Facilitators
Run it together from one console.
The lead reveals injects and keeps the exercise moving in real time. Co-facilitators score answers against the rubric, take notes, and flag gaps alongside.
MetisForge · cyber exercise application
Turn cyber exercises into evidence of readiness.
Build realistic scenarios. Run the exercise with your team. Leave with a clear record of decisions, gaps, and next steps.
Attack path vs. detection order
Sample · Ransomware at Calder Bay Fund ServicesHow the attacker moved · ATT&CK order
- 01 · Initial AccessT1566 Phishing
Malicious invoice opened by a fund accountant
- 02 · Initial AccessT1078 Valid Accounts
Harvested credentials reused over VPN
- 03 · Lateral MovementT1021 Remote Services
RDP pivot to the NAV calculation servers
- 04 · ExfiltrationT1041 Exfil. Over C2 Channel
Investor KYC records staged and copied out
- 05 · ImpactT1490 Inhibit System Recovery
Shadow copies deleted, ransom demanded
- 06 · ImpactT1486 Data Encrypted for Impact
Fund accounting servers encrypted
What the team saw · inject order
- Anomalous VPN login
- Phishing email reported
- Encryption event detected
- Lateral movement to NAV servers
- Exfiltration attempt
- Ransom demand received
The facilitator console
Run it live. Score it live. Report it instantly.
Reveal each inject, watch the team's answers arrive, score them with your co-facilitators, change the exercise as it runs, and open the readiness result the moment it ends. It plays on its own; hover or click to take the controls.
Illustrative mockup with sample data.
Get the full demoThe MetisGrid platform
One platform. MetisForge is available today; more is on the way.
- MetisGambitIn developmentAdversarial decision wargaming.
Clear roles, shared context
Every seat at the table gets its own view.
Give each participant the information and controls their role needs.
Analysts
Answer on your own screen.
Work through revealed questions with timers and team chat. Participant, facilitator, and leadership views remain deliberately separated.
Leadership
Read results you can explain.
Rubric-based results expose gaps without hiding the underlying rationale. Review the source responses alongside the assessment.
How it works
Plan the exercise. Run it. Prove what happened.
MetisForge keeps the scenario, live decisions, assessment, and follow-up in one record.
01Describe your scenario
Choose your industry, threat, and difficulty. Review the AI draft and refine it to match your environment.
Your outputScenario, injects, scripts, questions, and scoring rubric02Run it live
Set the pace from the facilitator console. Analysts work through revealed questions on their own screens, with timers and chat keeping the team coordinated.
Your outputTimestamped responses, scores, decisions, and facilitator notes03Review the evidence
Review question-level scores and source evidence, confirm the findings, then assign the work that follows.
Your outputScored decisions, cited findings, and corrective actions
Turn findings into action
Close the gaps the exercise exposes.
Each evidence-backed finding can become an owned corrective action, focused training, SME validation, and a targeted re-test.
01
CaptureResponses, decisions, scores, and facilitator observations02
ExplainFindings linked back to the exercise evidence that supports them03
AssignCorrective actions and focused training for the gaps observed04
ValidateEvidence reviewed by a subject-matter expert or facilitator05
Re-testA new exercise confirms whether readiness actually improved
A completed task shows that someone finished the assigned work. Validation and re-test show whether the response actually improved.
See the deliverable
Inspect the complete after-action report.
Open a full fictional report: the same report customers receive in MetisForge, with its evidence, scoring, and follow-through.
- Question-level scores and participant responses
- Evidence-cited findings and recommendations
- Corrective actions, training, validation, and re-test status
- Timeline, team chat, ATT&CK coverage, and data-quality appendix
Ransomware Escalation Exercise
Ransomware at Calder Bay Fund Services
- REPORT ID
- AAR-SAMPLE-01
- EXERCISE DATE
- August 21, 2026
- PARTICIPANTS
- 6
78%Overall readiness
READINESS BY INJECT
KEY FINDINGS · RESTRICTEDHover to reveal
Isolation authority for the NAV calculation servers was not pre-delegated; the decision took 9 minutes.
Client notification was drafted by the operations lead before compliance confirmed the reporting obligation.
GAP · HIGH
Ransom-demand escalation path unclear: compliance, legal, and client notification stalled for 11 minutes.MetisForge Training · MetisLoops
Train each person's decision loop between exercises.
Exercises train the team a few times a year. MetisLoops drills train each person in between: a short incident, played alone, one step at a time, against an attacker on a clock. Included with MetisForge Training on the Professional and Enterprise plans.
What is an OODA loop?
Observe, Orient, Decide, Act. John Boyd, a United States Air Force fighter pilot and strategist, described the cycle every responder runs. The side that turns it faster, on the more accurate picture, keeps the other side reacting to a situation that has already changed.
