MetisForge · cyber exercise application

Turn cyber exercises into evidence of readiness.

Build realistic scenarios. Run the exercise with your team. Leave with a clear record of decisions, gaps, and next steps.

Attack path vs. detection order

Sample · Ransomware at Calder Bay Fund Services
Hover a stage to trace it

How the attacker moved · ATT&CK order

  1. 01 · Initial AccessT1566 Phishing

    Malicious invoice opened by a fund accountant

  2. 02 · Initial AccessT1078 Valid Accounts

    Harvested credentials reused over VPN

  3. 03 · Lateral MovementT1021 Remote Services

    RDP pivot to the NAV calculation servers

  4. 04 · ExfiltrationT1041 Exfil. Over C2 Channel

    Investor KYC records staged and copied out

  5. 05 · ImpactT1486 Data Encrypted for Impact

    Fund accounting servers encrypted, ransom demanded

What the team saw · inject order

  1. Anomalous VPN login
  2. Phishing email reported
  3. Lateral movement to NAV servers
  4. Exfiltration attempt
  5. Ransom demand received

Injects arrive in the order your team detects them, not the order the attacker moved. Each scenario keeps both, so the debrief can show where the gap was.

  • Low
  • Medium
  • High
  • Critical

Product replay

See both sides of the exercise.

The facilitator controls the pace, reveals questions, and reviews incoming responses.

Calder Bay Ransomware — Live exerciseLIVE6 analysts onlineConnected · T+14:32
View report

EXERCISE CLOCK

00:14:32

RUN TIME · planned 60 min

SCENARIO

A phishing email lands in a fund accountant's inbox at Calder Bay Fund Services. Forty minutes later, mass file encryption hits the servers behind daily NAV production.

Financial services · Ransomware · 60 min

INJECTS6

  1. Anomalous VPN loginLOW · T+0092%
  2. Phishing email reportedMEDIUM · T+0884%
  3. 3
    Encryption event detectedHIGH · T+15live
  4. 4
    Lateral movement to NAV serversHIGH · T+27
  5. 5
    Exfiltration attemptCRITICAL · T+38
  6. 6
    Ransom demand receivedCRITICAL · T+52

CURRENT INJECT

Encryption Event Detected

NEXT QUESTION · Q2 OF 3

Who notifies compliance, legal, and affected clients?
3 responses 1 to review
INJECT 3 OF 6● HIGHTA0040 · ImpactT+15m

Encryption Event Detected

EDR flags mass file modification on two fund accounting servers and an attempt to stop the EDR agent on one of them. The NAV team is locked out of shared drives two hours before the daily pricing cut-off. A ransom note titled READ_ME_NOW.txt appears in every affected directory.

QUESTION 1 · REVEALED

What are your first three containment actions — and who has the authority to isolate production systems?

Facilitator guide · model answer

  1. 01Isolate both file servers via EDR network containment
  2. 02Block east-west RDP at the core switch
  3. 03Page the IR lead and invoke the major-incident bridge
  4. 04Engage compliance on regulatory and client notification

PERFORMANCE

82%
PROVISIONAL
Answered
3 of 6
Scored
2 of 3
  • SOS. Osei85% Good

    Isolate both fund accounting servers via EDR containment, block east-west RDP at the core switch, page the IR lead per the ransomware runbook.

  • AVA. Vora78% Good

    Pull the two servers off the network, snapshot for forensics, and confirm with the NAV lead whether today's pricing run can move to the DR site.

  • JPJ. ParkScoring…

    Confirm scope from EDR telemetry before isolating — then invoke the major-incident bridge and bring in compliance to assess regulatory notification.

Illustrative sample data. Layout mirrors the MetisForge facilitator console.

Run it yourself in the interactive demo

The MetisGrid platform

One platform. MetisForge is the first app.

MetisForgeAvailable

Create, run, and assess cyber tabletop exercises.

MetisGambitIn development

Adversarial decision wargaming.

MetisHunterIn development

Threat-hunting practice.

Clear roles, shared context

Every seat at the table gets its own view.

Give each participant the information and controls their role needs.

Facilitator

Control the pace from one console.

Reveal injects, capture responses, score against the rubric, and keep the exercise moving in real time.

Analysts

Answer on your own screen.

Work through revealed questions with timers and team chat. Participant, facilitator, and leadership views remain deliberately separated.

Leadership

Read results you can explain.

Rubric-based results expose gaps without hiding the underlying rationale. Review the source responses alongside the assessment.

