Facilitators
Run it together from one console.
The lead reveals injects and keeps the exercise moving in real time. Co-facilitators score answers against the rubric, take notes, and flag gaps alongside.
MetisForge · cyber exercise application
Turn cyber exercises into evidence of readiness.
Build realistic scenarios. Run the exercise with your team. Leave with a clear record of decisions, gaps, and next steps.
Attack path vs. detection order
Sample · Ransomware at Calder Bay Fund ServicesHow the attacker moved · ATT&CK order
- 01 · Initial AccessT1566 Phishing
Malicious invoice opened by a fund accountant
- 02 · Initial AccessT1078 Valid Accounts
Harvested credentials reused over VPN
- 03 · Lateral MovementT1021 Remote Services
RDP pivot to the NAV calculation servers
- 04 · ExfiltrationT1041 Exfil. Over C2 Channel
Investor KYC records staged and copied out
- 05 · ImpactT1490 Inhibit System Recovery
Shadow copies deleted, ransom demanded
- 06 · ImpactT1486 Data Encrypted for Impact
Fund accounting servers encrypted
What the team saw · inject order
- Anomalous VPN login
- Phishing email reported
- Encryption event detected
- Lateral movement to NAV servers
- Exfiltration attempt
- Ransom demand received
The facilitator console
Run it live. Score it live. Report it instantly.
Reveal each inject, watch the team's answers arrive, score them with your co-facilitators, change the exercise as it runs, and open the readiness result the moment it ends. It plays on its own; hover or click to take the controls.
Illustrative mockup with sample data.
Get the full demoThe MetisGrid platform
One platform for exercising, training, hunting and investigating.
Clear roles, shared context
Every seat at the table gets its own view.
Give each participant the information and controls their role needs.
Analysts
Answer on your own screen.
Work through revealed questions with timers and team chat. Participant, facilitator, and leadership views remain deliberately separated.
Leadership
Read results you can explain.
Rubric-based results expose gaps without hiding the underlying rationale. Review the source responses alongside the assessment.
How it works
Plan the exercise. Run it. Prove what happened.
MetisForge keeps the scenario, live decisions, assessment, and follow-up in one record.
01Describe your scenario
Choose your industry, threat, and difficulty. Review the AI draft and refine it to match your environment.
Your outputScenario, injects, scripts, questions, and scoring rubric02Run it live
Set the pace from the facilitator console. Analysts work through revealed questions on their own screens, with timers and chat keeping the team coordinated.
Your outputTimestamped responses, scores, decisions, and facilitator notes03Review the evidence
Review question-level scores and source evidence, confirm the findings, then assign the work that follows.
Your outputScored decisions, cited findings, and corrective actions
Turn findings into action
Close the gaps the exercise exposes.
Each evidence-backed finding can become an owned corrective action, focused training, SME validation, and a targeted re-test.
01
CaptureResponses, decisions, scores, and facilitator observations02
ExplainFindings linked back to the exercise evidence that supports them03
AssignCorrective actions and focused training for the gaps observed04
ValidateEvidence reviewed by a subject-matter expert or facilitator05
Re-testA new exercise confirms whether readiness actually improved
A completed task shows that someone finished the assigned work. Validation and re-test show whether the response actually improved.
See the deliverable
Inspect the complete after-action report.
Open a full fictional report: the same report customers receive in MetisForge, with its evidence, scoring, and follow-through.
- Question-level scores and participant responses
- Evidence-cited findings and recommendations
- Corrective actions, training, validation, and re-test status
- Timeline, team chat, ATT&CK coverage, and data-quality appendix
Ransomware Escalation Exercise
Ransomware at Calder Bay Fund Services
- REPORT ID
- AAR-SAMPLE-01
- EXERCISE DATE
- August 21, 2026
- PARTICIPANTS
- 6
78%Overall readiness
READINESS BY INJECT
KEY FINDINGS · RESTRICTEDHover to reveal
Isolation authority for the NAV calculation servers was not pre-delegated; the decision took 9 minutes.