The loop never stops: every action changes the situation and starts the next turn. Boyd put Orient at the heart of it, because it decides what you notice and which options you see. Training changes how you orient.
01Observe
Take in what is happening.Alerts, logs and telemetry · Reports from users and the service desk · Threat intelligence and advisories02Orient
Make sense of it.Triage and correlation · Competing hypotheses about what is going on · Mapping activity to ATT&CK tactics03Decide
Choose a move.Containment choices: detect, deny, disrupt, degrade or deceive · Which indicator to act on, from a file hash up to the attacker's behavior · Hold and watch, or act now04Act
Carry it out.Isolate, block, reset, rebuild · Notify, escalate, hand over · Verify the effect and keep the evidence
Two loops, one race
In security there is always another loop turning: the attacker's. Tony Sager of the Center for Internet Security calls it dueling OODAs. Every step the attacker takes leaves something to observe, and every move you make changes what the attacker sees next.
Every step scored on its own
Observe, Orient, Decide and Act each get a score, so the debrief names the step that broke your loop instead of giving one number.
An attacker who moves while you think
The incident clock runs while you work. The longer you take, the further the attacker gets.
Acting from training
From the second loop you can run a playbook and skip Decide. It is fast when your reading is right, and costly when it is not.
Drills for your own environment
Your team writes drills about its own systems. Two reviewers approve each one before anyone plays it.
Try a drill, no sign-up
About four minutes: one fictional incident, one loop, and the debrief a learner sees.
New to the loop? 6 Foundations lessons, about 26 minutes in all, each end in a practice drill. A preview or a second try is practice and never goes on anyone's record. More on OODA loop training
MetisHunter
In developmentThreat hunting as a practice, beside the XDR you already use.
Every XDR and SIEM can search. None of them helps an analyst decide what to look for, records why they looked, or remembers what the team learned. MetisHunter is being built to do that. It is not available yet, and it is not part of any plan until it ships.
Planned: a hunt in five stages
01
ObserveThe trigger, the intel, and the data you have and lack02
OrientA hypothesis that could be proved wrong03
DecideThe questions and queries, and what a hit means04
ActEach result, kept as evidence05
LearnFindings, blind spots, lessons and new detections
The same OODA loop MetisLoops trains, with a fifth stage that feeds what the hunt learned into the next one.
Planned
Hypothesis first
A guided hypothesis: the adversary behavior, the evidence it would leave, and what would prove it wrong. More than an indicator search.
Planned
Organization memory
Every closed hunt joins a searchable library: what was hunted, what was found, and what the team could not see.
Planned
Program maturity
A measure of the hunt program, from waiting for alerts to turning hunts into detections, with the next step for each area.
Planned
Audit-ready reports
Hypotheses, scope, data gaps, evidence, findings and the reviewer's sign-off, in a document an auditor can read.
One method across the platform. Learn the loop in MetisLoops, rehearse it in a MetisForge exercise, then apply it in a hunt.
Hear when MetisHunter shipsFrequently asked questions
What buyers need to know.
How the exercise, assessment, and follow-through fit together.
What is the difference between MetisGrid and MetisForge?
MetisGrid is the platform. MetisForge is its cyber exercise application: the place where teams create, facilitate, assess, and follow through on tabletop exercises. MetisLoops, its individual decision drills, is part of MetisForge Training. MetisHunter and MetisGambit are in development and are not part of any plan until they ship.
What does MetisForge generate?
A facilitator can generate a scenario with injects, scripts, participant questions, scoring guidance, and MITRE ATT&CK context, then review and refine the draft before using it.
Does AI make the final assessment?
No. MetisForge can help analyze the exercise record, but the report keeps the underlying responses, scores, and observations visible. A facilitator reviews the findings before releasing the report.
How is the readiness score calculated?
The facilitator scores individual exercise questions. Each inject score is the mean of the questions actually graded, and overall readiness is the mean of the graded injects. Unscored items are disclosed and excluded rather than treated as zeroes.
What is included in the after-action report?
The report can include an executive summary, exercise objectives and scenario, scoring methodology, inject and question performance, evidence-backed findings, strengths, lessons, corrective actions, a timeline, MITRE ATT&CK coverage, and data-quality notes.
What happens after a gap is identified?
Staff can raise a corrective action or training gap, assign focused work, review completion evidence, and record validation or a re-test. This keeps follow-through connected to the exercise that exposed the gap.
Can reports be shared with different audiences?
Facilitators control when reports are released to authorized participant groups. Reports can also be printed or exported to HTML and PDF for approved leadership and audit workflows.
Is the public sample report based on customer data?
No. The public sample is fictional and contains no customer, participant, or production data. Its structure and scoring logic mirror the report MetisForge produces.
Bring MetisForge to your team
Start with a pilot.
A pilot can start with your industry, threat, exercise objectives, and team structure so you can assess the workflow against a scenario that matters to your organization.