
+        <keyword>cookies</keyword>
+        <keyword>JAVASCRIPT</keyword>
+        <keyword>HYPERTEXT MARKUP LANGUAGE (HTML)</keyword>
+        <keyword>HYPERTEXT TRANSFER PROTOCOL (HTTP) - PROXYING</keyword>
+        <keyword>SESSION HIJACKING</keyword>
+        <keyword>CLIENT-SERVER MODELS</keyword>
+    </CyBOK>
+    <CyBOK KA="WAM" topic="Client-Side Vulnerabilities and Mitigations">
+        <keyword>client-side storage</keyword>
+        <keyword>CLIENT-SIDE VALIDATION</keyword>
+    </CyBOK>
+    <CyBOK KA="WAM" topic="Server-Side Vulnerabilities and Mitigations">
+        <keyword>injection vulnerabilities</keyword>
+        <keyword>server-side misconfiguration and vulnerable components</keyword>
+        <keyword>CROSS-SITE SCRIPTING (XSS)</keyword>
+        <keyword>BACK-END</keyword>
+    </CyBOK>
+    <CyBOK KA="SS" topic="Categories of Vulnerabilities">
+        <keyword>Web vulnerabilities / OWASP Top 10</keyword>
+    </CyBOK>
+    <CyBOK KA="SS" topic="Prevention of Vulnerabilities">
+        <keyword>coding practices</keyword>
+        <keyword>Protecting against session management attacks, XSS, SQLi, CSRF</keyword>
+    </CyBOK>
+    <CyBOK KA="SS" topic="Detection of Vulnerabilities">
+        <keyword>dynamic detection</keyword>
+    </CyBOK>
+
     <system>
         <system_name>web_server</system_name>
         <base distro="Debian 10 Buster amd64" />
diff --git a/scenarios/labs/web_security/4_sqli.xml b/scenarios/labs/web_security/4_sqli.xml
index a05c315ba..f641c0d5f 100644
--- a/scenarios/labs/web_security/4_sqli.xml
+++ b/scenarios/labs/web_security/4_sqli.xml
@@ -17,6 +17,31 @@ Throughout this lab, you will engage in a series of tasks across various platfor
     <type>lab-environment</type>
     <type>ctf-lab</type>
 
+    <CyBOK KA="WAM" topic="Fundamental Concepts and Approaches">
+        <keyword>HYPERTEXT MARKUP LANGUAGE (HTML)</keyword>
+        <keyword>HYPERTEXT TRANSFER PROTOCOL (HTTP) - PROXYING</keyword>
+        <keyword>DATABASE</keyword>
+        <keyword>SESSION HIJACKING</keyword>
+        <keyword>CLIENT-SERVER MODELS</keyword>
+    </CyBOK>
+    <CyBOK KA="WAM" topic="Server-Side Vulnerabilities and Mitigations">
+        <keyword>injection vulnerabilities</keyword>
+        <keyword>server-side misconfiguration and vulnerable components</keyword>
+        <keyword>SQL-INJECTION</keyword>
+        <keyword>BACK-END</keyword>
+        <keyword>BLIND ATTACKS</keyword>
+    </CyBOK>
+    <CyBOK KA="SS" topic="Categories of Vulnerabilities">
+        <keyword>Web vulnerabilities / OWASP Top 10</keyword>
+    </CyBOK>
+    <CyBOK KA="SS" topic="Prevention of Vulnerabilities">
+        <keyword>coding practices</keyword>
+        <keyword>Protecting against session management attacks, XSS, SQLi, CSRF</keyword>
+    </CyBOK>
+    <CyBOK KA="SS" topic="Detection of Vulnerabilities">
+        <keyword>dynamic detection</keyword>
+    </CyBOK>
+
     <system>
         <system_name>web_server</system_name>
         <base distro="Debian 10 Buster amd64" />
diff --git a/scenarios/labs/web_security/5_sqli_advanced.xml b/scenarios/labs/web_security/5_sqli_advanced.xml
index 23d52d97a..989b2bba9 100644
--- a/scenarios/labs/web_security/5_sqli_advanced.xml
+++ b/scenarios/labs/web_security/5_sqli_advanced.xml
@@ -17,6 +17,32 @@ Throughout the lab, you will engage with various vulnerable environments, includ
     <type>lab-environment</type>
     <type>ctf-lab</type>
 
+    <CyBOK KA="WAM" topic="Fundamental Concepts and Approaches">
+        <keyword>HYPERTEXT MARKUP LANGUAGE (HTML)</keyword>
