Choose Reflex Security if
- You have no one to facilitate and want the session run end to end by AI.
- The exercise is a discussion among leaders in a video call, and a transcript is the record you need.
MetisGrid vs Reflex Security
An AI that runs the meeting, or a record of what every analyst decided.
Reflex Security builds a live crisis from your organisation's public footprint and puts an AI agent into your video call to facilitate it, with AI adversaries and AI stand-ins for anyone missing. MetisForge is built around the facilitator and the written record: each analyst answers each question, the facilitator scores it, and the report traces every finding to those answers.
Side by side
MetisForge and Reflex Security, topic by topic.
MetisForge is the cyber exercise application in the MetisGrid platform. Reflex Security statements reviewed October 2026.
| Topic | MetisForge | Reflex Security |
|---|---|---|
| How an exercise runsWhere the exercise happens | In the browser: the facilitator runs a console and each analyst answers in their own workspace, with timers and team chat. Use it alongside your own call or room. | An AI agent facilitates the session inside Zoom, Meet or Teams and joins the call. Asynchronous team play is supported. |
| AnswersHow participants respond | Each analyst writes their own answer to each question. Every answer is attributed, timestamped, and timed from the moment the question was revealed. | Participants discuss in the call; sessions are captured and transcribed, and findings point to moments in the conversation. |
| FacilitatorWho runs and judges the exercise | A human facilitator paces the exercise, reveals questions, and scores each answer against the scenario's rubric. AI drafts; it does not make the final assessment. | The AI agent facilitates. AI agents also play adversaries and stakeholders and fill empty seats, including the CEO's. |
| ScenarioHow the scenario is built | AI drafts the scenario from your industry, threat, difficulty and objectives, grounded in your own documents and current threat intelligence. You review and edit every inject, question and rubric before it runs. | One-click generation from OSINT about your company, optionally enriched with your telemetry; you can also describe an incident. |
| AdaptationHow the story changes during play | Decision points branch the exercise on the team's choice. During the exercise the facilitator can add an inject or a decision point drafted from the answers so far, and review it before analysts see it. | AI adversaries and stakeholders react to the team's decisions in real time. |
| EvidenceWhat is kept | Answers, scores, facilitator notes, decisions, the event timeline and team chat, kept as one exercise record. | A transcript and recording of the session, turned into team analytics such as dominant voices and missed contributions. |
| ReportWhat you receive and what follows | A complete after-action report: document control, method, question-level scores, findings that cite the inject and answer behind them, corrective actions with owners and due dates, training, SME validation and re-test status. | A report generated when the session ends, with findings traced to the moment they came from, prioritised remediation and benchmarks against other sessions. |
| FrameworksFramework mapping | MITRE ATT&CK techniques on every inject and coverage by tactic in the report. Exercise content lines up with NIST CSF 2.0, ISO 27001, ISO 22301, CIS 17.7, PCI DSS 12.10.2 and DORA testing requirements; no certification is claimed. | Reports are described as mapping to SOC 2, ISO 27001, DORA and cyber-insurance requirements. |
| BuyingPublished plans or prices | Plans are published (Team, Professional, Enterprise, per facilitator seat); prices are quoted while list prices are set during the pilot programme. | No plans or prices published; book a demo. |
| TryingTry before buying | An interactive demo and a full sample report, with no sign-up. | A guided click-through tour with no sign-up. |
Credit where it is due
Where Reflex Security is strong.
- No facilitator needed: the AI agent runs the session, which removes the scarcest resource in most tabletop programmes.
- Absent roles are covered by AI agents, so an exercise can go ahead without the CEO or general counsel in the room.
- Scenarios start from your organisation's own public footprint, which makes them feel specific quickly.
Which fits
When to choose which.
Choose MetisForge if
- You want each analyst's own answer to each question, scored by a person against a rubric, as the record.
- Your facilitator should stay in control of pacing, disclosure and every change to the exercise.
- You need the report to carry findings through corrective actions, training, validation and re-test.
Sources
Read October 2026. Products change; if something here is out of date, write to info@metisgrid.com with a public source.