Forge Labs Guided hands-on practice on simulated Windows and Linux machines.
Who buys it Individual learner, university, L&D lead
What they need Build a skill and prove it transfers to an unseen task. Windows 11 and seven Linux distributions, each with distro-accurate commands Role paths, difficulty levels and a guided first run Referee scoring with per-step reasoning, not a completion tick Six languages, with technical evidence left untranslated so investigations still work Nothing real executes — no VM, no shell on a real host Not a substitute for an exploit-development certification track Competing with: TryHackMe, Hack The Box Academy, RangeForce
Forge Missions SOC investigations: triage a queue, hunt, and prove your conclusion.
Who buys it SOC lead, MSSP delivery manager
What they need Make analysts accurate and fast on work that looks like their own. Alert queue with innocent lookalikes, so closing everything scores badly SIEM, endpoint, case service and the wire all reading one estate Dwell time, containment time and SLA clocks scored, not just logged Cases mapped to ATT&CK from detections that actually fired Simulated tool surfaces, not a licensed vendor console Does not validate your production SIEM or EDR deployment Competing with: LetsDefend, TryHackMe SOC Simulator, Cyberbit, HTB Threat Range
Forge Exercises Live team incidents with roles, handover and a facilitator.
Who buys it SOC manager, incident response lead
What they need Rehearse a coordinated response and see how the team actually behaves. Shared persistent estate: everyone sees the same state at the same time Role gating, lobby, shift handover notes and typing and read receipts Facilitator view with injects, pause, help flags and a technical debrief Business impact tied to the technical work Facilitation as a service is scoped separately from the platform Concurrency beyond the tested profile needs a load acceptance first Competing with: Cyberbit, RangeForce DRILL, Immersive, TryHackMe Live Breach
Forge Workshop Build detections and automation that actually run, then break them.
Who buys it Detection engineer, automation engineer
What they need Ship reliable detections and playbooks, and recover when a connector fails. Executable SOAR playbooks: draft, run, fail, repair, rerun Deterministic integration faults and idempotent retries A run debugger showing resolved inputs, outputs, errors and retries Detection rules tested against positive and benign fixtures Playbooks run against the simulated estate, not your production tools Not a commercial SOAR product you would deploy Competing with: Immersive, RangeForce, TryHackMe
Forge Arena Capture the flag and attack-defense competition, hosted end to end.
Who buys it Community lead, recruiter, university, conference organizer
What they need Run a fair, memorable event without an operations team. Event creation, rosters, team sizes, branding and access codes Live scoreboard, service-uptime scoring in adversarial rounds, replay and spectating Pause and reschedule, exports, and a debrief pack Declared policy for AI entrants, scored on their own board Anti-cheating is investigative signal, not a guarantee Prizes and proctoring are not included Competing with: Hack The Box CTF, TryHackMe, OffSec Versus
Forge Agent Workbench Supervise AI agents during an incident: approve, halt, override, verify.
Who buys it SOC lead, AI governance owner
What they need Make sure people can safely run a SOC where agents do some of the work. Agents act on the same estate through a broker that enforces permissions Approval inbox bound to the exact action, target and state version A denied or out-of-scope agent action is a scored event, not a console error Staged faults and hidden ground truth: rejecting a plausible wrong answer scores well Per-run cost caps enforced outside the model, with a visible meter Simulated lane: agent actions change modeled state, not real machines No lab result certifies an agent is safe in production Competing with: Immersive Agentic SOC Simulator, HTB AI Range, Cyberbit
Forge Agent Evaluation Run a versioned agent against hidden cases and compare it honestly.
Who buys it Agent builder, AI platform owner, agent buyer
What they need Decide whether a configuration change made the agent better or just faster. Frozen suites with hidden ground truth the agent cannot read during a run An independent check of final state, not the agent's own claim of success Baseline against candidate, with failures and timeouts included Separate scores for quality, safety, oversight, cost and latency Learner and agent graded apart on the same incident A simulation score is not proof of production readiness Arbitrary third-party agent code does not execute inside Forge Competing with: Immersive Agentic Harness, HTB AI Range
Forge Crisis Executive and tabletop exercises driven by the real incident timeline.
Who buys it CISO, legal, communications, IR lead
What they need Rehearse the decisions that get made above the SOC floor. Executive, legal and communications roles with timed injects Injects fed by the same timeline engine as the technical labs Guests join a room by code without consuming a learner seat Decision record and an after-action report Facilitated delivery is a separate service Not legal or regulatory advice Competing with: Immersive, Cyberbit Crisis Sim, HTB Crisis Control, TryHackMe
Forge Ranges A cyber range that looks like your own network — built from your topology, run as a simulation, kept to your team.
Who buys it MSSP, enterprise security capability owner
What they need Test and train my people against a range that mirrors my estate, not a generic vendor's. Build a range from a scan report, an asset inventory or a picture of a network diagram Create or edit the range by talking to a conversational AI — describe the estate in plain words and it shapes the range to your exact specifications, one approved change at a time Arrange the range on a diagram: segments, machines, services and the starting seat Run tests, attack simulations and team exercises against the range you built Ranges belong to you: private by heart, shared with named colleagues at your company, never added to the public catalog Per-company branding, wording and separate reporting No customer machine images — everything in a range is simulated, nothing real executes A range is not a course or a lab in the catalog; it is your own environment Custom engineering is scoped, not unlimited Competing with: Immersive Lab Builder, Cyberbit, TryHackMe custom content
Forge Anvil Run authorized pentests with local tools, enforced scope, and reviewable evidence.