Client notification was drafted by the operations lead before compliance confirmed the reporting obligation.
GAP · HIGH
Ransom-demand escalation path unclear: compliance, legal, and client notification stalled for 11 minutes.MetisForge Training · MetisLoops
Train each person's decision loop between exercises.
Exercises train the team a few times a year. MetisLoops drills train each person in between: a short incident, played alone, one step at a time, against an attacker on a clock. Included with MetisForge Training on the Professional and Enterprise plans.
What is an OODA loop?
Observe, Orient, Decide, Act. John Boyd, a United States Air Force fighter pilot and strategist, described the cycle every responder runs. The side that turns it faster, on the more accurate picture, keeps the other side reacting to a situation that has already changed.
The loop never stops: every action changes the situation and starts the next turn. Boyd put Orient at the heart of it, because it decides what you notice and which options you see. Training changes how you orient.
01Observe
Take in what is happening.Alerts, logs and telemetry · Reports from users and the service desk · Threat intelligence and advisories02Orient
Make sense of it.Triage and correlation · Competing hypotheses about what is going on · Mapping activity to ATT&CK tactics03Decide
Choose a move.Containment choices: detect, deny, disrupt, degrade or deceive · Which indicator to act on, from a file hash up to the attacker's behavior · Hold and watch, or act now04Act
Carry it out.Isolate, block, reset, rebuild · Notify, escalate, hand over · Verify the effect and keep the evidence
Two loops, one race
In security there is always another loop turning: the attacker's. Tony Sager of the Center for Internet Security calls it dueling OODAs. Every step the attacker takes leaves something to observe, and every move you make changes what the attacker sees next.
Every step scored on its own
Observe, Orient, Decide and Act each get a score, so the debrief names the step that broke your loop instead of giving one number.
An attacker who moves while you think
The incident clock runs while you work. The longer you take, the further the attacker gets.
Acting from training
From the second loop you can run a playbook and skip Decide. It is fast when your reading is right, and costly when it is not.
Drills for your own environment
Your team writes drills about its own systems. Two reviewers approve each one before anyone plays it.
Try a drill, no sign-up
About four minutes: one fictional incident, one loop, and the debrief a learner sees.
New to the loop? 6 Foundations lessons, about 26 minutes in all, each end in a practice drill. A preview or a second try is practice and never goes on anyone's record. More on OODA loop training
MetisForge · MetisGambit
AvailableFind the attacker before they reach what matters.
MetisGambit is a solo game of cyber defense. You see only what your logs record, you have two moves a turn, and the business has to keep running while you work. Included with every MetisForge plan.
A case in 10 to 15 minutes
A hidden attacker is somewhere in a small company network. Search the logs, make two moves a turn and keep a case file, without shutting the business down.
Only what your logs can show
Alerts say what a log recorded, not what it means. Every turn is graded on what your logs could have told you at that moment.
The attack, replayed on the map
When the case ends, the network map replays what the attacker really did, step by step, so you can see what your logs were showing you all along.
Longer matches against an AI adversary
Adversary matches run about 20 turns. The debrief shows an ATT&CK scorecard, every call you made and what to change on Monday.
Practice between exercises. A guided first case, a daily case everyone plays and practice cases, played alone in the browser.
More about MetisGambitMetisHunter
AvailableThreat hunting as a practice, beside the XDR you already use.
Every XDR and SIEM can search. MetisHunter helps an analyst decide what to look for, writes the queries for the tools the team already runs, records why they looked and keeps what the hunt found. Licensed on its own or with MetisForge.
A hunt in six steps
01
StartA threat-intel report, an ATT&CK technique or your own concern02
Pick a huntDrafted hypotheses, each one able to be proved wrong03
PlanChecks, with a query for each of your platforms04
Check the dataConfirm the logs exist before you search them05
HuntRun each query and keep what it returns as evidence06
VerdictSupported, not supported or inconclusive, and what follows
Prefer to think on paper first? Start from notes: write in the hunt's notebook and a build chat turns your notes into checks.
