MetisForge · cyber exercise application
Build realistic scenarios. Run the exercise with your team. Leave with a clear record of decisions, gaps, and next steps.
How the attacker moved · ATT&CK order
Malicious invoice opened by a fund accountant
Harvested credentials reused over VPN
RDP pivot to the NAV calculation servers
Investor KYC records staged and copied out
Shadow copies deleted, ransom demanded
Fund accounting servers encrypted
What the team saw · inject order
Product replay
The facilitator controls the pace, reveals questions, and reviews incoming responses.
EXERCISE CLOCK
00:27:42
RUN TIME · planned 60 min
SCENARIO
A phishing email lands in a fund accountant's inbox at Calder Bay Fund Services. The stolen credentials are reused over VPN, and mass file encryption hits two fund accounting servers two hours before the daily NAV cut-off.
Financial services · Ransomware · 60 minOpen briefINJECTS6
CURRENT INJECT
Encryption Event DetectedQUESTIONS
Every question on this inject is openEDR flags mass file modification on two fund accounting servers and an attempt to stop the EDR agent on one of them. The NAV team is locked out of shared drives two hours before the daily pricing cut-off. A ransom note titled READ_ME_NOW.txt appears in every affected directory.
Evidence 3 artifacts
DISCUSSION QUESTIONS
Model answer
PERFORMANCE
Isolate both fund accounting servers via EDR containment, block east-west RDP at the core switch, page the IR lead per the ransomware runbook.
Pull the two servers off the network, snapshot for forensics, and confirm with the NAV lead whether today's pricing run can move to the DR site.
Confirm scope from EDR telemetry before isolating, then invoke the major-incident bridge and bring in compliance to assess regulatory notification.
Illustrative sample data. Layout mirrors the MetisForge facilitator console.
Run it yourself in the interactive demoThe MetisGrid platform
Clear roles, shared context
Give each participant the information and controls their role needs.
Facilitators
The lead reveals injects and keeps the exercise moving in real time. Co-facilitators score answers against the rubric, take notes, and flag gaps alongside.
Analysts
Work through revealed questions with timers and team chat. Participant, facilitator, and leadership views remain deliberately separated.
Leadership
Rubric-based results expose gaps without hiding the underlying rationale. Review the source responses alongside the assessment.
How it works
MetisForge keeps the scenario, live decisions, assessment, and follow-up in one record.
Choose your industry, threat, and difficulty. Review the AI draft and refine it to match your environment.
Set the pace from the facilitator console. Analysts work through revealed questions on their own screens, with timers and chat keeping the team coordinated.
Review question-level scores and source evidence, confirm the findings, then assign the work that follows.
Turn findings into action
Each evidence-backed finding can become an owned corrective action, focused training, SME validation, and a targeted re-test.
01
CaptureResponses, decisions, scores, and facilitator observations02
ExplainFindings linked back to the exercise evidence that supports them03
AssignCorrective actions and focused training for the gaps observed04
ValidateEvidence reviewed by a subject-matter expert or facilitator05
Re-testA new exercise confirms whether readiness actually improvedA completed task shows that someone finished the assigned work. Validation and re-test show whether the response actually improved.
See the deliverable
Open a full fictional report: the same report customers receive in MetisForge, with its evidence, scoring, and follow-through.
Ransomware at Calder Bay Fund Services
READINESS BY INJECT
KEY FINDINGS · RESTRICTEDHover to reveal
Isolation authority for the NAV calculation servers was not pre-delegated; the decision took 9 minutes.
Client notification was drafted by the operations lead before compliance confirmed the reporting obligation.
GAP · HIGH
Ransom-demand escalation path unclear: compliance, legal, and client notification stalled for 11 minutes.MetisForge Training · MetisLoops
Exercises train the team a few times a year. MetisLoops drills train each person in between: a short incident, played alone, one step at a time, against an attacker on a clock. Included with MetisForge Training on the Professional and Enterprise plans.
Observe, Orient, Decide, Act. John Boyd, a United States Air Force fighter pilot and strategist, described the cycle every responder runs. The side that turns it faster, on the more accurate picture, keeps the other side reacting to a situation that has already changed.
The loop never stops: every action changes the situation and starts the next turn. Boyd put Orient at the heart of it, because it decides what you notice and which options you see. Training changes how you orient.
