CYBRARY Forge Proof Room
Solutions engineers demo their own product in a simulated world wearing the prospect's names.
What is in it
For vp sales, head of solutions engineering, product marketing — let a buyer drive the product on the call, on an estate they recognize, and close it there.
- Pre-provisioned demo kits for platforms, endpoint agents, appliances, plant equipment and executive value stories
- Three depths of mirror, their choice: names they dictate, a sample they drop in that is read in their own browser, or a scoped read-only look they approve and can revoke in one click
- A join code the prospect opens in a browser — no account, no install, no scheduling a lab
- A run sheet with the line to say, the surface to show and the thing the prospect can check themselves
- Leave-behind links, seats for their engineers, and a recorded recap of what was shown and what they checked themselves
- Your product's screens, consoles and device panels authored by us to match what you actually sell
What it is not
- No connection ever writes back and nothing is pulled without a scoped grant the prospect can revoke
- Nothing real executes, so it proves the workflow, not your production deployment
- Kits are authored per customer rather than self-serve, so a new product surface takes build time
Forge Proof Room against the field
39 capabilities that matter for this purchase, next to the platforms a buyer shortlists in this lane: Reprise, Demostack, Walnut, Consensus, Saleo. Reprise, Demostack, Walnut, Consensus, Saleo sit outside the eight-vendor research, so they carry no marks below — named for honesty, not scored.
- A solutions engineer gets a live, bounded environment with a run sheet, not a recorded video.
- The prospect can drive it themselves from a shared link.
| What you need | Forge Proof RoomIncluded in the platform |
|---|---|
| Multi-machine technical scenarios | Yes See it live |
| Genuine operating-system and native target executionThe clearest competitor advantage in the whole register. | Coming Deliberate design, and the trade is worth reading: because nothing real executes, a range opens in seconds, is disposable between runs and carries no infrastructure to patch, isolate or clean up. A declared native lane is the bridge for the cases that genuinely need real execution; until it ships we do not claim this. |
| Disposable, zero-risk practice environmentsNo VM to provision, isolate or rebuild — a fresh estate every run, with nothing real to break. | Yes See it live A range opens in seconds in the browser, resets to a clean state on every run and costs nothing to stand up or tear down — so practice is frequent instead of scheduled around infrastructure. |
| Delivered entirely in the browser | Yes See it live No VM to provision, so a lab opens in seconds rather than minutes. |
| Private or isolated practice environments | Yes See it live |
| Team live-fire response | Yes See it live |
| Red and blue or adversarial team modes | Yes See it live |
| Customer-specific technical scenarios | Yes See it live |
| Customer machine-image import | By design, no Requires the native lane. Immersive is the only documented example. |
| Facilitated technical exercises | Yes See it live |
| Business impact linked to technical work | Yes See it live |
| Learner configures routing and firewall behavior | Yes See it live Routing, switching, wireless and firewall labs where a wrong rule is visible on the wire. |
| The same attempt survives refresh and reconnectPublished as a result you can watch run, not as a feature claim. | Yes See it live The attempt is cut at every step and recovered from each one, in your own browser as the page loads. |
| Proof of consistent shared state under concurrency | Yes See it live Forty seats receive the same actions backwards, jumbled, duplicated and after a late join, and all land on one world. |
| Organizational learning and administration product | Yes See it live |
| Assign content and development plans | Yes See it live |
| Team and sub-team reporting | Yes See it live |
| Hiring or skills-assessment workflow | Yes, in part See it live |
| Framework-linked readiness | Yes See it live ATT&CK coverage is computed from detections that actually fired, not from a content tag. |
| AI-assisted custom technical content | Yes See it live |
| Delegated content-creator role | Yes See it live |
| Single sign-on documented in the reviewed source | Yes, in part Auth is in place; an enterprise SSO and LMS launch contract is still being built. |
| Public API or integration capability | Yes, in part See it live |
| 44 languages (7 native + 37 AI-translated) | Yes See it live 44 languages (7 native, 37 extended), and technical evidence left untranslated so investigations still work. |
| Accessibility (WCAG / screen reader / keyboard)Immersive Labs publishes a WCAG 2.2 accessibility statement; Hack The Box documents text-to-speech. Others: verify. | Yes See it live Keyboard and screen-reader paths are verified on every change and the tested scope is published; an independent audit has not been done. |
| Voice navigationVoice-driven navigation and command entry. No competitor documents this publicly — verify with each. | Yes See it live Hands-free navigation and terminal input across the Arena and lab desktops. |
| Published concurrency evidence for a full class | Yes See it live Convergence under hostile delivery is computed in front of the reader. A matched benchmark against another vendor exists for nobody, us included. |
| Decision-level coaching from the learner's own trailWhat was opened, revisited, how long before committing, and whether the action had support. | Yes See it live Published with the list of what we never collect: no keystrokes, no clipboard, no screen recording. |