Who buys it Pentest manager, security consultancy, internal assessment team
What they need Control real assessment work from authorization through evidence, reporting, and retest. Approved local tools collected in one engagement-scoped workspace Targets, ports, testing windows and rules of engagement applied from Forge Commands, outputs, screen context and network connections attached to findings Manager intake, analyst assignment, reporting, QA and retest workflow Team rooms with chat, shared tasks, handoffs and a timeline that can't be edited Manager approval of findings, PDF and Word reports, and a replay of every engagement Credential store, cleanup tracking and a manager sign-off before closure Testing requires explicit authorization and an active engagement scope Browser labs remain simulated; native execution is confined to the Anvil desktop paths Competing with: Pentera, Horizon3 NodeZero, PlexTrac, Cobalt, AttackForge, Dradis
Forge Proof Room Solutions engineers demo their own product in a simulated world wearing the prospect's names.
Who buys it VP Sales, head of solutions engineering, product marketing
What they need Let a buyer drive the product on the call, on an estate they recognize, and close it there. Pre-provisioned demo kits for platforms, endpoint agents, appliances, plant equipment and executive value stories Three depths of mirror, their choice: names they dictate, a sample they drop in that is read in their own browser, or a scoped read-only look they approve and can revoke in one click A join code the prospect opens in a browser — no account, no install, no scheduling a lab A run sheet with the line to say, the surface to show and the thing the prospect can check themselves Leave-behind links, seats for their engineers, and a recorded recap of what was shown and what they checked themselves Your product's screens, consoles and device panels authored by us to match what you actually sell No connection ever writes back and nothing is pulled without a scoped grant the prospect can revoke Nothing real executes, so it proves the workflow, not your production deployment Kits are authored per customer rather than self-serve, so a new product surface takes build time Competing with: Reprise, Demostack, Walnut, Consensus, Saleo
Forge AI SOC An agent triaging the estate's own detections, with a person answering for it.
Who buys it SOC manager, head of detection engineering, AI governance owner
What they need See how a shift works when an agent takes the first pass, and train people to catch it being wrong. Triage runs on the live detections of the estate you pick, not a scripted feed Every call carries its evidence, its unknowns and the ATT&CK step behind it The agent runs only the read-only half of the playbook; anything that changes the world is held with the action and target written out Deterministically wrong calls, seeded from the run, disclosed only in the debrief You are scored, not the agent: catching a plausible wrong call beats agreeing with a right one No global console — there is no shared SIEM, only the estate the shift is on A score here is evidence of practice, not proof an agent is safe in production Competing with: Dropzone AI, Prophet Security, Radiant Security, Immersive Agentic SOC
Forge Programs Run cyber training for a whole team and report it honestly.
Who buys it L&D lead, security capability owner, university program lead
What they need Put a cohort through real work and be able to show what each person actually did. Assign from the full library by role, difficulty and machine Cohorts share one estate, with seats, roles and a lead who starts the session Live instructor view of the work in progress, not a report the next morning Decision drills paired to the lab that teaches the step Progress mapped to NIST CSF, NICE and the DoD workforce framework for the training plan Completion is inferred from the run, so there is no box to tick Forge scores are evidence of practice, not a certification Competing with: Immersive, RangeForce, TryHackMe for Business, Hack The Box Academy
Forge Playbook Builder Write a response playbook, compile it, and see where it stops for a person.
Who buys it SOAR engineer, automation lead, detection engineer
What they need Prove a playbook does what it says before it touches anything. Plain-line authoring compiled by the same engine the graded cases run A debugger that names unreachable steps, missing gates and what the run would write Every pause for a human listed before the first step runs Only actions the engine can really execute compile — the rest are errors on purpose It drives the simulated estate, not your production SOAR platform No connector marketplace: integrations are modeled, including their failures Competing with: Tines, Torq, Splunk SOAR, Palo Alto XSOAR
Forge Secure Code Review a real pull request under time pressure, with a scanner that is partly wrong.
Who buys it Engineering manager, AppSec lead, platform team
What they need Teach developers to find the flaw the tooling missed and reject the finding it invented. A seeded pull request with one genuine flaw hidden among ordinary refactors A scanner report carrying false positives the learner must close with a reason A dependency list that is mostly a distraction, as it is on a real branch Graded on the hunk, the class of flaw, the false alarm and the fix asked for A second bench at /labs/appsec-review where an AI reviewer writes the patches and the developer adjudicates it, scored on a card of its own No build runs and no code executes — the review is of the diff, as reviews are Not a replacement for your scanner; it teaches judgement about scanner output Competing with: Secure Code Warrior, HackEDU/Security Journey, Hack The Box Academy
Forge Plant Floor An operational-technology shift where the IT answer is the wrong answer.
Who buys it OT security lead, plant engineering manager, critical-infrastructure CISO
What they need Prepare responders for a plant network, where containment can be the dangerous move. An asset register laid out by Purdue level, from field devices to the plant DMZ Control traffic, a historian trend and the alarm log for one shift Events that look like IT incidents and are not, and IT responses scored as failures Graded on the asset, the event, the boundary crossed and the safe next move Nothing speaks to a real controller — the protocol behavior is modeled Not a safety-instrumented-system engineering course Competing with: Dragos Academy, Immersive, OPSWAT
CYBRARY