+        <keyword>HYPERTEXT TRANSFER PROTOCOL (HTTP) - PROXYING</keyword>
+        <keyword>DATABASE</keyword>
+        <keyword>SESSION HIJACKING</keyword>
+        <keyword>CLIENT-SERVER MODELS</keyword>
+    </CyBOK>
+    <CyBOK KA="WAM" topic="Server-Side Vulnerabilities and Mitigations">
+        <keyword>injection vulnerabilities</keyword>
+        <keyword>server-side misconfiguration and vulnerable components</keyword>
+        <keyword>COMMAND INJECTION</keyword>
+        <keyword>SQL-INJECTION</keyword>
+        <keyword>BACK-END</keyword>
+        <keyword>BLIND ATTACKS</keyword>
+    </CyBOK>
+    <CyBOK KA="SS" topic="Categories of Vulnerabilities">
+        <keyword>Web vulnerabilities / OWASP Top 10</keyword>
+    </CyBOK>
+    <CyBOK KA="SS" topic="Prevention of Vulnerabilities">
+        <keyword>coding practices</keyword>
+        <keyword>Protecting against session management attacks, XSS, SQLi, CSRF</keyword>
+    </CyBOK>
+    <CyBOK KA="SS" topic="Detection of Vulnerabilities">
+        <keyword>dynamic detection</keyword>
+    </CyBOK>
+
     <system>
         <system_name>web_server</system_name>
         <base distro="Debian 10 Buster amd64" />
diff --git a/scenarios/labs/web_security/6_csrf.xml b/scenarios/labs/web_security/6_csrf.xml
index 5887f33d7..a3dd994bc 100644
--- a/scenarios/labs/web_security/6_csrf.xml
+++ b/scenarios/labs/web_security/6_csrf.xml
@@ -17,6 +17,39 @@ Throughout the lab, you will engage in hands-on tasks that mirror real-world sce
     <type>lab-environment</type>
     <type>ctf-lab</type>
 
+    <CyBOK KA="WAM" topic="Fundamental Concepts and Approaches">
+        <keyword>cookies</keyword>
+        <keyword>JAVASCRIPT</keyword>
+        <keyword>HYPERTEXT MARKUP LANGUAGE (HTML)</keyword>
+        <keyword>HYPERTEXT TRANSFER PROTOCOL (HTTP) - PROXYING</keyword>
+        <keyword>DATABASE</keyword>
+        <keyword>SESSION HIJACKING</keyword>
+        <keyword>CLIENT-SERVER MODELS</keyword>
+    </CyBOK>
+    <CyBOK KA="WAM" topic="Client-Side Vulnerabilities and Mitigations">
+        <keyword>client-side storage</keyword>
+        <keyword>CLIENT-SIDE VALIDATION</keyword>
+        <keyword>clickjacking</keyword>
+    </CyBOK>
+    <CyBOK KA="WAM" topic="Server-Side Vulnerabilities and Mitigations">
+        <keyword>injection vulnerabilities</keyword>
+        <keyword>server-side misconfiguration and vulnerable components</keyword>
+        <keyword>CROSS-SITE SCRIPTING (XSS)</keyword>
+        <keyword>CROSS-SITE REQUEST FORGERY (CSRF)</keyword>
+        <keyword>CONFUSED DEPUTY ATTACKS</keyword>
+        <keyword>BACK-END</keyword>
+    </CyBOK>
+    <CyBOK KA="SS" topic="Categories of Vulnerabilities">
+        <keyword>Web vulnerabilities / OWASP Top 10</keyword>
+    </CyBOK>
+    <CyBOK KA="SS" topic="Prevention of Vulnerabilities">
+        <keyword>coding practices</keyword>
+        <keyword>Protecting against session management attacks, XSS, SQLi, CSRF</keyword>
+    </CyBOK>
+    <CyBOK KA="SS" topic="Detection of Vulnerabilities">
+        <keyword>dynamic detection</keyword>
+    </CyBOK>
+
     <system>
         <system_name>web_server</system_name>
         <base distro="Debian 10 Buster amd64" />
diff --git a/scenarios/labs/web_security/7_additional_web.xml b/scenarios/labs/web_security/7_additional_web.xml
index 2bc67c968..848fe81c6 100644
--- a/scenarios/labs/web_security/7_additional_web.xml
+++ b/scenarios/labs/web_security/7_additional_web.xml
@@ -15,6 +15,75 @@ Web and Network Security additional CTF challenges.
