CYBRARY Forge Ranges
A cyber range that looks like your own network — built from your topology, run as a simulation, kept to your team.
What is in it
For mssp, enterprise security capability owner — test and train my people against a range that mirrors my estate, not a generic vendor's.
- Build a range from a scan report, an asset inventory or a picture of a network diagram
- Create or edit the range by talking to a conversational AI — describe the estate in plain words and it shapes the range to your exact specifications, one approved change at a time
- Arrange the range on a diagram: segments, machines, services and the starting seat
- Run tests, attack simulations and team exercises against the range you built
- Ranges belong to you: private by heart, shared with named colleagues at your company, never added to the public catalog
- Per-company branding, wording and separate reporting
What it is not
- No customer machine images — everything in a range is simulated, nothing real executes
- A range is not a course or a lab in the catalog; it is your own environment
- Custom engineering is scoped, not unlimited
Forge Ranges against the field
39 capabilities that matter for this purchase, next to the platforms a buyer shortlists in this lane: Immersive Lab Builder, Cyberbit, TryHackMe custom content.
- Describe the estate to a conversational AI and it builds or edits the range to your exact specifications, one approved change at a time.
- Paste a scenario and Forge wires the events, journal records, alerts and case console for you.
- Windows records are validated against a canonical channel and provider table, so authored content cannot invent an impossible event.
- Customer estates are mirrored read-only as a simulation; nothing touches the real network.
| What you need | Forge RangesIncluded in the platform | THM | Cyberbit | Immersive |
|---|---|---|---|---|
| Multi-machine technical scenarios | Yes See it live | TryHackMe: Documented for Multi-machine technical scenarios | Cyberbit: Documented for Multi-machine technical scenarios | Immersive: Documented for Multi-machine technical scenarios |
| Genuine operating-system and native target executionThe clearest competitor advantage in the whole register. | Coming Deliberate design, and the trade is worth reading: because nothing real executes, a range opens in seconds, is disposable between runs and carries no infrastructure to patch, isolate or clean up. A declared native lane is the bridge for the cases that genuinely need real execution; until it ships we do not claim this. | TryHackMe: Limited for Genuine operating-system and native target execution | Cyberbit: Documented for Genuine operating-system and native target execution | Immersive: Documented for Genuine operating-system and native target execution |
| Disposable, zero-risk practice environmentsNo VM to provision, isolate or rebuild — a fresh estate every run, with nothing real to break. | Yes See it live A range opens in seconds in the browser, resets to a clean state on every run and costs nothing to stand up or tear down — so practice is frequent instead of scheduled around infrastructure. | TryHackMe: Limited for Disposable, zero-risk practice environments | Cyberbit: Limited for Disposable, zero-risk practice environments | Immersive: Limited for Disposable, zero-risk practice environments |
| Delivered entirely in the browser | Yes See it live No VM to provision, so a lab opens in seconds rather than minutes. | TryHackMe: Documented for Delivered entirely in the browser | Cyberbit: Documented for Delivered entirely in the browser | Immersive: Documented for Delivered entirely in the browser |
| Private or isolated practice environments | Yes See it live | TryHackMe: Limited for Private or isolated practice environments | Cyberbit: Documented for Private or isolated practice environments | Immersive: Documented for Private or isolated practice environments |
| Team live-fire response | Yes See it live | TryHackMe: Documented for Team live-fire response | Cyberbit: Documented for Team live-fire response | Immersive: Documented for Team live-fire response |
| Red and blue or adversarial team modes | Yes See it live | TryHackMe: Limited for Red and blue or adversarial team modes | Cyberbit: Limited for Red and blue or adversarial team modes | Immersive: Documented for Red and blue or adversarial team modes |
| Customer-specific technical scenarios | Yes See it live | TryHackMe: Documented for Customer-specific technical scenarios | Cyberbit: Documented for Customer-specific technical scenarios | Immersive: Documented for Customer-specific technical scenarios |
| Customer machine-image import | By design, no Requires the native lane. Immersive is the only documented example. | Immersive: Documented for Customer machine-image import | ||
| Facilitated technical exercises | Yes See it live | TryHackMe: Limited for Facilitated technical exercises | Cyberbit: Documented for Facilitated technical exercises | Immersive: Documented for Facilitated technical exercises |
| Business impact linked to technical work | Yes See it live | TryHackMe: Limited for Business impact linked to technical work | Cyberbit: Documented for Business impact linked to technical work | Immersive: Documented for Business impact linked to technical work |
| Learner configures routing and firewall behavior | Yes See it live Routing, switching, wireless and firewall labs where a wrong rule is visible on the wire. | TryHackMe: Limited for Learner configures routing and firewall behavior | Cyberbit: Limited for Learner configures routing and firewall behavior | Immersive: Limited for Learner configures routing and firewall behavior |