How it works

Plan the exercise. Run it. Prove what happened.

MetisForge keeps the scenario, live decisions, assessment, and follow-up in one record.

  1. 01Describe your scenario

    Choose your industry, threat, and difficulty. Review the AI draft and refine it to match your environment.

    Your outputScenario, injects, scripts, questions, and scoring rubric

  2. 02Run it live

    Set the pace from the facilitator console. Analysts work through revealed questions on their own screens, with timers and chat keeping the team coordinated.

    Your outputTimestamped responses, scores, decisions, and facilitator notes

  3. 03Review the evidence

    Review question-level scores and source evidence, confirm the findings, then assign the work that follows.

    Your outputScored decisions, cited findings, and corrective actions

Turn findings into action

Close the gaps the exercise exposes.

Each evidence-backed finding can become an owned corrective action, focused training, SME validation, and a targeted re-test.

  1. 01

    CaptureResponses, decisions, scores, and facilitator observations

  2. 02

    ExplainFindings linked back to the exercise evidence that supports them

  3. 03

    AssignCorrective actions and focused training for the gaps observed

  4. 04

    ValidateEvidence reviewed by a subject-matter expert or facilitator

  5. 05

    Re-testA new exercise confirms whether readiness actually improved

A completed task shows that someone finished the assigned work. Validation and re-test show whether the response actually improved.

See the deliverable

Inspect the complete after-action report.

Open a full fictional report rendered by the same component used in MetisForge. It includes the document detail, evidence, scoring, and follow-through customers receive in the application.

  • Question-level scores and participant responses
  • Evidence-cited findings and recommendations
  • Corrective actions, training, validation, and re-test status
  • Timeline, team chat, ATT&CK coverage, and data-quality appendix
Open the sample AAR

AFTER-ACTION REPORTILLUSTRATIVE SAMPLE — NO CUSTOMER DATA

Ransomware Escalation Exercise

Ransomware at Calder Bay Fund Services

REPORT ID
AAR-SAMPLE-01
EXERCISE DATE
August 21, 2026
PARTICIPANTS
6
78%Overall readiness

READINESS BY INJECT

  1. 0192%
  2. 0284%
  3. 0385%
  4. 0471%
  5. 0566%
  6. 0671%

KEY FINDINGS · RESTRICTEDHover to reveal

Isolation authority for was not pre-delegated; the decision took .

Client notification was drafted by before compliance confirmed .

GAP · HIGH

Ransom-note escalation path unclear — compliance, legal, and client notification stalled for 11 minutes.
Illustrative sample

Frequently asked questions

What buyers need to know.

How the exercise, assessment, and follow-through fit together.

What is the difference between MetisGrid and MetisForge?

MetisGrid is the platform. MetisForge is its cyber exercise application: the place where teams create, facilitate, assess, and follow through on tabletop exercises. The public site currently focuses on MetisForge because it is the available application.

What does MetisForge generate?

A facilitator can generate a scenario with injects, scripts, participant questions, scoring guidance, and MITRE ATT&CK context, then review and refine the draft before using it.

Does AI make the final assessment?

No. MetisForge can help analyze the exercise record, but the report keeps the underlying responses, scores, and observations visible. A facilitator reviews the findings before releasing the report.

How is the readiness score calculated?

The facilitator scores individual exercise questions. Each inject score is the mean of the questions actually graded, and overall readiness is the mean of the graded injects. Unscored items are disclosed and excluded rather than treated as zeroes.

What is included in the after-action report?

The report can include an executive summary, exercise objectives and scenario, scoring methodology, inject and question performance, evidence-backed findings, strengths, lessons, corrective actions, a timeline, MITRE ATT&CK coverage, and data-quality notes.

What happens after a gap is identified?

Staff can raise a corrective action or training gap, assign focused work, review completion evidence, and record validation or a re-test. This keeps follow-through connected to the exercise that exposed the gap.

Can reports be shared with different audiences?

Facilitators control when reports are released to authorized participant groups. Reports can also be printed or exported to HTML and PDF for approved leadership and audit workflows.

Is the public sample report based on customer data?

No. The public sample is fictional and contains no customer, participant, or production data. Its structure and scoring logic mirror the report MetisForge produces.

Bring MetisForge to your team

Start with a pilot.

A pilot can start with your industry, threat, exercise objectives, and team structure so you can assess the workflow against a scenario that matters to your organization.

Request pilot accessOr email info@metisgrid.com