     <type>lab-environment</type>
     <type>ctf-lab</type>
 
+    <!-- TODO: update cybok -->
+    <CyBOK KA="WAM" topic="Fundamental Concepts and Approaches">
+        <keyword>web PKI and HTTPS</keyword>
+        <keyword>authentication</keyword>
+        <keyword>ACCESS CONTROL</keyword>
+        <keyword>cookies</keyword>
+        <keyword>passwords and alternatives</keyword>
+        <keyword>JAVASCRIPT</keyword>
+        <keyword>HYPERTEXT MARKUP LANGUAGE (HTML)</keyword>
+        <keyword>CASCADING STYLE SHEETS (CSS)</keyword>
+        <keyword>HYPERTEXT TRANSFER PROTOCOL (HTTP)</keyword>
+        <keyword>HYPERTEXT TRANSFER PROTOCOL (HTTP) - PROXYING</keyword>
+        <keyword>DATABASE</keyword>
+        <keyword>Broken Access Control / Insecure Direct Object References</keyword>
+        <keyword>SESSION HIJACKING</keyword>
+        <keyword>CERTIFICATES</keyword>
+        <keyword>REPRESENTATIONAL STATE TRANSFER (REST)</keyword>
+        <keyword>PERMISSION DIALOG BASED ACCESS CONTROL</keyword>
+        <keyword>CLIENT-SERVER MODELS</keyword>
+    </CyBOK>
+    <CyBOK KA="WAM" topic="Client-Side Vulnerabilities and Mitigations">
+        <keyword>client-side storage</keyword>
+        <keyword>CLIENT-SIDE VALIDATION</keyword>
+        <keyword>clickjacking</keyword>
+    </CyBOK>
+    <CyBOK KA="WAM" topic="Server-Side Vulnerabilities and Mitigations">
+        <keyword>injection vulnerabilities</keyword>
+        <keyword>server-side misconfiguration and vulnerable components</keyword>
+        <keyword>CROSS-SITE SCRIPTING (XSS)</keyword>
+        <keyword>SAME ORIGIN POLICY (SOP)</keyword>
+        <keyword>COMMAND INJECTION</keyword>
+        <keyword>SQL-INJECTION</keyword>
+        <keyword>CROSS-SITE REQUEST FORGERY (CSRF)</keyword>
+        <keyword>CONFUSED DEPUTY ATTACKS</keyword>
+        <keyword>BACK-END</keyword>
+        <keyword>BLIND ATTACKS</keyword>
+    </CyBOK>
+    <CyBOK KA="SS" topic="Categories of Vulnerabilities">
+        <keyword>Web vulnerabilities / OWASP Top 10</keyword>
+        <keyword>API vulnerabilities</keyword>
+    </CyBOK>
+    <CyBOK KA="SS" topic="Prevention of Vulnerabilities">
+        <keyword>coding practices</keyword>
+        <keyword>Protecting against session management attacks, XSS, SQLi, CSRF</keyword>
+        <keyword>API design</keyword>
+    </CyBOK>
+    <CyBOK KA="SS" topic="Detection of Vulnerabilities">
+        <keyword>dynamic detection</keyword>
+    </CyBOK>
+    <!-- labtainers -->
+    <CyBOK KA="SOIM" topic="Monitor: Data Sources">
+        <keyword>network traffic</keyword>
+    </CyBOK>
+    <CyBOK KA="F" topic="Main Memory Forensics">
+        <keyword>network connections</keyword>
+        <keyword>data recovery and file content carving</keyword>
+    </CyBOK>
+    <CyBOK KA="NS" topic="Network Defence Tools">
+        <keyword>FIREWALLS</keyword>
+        <keyword>IPTables</keyword>
+        <keyword>VIRTUAL - PRIVATE NETWORK (VPN)</keyword>
+    </CyBOK>
+    <CyBOK KA="NS" topic="Internet Architecture">