| The same attempt survives refresh and reconnectPublished as a result you can watch run, not as a feature claim. | Yes See it live The attempt is cut at every step and recovered from each one, in your own browser as the page loads. | |||
| Proof of consistent shared state under concurrency | Yes See it live Forty seats receive the same actions backwards, jumbled, duplicated and after a late join, and all land on one world. | |||
| Organizational learning and administration product | Yes See it live | TryHackMe: Documented for Organizational learning and administration product | Cyberbit: Documented for Organizational learning and administration product | Immersive: Documented for Organizational learning and administration product |
| Assign content and development plans | Yes See it live | TryHackMe: Documented for Assign content and development plans | Cyberbit: Documented for Assign content and development plans | Immersive: Documented for Assign content and development plans |
| Team and sub-team reporting | Yes See it live | TryHackMe: Documented for Team and sub-team reporting | Cyberbit: Documented for Team and sub-team reporting | Immersive: Documented for Team and sub-team reporting |
| Hiring or skills-assessment workflow | Yes, in part See it live | TryHackMe: Limited for Hiring or skills-assessment workflow | Cyberbit: Documented for Hiring or skills-assessment workflow | Immersive: Documented for Hiring or skills-assessment workflow |
| Framework-linked readiness | Yes See it live ATT&CK coverage is computed from detections that actually fired, not from a content tag. | TryHackMe: Documented for Framework-linked readiness | Cyberbit: Documented for Framework-linked readiness | Immersive: Documented for Framework-linked readiness |
| AI-assisted custom technical content | Yes See it live | TryHackMe: Documented for AI-assisted custom technical content | Cyberbit: Documented for AI-assisted custom technical content | Immersive: Documented for AI-assisted custom technical content |
| Delegated content-creator role | Yes See it live | Immersive: Documented for Delegated content-creator role | ||
| Single sign-on documented in the reviewed source | Yes, in part Auth is in place; an enterprise SSO and LMS launch contract is still being built. | |||
| Public API or integration capability | Yes, in part See it live | Immersive: Documented for Public API or integration capability | ||
| 44 languages (7 native + 37 AI-translated) | Yes See it live 44 languages (7 native, 37 extended), and technical evidence left untranslated so investigations still work. | Cyberbit: Documented for 44 languages (7 native + 37 AI-translated) | Immersive: Limited for 44 languages (7 native + 37 AI-translated) | |
| Accessibility (WCAG / screen reader / keyboard)Immersive Labs publishes a WCAG 2.2 accessibility statement; Hack The Box documents text-to-speech. Others: verify. | Yes See it live Keyboard and screen-reader paths are verified on every change and the tested scope is published; an independent audit has not been done. | TryHackMe: Limited for Accessibility (WCAG / screen reader / keyboard) | ||
| Voice navigationVoice-driven navigation and command entry. No competitor documents this publicly — verify with each. | Yes See it live Hands-free navigation and terminal input across the Arena and lab desktops. | |||
| Published concurrency evidence for a full class | Yes See it live Convergence under hostile delivery is computed in front of the reader. A matched benchmark against another vendor exists for nobody, us included. | |||
| Decision-level coaching from the learner's own trailWhat was opened, revisited, how long before committing, and whether the action had support. | Yes See it live Published with the list of what we never collect: no keystrokes, no clipboard, no screen recording. | |||
| Contracted rapid custom-delivery service level | Coming | |||
| Physical and layer-1 equipment faults as graded contentCables, optics, network cards, switch ports, power, cooling, disks, memory, firmware, peripherals and wireless. | Yes See it live Faults planted from a seed, visible in counters, syslog, sensors and on the wire. | |||
| Escalation graded on reaching the owning departmentA right diagnosis sent to the wrong queue with the wrong evidence scores as wrong. | Yes See it live | |||
| NIST CSF, NICE, DoD 8140 and ATT&CK mapping on every activityReported in the customer's own workforce and coverage vocabulary. | Yes See it live | Cyberbit: Documented for NIST CSF, NICE, DoD 8140 and ATT&CK mapping on every activity | Immersive: Documented for NIST CSF, NICE, DoD 8140 and ATT&CK mapping on every activity | |
| Whole exercise reachable by screen reader and keyboardNot just the portal around the lab — the terminals and consoles themselves. | Yes See it live Our own verification; an independent audit has not been done. | |||
| Editors behave like the real ones, including a write conflictvi, Emacs, nano and pico with regex search, substitution, marks, visual mode, syntax highlighting by file type, and the warning you get when a file is already open elsewhere. | Yes See it live Leaving an editor hands focus back to the shell that launched it, on every terminal — Bash, PowerShell and cmd. | |||
| Command-line tools parse the real syntax rather than matching fixturessed, awk, grep and cat run genuine engines: BRE/ERE/fixed/PCRE dialects, hold space, branching, labels, BEGIN/END blocks, arrays, printf, redirection and true exit codes. | Yes See it live A wrong flag fails the way it fails on a real box, so a learner cannot pass by typing the expected answer. | |||
