Build cyber skills in environments that respond to your decisions.

Finding-to-exercise

From a real finding to team practice to a verified fix

When a manager approves an Anvil finding, Forge AI drafts a private practice lab from it. Your team reviews and publishes it, trains on it, and the real retest is recorded against the same finding, so you can see what was found, who practiced and whether the fix held.

1. 1. Approved finding

   Only manager-approved findings can become exercises.

2. 2. Private draft

   Forge AI writes an emulated practice lab from customer-safe details. Hosts, addresses, credentials and commands are stripped first.

3. 3. Human review

   A person with lab creator rights edits and publishes. It stays private to your company.

4. 4. Team practice

   People trained, pass rate and time to finish show on the finding.

5. 5. Real retest

   Fixed, partly fixed or not fixed is recorded with a readiness snapshot. Not fixed? Draft an updated exercise.

• Built only from manager-approved findings
• Scrubbed of hosts, addresses, emails, secrets and commands before AI sees it
• Always private to the finding's company
• Published only by a person, through the normal completability check
• Readiness snapshot saved with every retest result
• Per-engagement summary export (CSV)

Practice results come from an emulated exercise and show readiness, not proof the real system is fixed. Training never authorizes a retest; that still needs its own window and signed rules of engagement.

Runnable procedures

Change a procedure, rehearse it, keep the result as evidence

Your incident procedure becomes roles, ordered steps, what each seat may do and who must approve. Every new version is flagged for a Crisis Sim rehearsal, each step is scored on time, late, skipped or missing its approval, and readiness is tracked version by version.

For leaders

Is our plan getting better?

• Readiness per procedure version, with the change that moved it
• A dated record of every rehearsal to share with the board
• See which approvals slow the response before a real incident does

For responders

What do I do, and when?

• Your steps, your seat and the minute each one is due
• Exactly what you're allowed to do, and who has to sign off
• Rehearse the version you'll actually use, not last year's

1. 1. Write or paste

   Build steps by hand, or paste your runbook and Forge AI proposes them. A person approves.

2. 2. New version

   Every change is a new version with a step-by-step diff, and admins are told a rehearsal is due.

3. 3. Rehearse

   Link a Crisis Sim room: each seat ticks its own steps on the room clock and approvers sign off in the room.

4. 4. Score

   On time, late, skipped or missing approval — scored the same way every time, no AI in the score.

5. 5. Evidence

   Readiness per version, so you can see whether the change helped.

• Roles, permissions and approvals on every step
• Versioned, with a diff of what changed
• Rehearsal flagged on every new version
• Deterministic step scoring — no AI in the score
• Readiness trend across versions
• AI only drafts; a person approves

Procedures are rehearsed in Crisis Sim; the hands-on steps behind them are practiced in Forge Labs.

Rehearsal results come from an emulated exercise. They show readiness, not proof of a real-world response.