| Contracted rapid custom-delivery service level | Coming |
| Physical and layer-1 equipment faults as graded contentCables, optics, network cards, switch ports, power, cooling, disks, memory, firmware, peripherals and wireless. | Yes See it live Faults planted from a seed, visible in counters, syslog, sensors and on the wire. |
| Escalation graded on reaching the owning departmentA right diagnosis sent to the wrong queue with the wrong evidence scores as wrong. | Yes See it live |
| NIST CSF, NICE, DoD 8140 and ATT&CK mapping on every activityReported in the customer's own workforce and coverage vocabulary. | Yes See it live |
| Whole exercise reachable by screen reader and keyboardNot just the portal around the lab — the terminals and consoles themselves. | Yes See it live Our own verification; an independent audit has not been done. |
| Editors behave like the real ones, including a write conflictvi, Emacs, nano and pico with regex search, substitution, marks, visual mode, syntax highlighting by file type, and the warning you get when a file is already open elsewhere. | Yes See it live Leaving an editor hands focus back to the shell that launched it, on every terminal — Bash, PowerShell and cmd. |
| Command-line tools parse the real syntax rather than matching fixturessed, awk, grep and cat run genuine engines: BRE/ERE/fixed/PCRE dialects, hold space, branching, labels, BEGIN/END blocks, arrays, printf, redirection and true exit codes. | Yes See it live A wrong flag fails the way it fails on a real box, so a learner cannot pass by typing the expected answer. |
| Wireless, Bluetooth and wide-area links as first-class estateAccess points and SSIDs, paired devices, rooftop bridges, IPSec, WireGuard and MPLS sites with radio and link faults. | Yes See it live |
| Prospect-driven demo room a seller can run liveA shared session the prospect drives, mirrored read-only, with domain kits, a run sheet and answers to the usual objections. | Yes See it live Bounded profiles and join codes; nothing of the customer's own network is touched. |
| Paste a scenario document and get a wired, editable labEvents, journal records, alerts and the case console are wired automatically, and shown back for checking before anything is created. | Yes See it live Windows log records are corrected against a canonical channel and provider table; a rename writes both journal records, so the old name stays answerable. |
| Shared network storage that persists across machinesMapped drive letters on Windows, NFS and CIFS mount points on Linux, fstab and mtab, private home drives and discoverable credentials. | Yes See it live What one host writes to a share, another host reads later in the same exercise. |
The run behind this line: The campaign a buyer is walked through
The demonstration run: one breach from the email that started it to the closed case, with every claim backed by something on screen.
Opponent: Silver Lantern — a scripted intrusion built for demonstration honesty. Shaped after A composite intrusion built only from steps the range can actually execute. Technique and zone identifiers are published by MITRE and ISA/IEC; the mapping is ours and is not an accreditation.
How it starts — the message delivered to the mailbox
- From
- Northwind Procurement <tenders@northwind-procure.example>
- Subject
- Tender NW-2291 — revised scope, response due Thursday
- Link
- shows “Supplier portal”, really points at https://supplier-portal.northwind-procure.example/auth
- A supplier portal on a domain nobody has seen before
- The organization's real portal uses federated sign-in, not a password form
- Removal from a shortlist as the threat — pressure aimed at a business outcome
Graded verdict: phish — T1566.002. Nothing here sends or resolves anywhere real.
The steps, and the zone each one crosses
| # | Tactic | ATT&CK | On the range | IEC 62443 zone |
|---|---|---|---|---|
| 1 | Initial access | T1566.002 Phishing: spearphishing link | A credential form collects the password and the second factor code. | Enterprise |
| 2 | Credential access | T1621 Multi-factor authentication request generation | The captured code is replayed inside its validity window. | Identity |
| 3 | Persistence | T1098.005 Device registration | A new authenticator is enrolled so the password reset will not help. | Cloud tenant |
| 4 | Collection | T1114.002 Remote email collection | A mailbox rule quietly forwards anything mentioning payment. | Cloud tenant |
Zones in this run: Enterprise (Purdue level 4/5, via Internet mail and web egress); Identity (Purdue level 4, via LDAP and Kerberos to the domain controllers); Cloud tenant (Purdue level 4, via Federated sign-in and management API). How the zone model is used.
The alerts the SIEM raises from this run
Authentication replayed from a second address
The same session token seen from two networks minutes apart.
cloud audit · stage 2 · LINE-PROOF-01 · T1621
New authentication method registered
An authenticator enrolled from a device with no prior sign-in.
cloud audit · stage 3 · LINE-PROOF-02 · T1098.005
Mailbox rule forwarding externally
An inbox rule with an external forward and a keyword filter.
cloud audit · stage 4 · LINE-PROOF-03 · T1114.002
What the case has to hold before it closes
- The email that started it, kept as evidence
- The identity actions the attacker took, in order
- The tenant persistence that a password reset would have missed
- The eviction steps and the proof each one worked
Start learning this line
The campaign the proof room walks a buyer through.
Start the lab
A tick means the other platform's own documentation shows it. A question mark means we could not confirm it publicly — it is never a claim that they lack it. Every Forge yes opens the working screen rather than a screenshot.