01Observe
Take in what is happening.Alerts, logs and telemetry · Reports from users and the service desk · Threat intelligence and advisories02Orient
Make sense of it.Triage and correlation · Competing hypotheses about what is going on · Mapping activity to ATT&CK tactics03Decide
Choose a move.Containment choices: detect, deny, disrupt, degrade or deceive · Which indicator to act on, from a file hash up to the attacker's behavior · Hold and watch, or act now04Act
Carry it out.Isolate, block, reset, rebuild · Notify, escalate, hand over · Verify the effect and keep the evidenceIn security there is always another loop turning: the attacker's. Tony Sager of the Center for Internet Security calls it dueling OODAs. Every step the attacker takes leaves something to observe, and every move you make changes what the attacker sees next.
Observe, Orient, Decide and Act each get a score, so the debrief names the step that broke your loop instead of giving one number.
The incident clock runs while you work. The longer you take, the further the attacker gets.
From the second loop you can run a playbook and skip Decide. It is fast when your reading is right, and costly when it is not.
Your team writes drills about its own systems. Two reviewers approve each one before anyone plays it.
About four minutes: one fictional incident, one loop, and the debrief a learner sees.
New to the loop? 6 Foundations lessons, about 26 minutes in all, each end in a practice drill. A preview or a second try is practice and never goes on anyone's record.
MetisHunter
In developmentEvery XDR and SIEM can search. None of them helps an analyst decide what to look for, records why they looked, or remembers what the team learned. MetisHunter is being built to do that. It is not available yet, and it is not part of any plan until it ships.
Planned: a hunt in five stages
01
ObserveThe trigger, the intel, and the data you have and lack02
OrientA hypothesis that could be proved wrong03
DecideThe questions and queries, and what a hit means04
ActEach result, kept as evidence05
LearnFindings, blind spots, lessons and new detectionsThe same OODA loop MetisLoops trains, with a fifth stage that feeds what the hunt learned into the next one.
Planned
A guided hypothesis: the adversary behavior, the evidence it would leave, and what would prove it wrong. More than an indicator search.
Planned
Every closed hunt joins a searchable library: what was hunted, what was found, and what the team could not see.
Planned
A measure of the hunt program, from waiting for alerts to turning hunts into detections, with the next step for each area.
Planned
Hypotheses, scope, data gaps, evidence, findings and the reviewer's sign-off, in a document an auditor can read.
One method across the platform. Learn the loop in MetisLoops, rehearse it in a MetisForge exercise, then apply it in a hunt.
Hear when MetisHunter shipsFrequently asked questions
How the exercise, assessment, and follow-through fit together.
MetisGrid is the platform. MetisForge is its cyber exercise application: the place where teams create, facilitate, assess, and follow through on tabletop exercises. MetisLoops, its individual decision drills, is part of MetisForge Training. MetisHunter and MetisGambit are in development and are not part of any plan until they ship.
A facilitator can generate a scenario with injects, scripts, participant questions, scoring guidance, and MITRE ATT&CK context, then review and refine the draft before using it.
No. MetisForge can help analyze the exercise record, but the report keeps the underlying responses, scores, and observations visible. A facilitator reviews the findings before releasing the report.
The facilitator scores individual exercise questions. Each inject score is the mean of the questions actually graded, and overall readiness is the mean of the graded injects. Unscored items are disclosed and excluded rather than treated as zeroes.
The report can include an executive summary, exercise objectives and scenario, scoring methodology, inject and question performance, evidence-backed findings, strengths, lessons, corrective actions, a timeline, MITRE ATT&CK coverage, and data-quality notes.
Staff can raise a corrective action or training gap, assign focused work, review completion evidence, and record validation or a re-test. This keeps follow-through connected to the exercise that exposed the gap.
Facilitators control when reports are released to authorized participant groups. Reports can also be printed or exported to HTML and PDF for approved leadership and audit workflows.
No. The public sample is fictional and contains no customer, participant, or production data. Its structure and scoring logic mirror the report MetisForge produces.
Bring MetisForge to your team
A pilot can start with your industry, threat, exercise objectives, and team structure so you can assess the workflow against a scenario that matters to your organization.