| Wireless, Bluetooth and wide-area links as first-class estateAccess points and SSIDs, paired devices, rooftop bridges, IPSec, WireGuard and MPLS sites with radio and link faults. | Yes See it live | TryHackMe: Limited for Wireless, Bluetooth and wide-area links as first-class estate | Cyberbit: Limited for Wireless, Bluetooth and wide-area links as first-class estate | |
| Prospect-driven demo room a seller can run liveA shared session the prospect drives, mirrored read-only, with domain kits, a run sheet and answers to the usual objections. | Yes See it live Bounded profiles and join codes; nothing of the customer's own network is touched. | |||
| Paste a scenario document and get a wired, editable labEvents, journal records, alerts and the case console are wired automatically, and shown back for checking before anything is created. | Yes See it live Windows log records are corrected against a canonical channel and provider table; a rename writes both journal records, so the old name stays answerable. | TryHackMe: Limited for Paste a scenario document and get a wired, editable lab | Cyberbit: Limited for Paste a scenario document and get a wired, editable lab | Immersive: Limited for Paste a scenario document and get a wired, editable lab |
| Shared network storage that persists across machinesMapped drive letters on Windows, NFS and CIFS mount points on Linux, fstab and mtab, private home drives and discoverable credentials. | Yes See it live What one host writes to a share, another host reads later in the same exercise. |
The run behind this line: A full shift to model your own scenario on
The reference shift an author copies: a mixed queue, one real intrusion in it, and everything an authored scenario needs to declare.
Opponent: Mixed: one genuine intruder in a queue of ordinary noise. Shaped after A composite day shift drawn from the platform's own graded cases. Technique and zone identifiers are published by MITRE and ISA/IEC; the mapping is ours and is not an accreditation.
How it starts — the message delivered to the mailbox
- From
- Print Services <scanner@northwind-print.example>
- Subject
- Scan from MFP-3F-04 (3 pages)
- Attachment
- Scan_MFP3F04.zip (Compressed archive)
- The printer does not send mail from an external domain
- An archive rather than the PDF a scanner produces
- No scanning job for this user exists in the print log
Graded verdict: phish — T1566.001. Nothing here sends or resolves anywhere real.
The steps, and the zone each one crosses
| # | Tactic | ATT&CK | On the range | IEC 62443 zone |
|---|---|---|---|---|
| 1 | Initial access | T1566.001 Phishing: spearphishing attachment | The archive holds a shortcut that runs a loader. | Enterprise |
| 2 | Discovery | T1087.002 Domain account discovery | The loader lists domain admins before doing anything else. | Identity |
| 3 | Persistence | T1547.001 Registry Run key | A Run value keeps the loader alive across reboots. | Enterprise |
Zones in this run: Enterprise (Purdue level 4/5, via Internet mail and web egress); Identity (Purdue level 4, via LDAP and Kerberos to the domain controllers). How the zone model is used.
The alerts the SIEM raises from this run
Shortcut executed from an archive
A .lnk running from a temporary archive extraction path.
endpoint agent · stage 1 · LINE-CUSTOM-01 · T1566.001
Privileged group enumerated from a workstation
Domain Admins membership read by a standard user account.
directory audit · stage 2 · LINE-CUSTOM-02 · T1087.002
What the case has to hold before it closes
- Which queue item was the real one, and what separated it from the noise
- The declared objective the authored scenario will grade
- The artifacts an author must plant to reproduce this shift
- The scoring the author intends, written before the run
New · Defensive Digital Twins
Rehearse on a twin of your own estate
Upload your company facts (encrypted at rest), see every SIEM and tool as a twin with alerts, compliance evidence and history, and practice from a locked baseline with a scored debrief. See how it compares →
New · Forge Exposure
See which attack paths matter most
Continuous ranking of modeled attack paths to your crown jewels, choke points to fix first, and verified remediation plans — built on your digital twin. Compare with XM Cyber →
Build a range from your own topology
Start from a file your own tools already export — an Nmap scan report or a CSV asset inventory today, with runZero, NetBox, Cisco and Check Point formats in qualification — or a picture of a network diagram. Every device the evidence could not supply is listed in a fidelity report. The range that comes out is yours: it lives in your ranges, you add the colleagues who may open it, and it never enters the catalog other people browse.
Or skip the file entirely and just describe what you need: a conversational AI, the range creator advisor, builds or edits the range to your exact specifications — machines, segments, services and the starting seat — one approved change at a time, with every change yours to accept or reject.
Going the other way, pick any range Forge already runs and see its topology drawn out for review before you reuse it.
Start learning this line
A full shift to model your own scenario on before authoring one.
Start the lab
A tick means the other platform's own documentation shows it. A question mark means we could not confirm it publicly — it is never a claim that they lack it. Every Forge yes opens the working screen rather than a screenshot.