CYBRARY Practice. Defend. Build. Compete.
One range that already does what you are buying eight tools to cover
Guided labs, a live SOC, red and blue ranges, competitions, crisis exercises and an AI agent workbench — the same estate, the same scoring, the same reports. Below is Forge beside the platforms you are probably also looking at, across 115 capabilities. Forge answers yes on 106 of them, and every yes opens the real thing in the product rather than a screenshot. Ten of those rows are new since the September research: real editors and command-line tools, a working mail client with graded phishing reporting, wireless and wide-area links, shared network drives, per-scenario SIEM and cases, paste-a-scenario authoring, the seller demo room, and the whole desktop exercise on a phone.
Forge Labs against the field
15 capabilities that matter for this purchase, next to the platforms a buyer shortlists in this lane: TryHackMe, Hack The Box Academy, RangeForce.
- Because the estate is simulated rather than hosted, a class of five hundred costs the same to run as a class of five — nobody waits for a machine.
- Every run is reseeded, so artifact names and file hashes differ per learner and last year's answers are worthless.
- Scoring reads what actually happened at the shell: a command that returned access denied does not tick the step off.
| What you need | Forge LabsIncluded in the platform | HTB | THM | RangeForce |
|---|---|---|---|---|
| Free entry route for an individual | Yes, in part Runs through Cybrary's existing free tier rather than a Forge-specific plan. | Hack The Box: Documented for Free entry route for an individual | TryHackMe: Documented for Free entry route for an individual | RangeForce: Limited for Free entry route for an individual |
| Paid individual subscription | Yes, in part Sold as part of Cybrary, not separately packaged yet. | Hack The Box: Documented for Paid individual subscription | TryHackMe: Documented for Paid individual subscription | |
| Guided hands-on labs | Yes See it live | Hack The Box: Documented for Guided hands-on labs | TryHackMe: Documented for Guided hands-on labs | RangeForce: Documented for Guided hands-on labs |
| Job-role learning paths | Yes See it live | Hack The Box: Documented for Job-role learning paths | TryHackMe: Documented for Job-role learning paths | RangeForce: Documented for Job-role learning paths |
| Foundational command line and operating-system learning | Yes See it live Seven Linux distributions and Windows 11, each with distro-accurate command behavior. | Hack The Box: Documented for Foundational command line and operating-system learning | TryHackMe: Documented for Foundational command line and operating-system learning | RangeForce: Documented for Foundational command line and operating-system learning |
| Advanced offensive target practice | Yes, in part See it live Attack paths are modeled, not executed. Genuine exploitation needs the native lane. | Hack The Box: Documented for Advanced offensive target practice | TryHackMe: Documented for Advanced offensive target practice | RangeForce: Limited for Advanced offensive target practice |
| Vendor's own practical certification program | Coming Cybrary certification exists; Forge-assessed credentials are not built. | Hack The Box: Documented for Vendor's own practical certification program | TryHackMe: Documented for Vendor's own practical certification program | |
| Completion certificates and CPE route | Yes, in part See it live | Hack The Box: Documented for Completion certificates and CPE route | TryHackMe: Limited for Completion certificates and CPE route | RangeForce: Limited for Completion certificates and CPE route |
| Cloud-specific learning | Yes See it live | Hack The Box: Documented for Cloud-specific learning | TryHackMe: Documented for Cloud-specific learning | RangeForce: Limited for Cloud-specific learning |
| Application-security and developer exercises | Yes See it live Graded secure code review: a seeded pull request with one real flaw, a scanner report that is partly wrong, and a dependency list that is mostly a distraction. | Hack The Box: Documented for Application-security and developer exercises | TryHackMe: Documented for Application-security and developer exercises | RangeForce: Limited for Application-security and developer exercises |
| Operational-technology content and environments | Yes See it live A graded plant shift across Purdue levels, scored on the safe response rather than the IT one — containment that would blind the control room loses marks. | Hack The Box: Documented for Operational-technology content and environments | RangeForce: Documented for Operational-technology content and environments | |
| SCADA practice mapped to IEC 62443 zones, conduits and security levels | Yes See it live The plant is built to a zone and conduit model with target security levels, and every graded decision is listed against the foundational requirement it exercises — so a coverage answer comes from what learners did, not from a syllabus. | |||
| Structured feedback after practice | Yes See it live Referee scoring with per-step reasoning and a debrief that discloses what was staged. | Hack The Box: Documented for Structured feedback after practice | TryHackMe: Documented for Structured feedback after practice | RangeForce: Documented for Structured feedback after practice |
| A working corporate mail client inside the exerciseOutlook on the Windows desktop, Evolution on Linux: folders, threads, attachments, full headers and message source. | Yes See it live Phishing training is graded both ways — a missed lure costs the same as reporting a legitimate message. | TryHackMe: Limited for A working corporate mail client inside the exercise | ||
| The full desktop exercise usable on a phoneA trackpad cursor, edge-following viewport, gestures, an on-screen keyboard and the taskbar folded into one reachable control. | Yes See it live | TryHackMe: Limited for The full desktop exercise usable on a phone |
Bake-off metrics
The three numbers a buyer asks for, live in the product
Most evaluations come down to the same three asks: how fast does the team respond, what is the one number for the whole program, and what does the framework coverage look like. All three are on one screen in Forge, computed from runs already recorded — nothing to export into a spreadsheet first.
Response clocks
MTTD, MTTR, MTTC and time to close, each against a published target, with mean, median, best and the change against the team's earlier runs.
Readiness score
One number for the program, with all five parts and their weights shown — coverage, quality, speed, currency and pass rate — so it can be argued with rather than believed.
Coverage maps
MITRE ATT&CK, MITRE ATLAS and NIST-NICE. A filled square is proven by a passed run, an outline is on the range but unproven, a dashed square is a content gap we admit to.
One thing we will not do: quote a peer benchmark. We do not hold other organizations' runs, so the comparison offered is against published targets and against the same team's earlier windows. An invented industry average would be the easiest number on this page to draw and the least honest.
Every yes is clickable
No roadmap dressed up as a feature. "See it live" opens the working screen in Forge; where something is still being built, the page says "Coming" and nothing more.
Fair to the other platforms
A tick means their own documentation shows it. A question mark means we could not confirm it publicly — ask them, and we will correct this page. There is no total and no winner badge, because these rows are not worth the same to you.
What we will not claim
Nothing in Forge executes for real. That is why a class of 500 costs no more to run than a class of five — and why genuine exploitation against live binaries, and any proof that a control is safe in production, belong somewhere else.