Hypothesis first
Start from a threat-intel report, an ATT&CK technique or a concern in your own words. AI drafts hypotheses: the behavior, why it could happen here, the evidence it would leave and what would prove it wrong.
Queries for the tools you run
Each check comes with a query for Microsoft Sentinel, Microsoft Defender XDR, Splunk, Elastic or CrowdStrike Falcon. Run it in your own tool and paste the result back as evidence.
Check the data before you hunt
Count queries confirm the logs a hypothesis needs are there. When they are not, the hunt records a data gap instead of a false all clear.
A report for every hunt
A verdict with a confidence, outcomes such as a new detection, a control change or a data gap, and a report of the checks, evidence, findings, indicators and limitations.
Nothing found is lost. “Where have I seen this?” checks a hunt's indicators against earlier hunts and MetisTracker investigations.
More about MetisHunterMetisTracker
AvailableThe incident timeline your whole team builds at once.
During an investigation every analyst finds something different. MetisTracker puts it all on one timeline as it happens: one line per event, logged in seconds, drawn on a chart that helps the team see the pattern. Licensed on its own or with MetisForge.
Log it as it happens
Type what happened and press Enter. The time comes from the server's clock unless you type one. @ names a host or account, # adds a tag, and pasted log lines are added together after a preview.
A timeline you can read
Lanes by host, account, analyst or ATT&CK tactic, with hours outside the working day shaded and a panel that points out bursts, quiet stretches and out-of-hours events. A movement view shows which host reached which.
The whole team, at once
Analysts log into the same investigation live, each in their own color, with comments and a history of every change. Leads manage the people, analysts log, observers read.
From timeline to report
Mark the events that matter, write the story around them and download it as PDF or HTML, with indicators defanged by default. Export to an Excel workbook or CSV.
Nothing quietly disappears. A deleted event keeps its history and can be put back, and investigations are archived, never deleted.
More about MetisTrackerFrequently asked questions
What buyers need to know.
How the exercise, assessment, and follow-through fit together.
What is the difference between MetisGrid and MetisForge?
MetisGrid is the platform. MetisForge is its cyber exercise application: the place where teams create, facilitate, assess, and follow through on tabletop exercises. MetisLoops, its individual decision drills, is part of MetisForge Training, and MetisGambit, solo defense cases, comes with every MetisForge plan. MetisHunter, for threat hunting, and MetisTracker, for incident timelines, are products of their own, licensed alone or together with MetisForge.
What does MetisForge generate?
A facilitator can generate a scenario with injects, scripts, participant questions, scoring guidance, and MITRE ATT&CK context, then review and refine the draft before using it.
Does AI make the final assessment?
No. MetisForge can help analyze the exercise record, but the report keeps the underlying responses, scores, and observations visible. A facilitator reviews the findings before releasing the report.
How is the readiness score calculated?
The facilitator scores individual exercise questions. Each inject score is the mean of the questions actually graded, and overall readiness is the mean of the graded injects. Unscored items are disclosed and excluded rather than treated as zeroes.
What is included in the after-action report?
The report can include an executive summary, exercise objectives and scenario, scoring methodology, inject and question performance, evidence-backed findings, strengths, lessons, corrective actions, a timeline, MITRE ATT&CK coverage, and data-quality notes.
What happens after a gap is identified?
Staff can raise a corrective action or training gap, assign focused work, review completion evidence, and record validation or a re-test. This keeps follow-through connected to the exercise that exposed the gap.
Can reports be shared with different audiences?
Facilitators control when reports are released to authorized participant groups. Reports can also be printed or exported to HTML and PDF for approved leadership and audit workflows.
Is the public sample report based on customer data?
No. The public sample is fictional and contains no customer, participant, or production data. Its structure and scoring logic mirror the report MetisForge produces.
Bring MetisForge to your team
Start with a pilot.
A pilot can start with your industry, threat, exercise objectives, and team structure so you can assess the workflow against a scenario that matters to your organization.