+        <keyword>network layer security</keyword>
+    </CyBOK>
+    <CyBOK KA="WAM" topic="FIREWALLS">
+        <keyword>FIREWALLS</keyword>
+    </CyBOK>
+    
     <system>
         <system_name>web_server</system_name>
         <base distro="Debian 10 Buster amd64" />
diff --git a/scenarios/labs/web_security/websec_lab.xml b/scenarios/labs/web_security/websec_lab.xml
index a133405fc..30f3e563a 100644
--- a/scenarios/labs/web_security/websec_lab.xml
+++ b/scenarios/labs/web_security/websec_lab.xml
@@ -15,14 +15,21 @@
   <CyBOK KA="WAM" topic="Fundamental Concepts and Approaches">
     <keyword>web PKI and HTTPS</keyword>
     <keyword>authentication</keyword>
+    <keyword>ACCESS CONTROL</keyword>
     <keyword>cookies</keyword>
     <keyword>passwords and alternatives</keyword>
-    <keyword>JAVASCRIPT / HYPERTEXT MARKUP LANGUAGE (HTML) / CASCADING STYLE SHEETS (CSS) / HYPERTEXT TRANSFER PROTOCOL (HTTP)
-    COOKIES</keyword>
+    <keyword>JAVASCRIPT</keyword>
+    <keyword>HYPERTEXT MARKUP LANGUAGE (HTML)</keyword>
+    <keyword>CASCADING STYLE SHEETS (CSS)</keyword>
+    <keyword>HYPERTEXT TRANSFER PROTOCOL (HTTP)</keyword>
     <keyword>HYPERTEXT TRANSFER PROTOCOL (HTTP) - PROXYING</keyword>
+    <keyword>DATABASE</keyword>
     <keyword>Broken Access Control / Insecure Direct Object References</keyword>
     <keyword>SESSION HIJACKING</keyword>
+    <keyword>CERTIFICATES</keyword>
     <keyword>REPRESENTATIONAL STATE TRANSFER (REST)</keyword>
+    <keyword>PERMISSION DIALOG BASED ACCESS CONTROL</keyword>
+    <keyword>CLIENT-SERVER MODELS</keyword>
   </CyBOK>
   <CyBOK KA="WAM" topic="Client-Side Vulnerabilities and Mitigations">
     <keyword>client-side storage</keyword>
@@ -38,6 +45,8 @@
     <keyword>SQL-INJECTION</keyword>
     <keyword>CROSS-SITE REQUEST FORGERY (CSRF)</keyword>
     <keyword>CONFUSED DEPUTY ATTACKS</keyword>
+    <keyword>BACK-END</keyword>
+    <keyword>BLIND ATTACKS</keyword>
   </CyBOK>
   <CyBOK KA="SS" topic="Categories of Vulnerabilities">
     <keyword>Web vulnerabilities / OWASP Top 10</keyword>
@@ -48,6 +57,28 @@
     <keyword>Protecting against session management attacks, XSS, SQLi, CSRF</keyword>
     <keyword>API design</keyword>
   </CyBOK>
+  <CyBOK KA="SS" topic="Detection of Vulnerabilities">
+      <keyword>dynamic detection</keyword>
+  </CyBOK>
+  <!-- labtainers -->
+  <CyBOK KA="SOIM" topic="Monitor: Data Sources">
+      <keyword>network traffic</keyword>
+  </CyBOK>
+  <CyBOK KA="F" topic="Main Memory Forensics">
+      <keyword>network connections</keyword>
+      <keyword>data recovery and file content carving</keyword>
+  </CyBOK>
+  <CyBOK KA="NS" topic="Network Defence Tools">
+      <keyword>FIREWALLS</keyword>
+      <keyword>IPTables</keyword>
+      <keyword>VIRTUAL - PRIVATE NETWORK (VPN)</keyword>
+  </CyBOK>
+  <CyBOK KA="NS" topic="Internet Architecture">
+      <keyword>network layer security</keyword>
+  </CyBOK>
+  <CyBOK KA="WAM" topic="FIREWALLS">
+      <keyword>FIREWALLS</keyword>
+  </CyBOK>
 
   <system>
     <system_name>kali</system_name>