CYBRARY Rehearse against an emulated estate grounded in your own environment.
Rehearse against an emulated estate grounded in approved inventory, configuration, identity and assessment information, with source freshness visible throughout.
Northbridge Payments, modeled right now
A customer-shaped demonstration using synthetic values. Five dated sources reconcile into one reviewable model without exposing customer data.
Business service view
Customer Payments
Time-lapse · simulated
A week at the two-site reference estate
Day 1, 00:00 UTC · 140 readings this hour · uptime 100% · overlay accuracy 100%
Headquarters
- ups-1reporting
- sw-core-1reporting
- cam-lobby-1reporting
- hvac-1reporting
Branch office
- ups-1reporting
- sw-1reporting
- cam-door-1reporting
Every reading is simulated and runs through the same intake and overlay as real feeds. A quiet device means lost visibility, never an assumed outage.
From five sources to one decision-ready twin
A 16-second walkthrough of provenance, relationships, drift review, recovery modeling and the handoff to Forge Exposure.
- 01
Your estate, with receipts
Upload exports or connect Microsoft, ServiceNow, AWS, Azure and Check Point. Every fact shows where it came from and how old it is.
- 02
A twin for every tool
Your SIEM, EDR, identity, CMDB, firewall and cloud each appear as a twin, with alerts, compliance evidence and a history timeline.
- 03
Practice from a known state
Lock a baseline, run a scored exercise on it, read what you missed and retest on a new variant.
Feed the twin from the tools you already run.
The twin reads live signals from your estate and paints them onto the 3D view — live, replayed, or modeled. It only ever reads; nothing is sent back and nothing real is controlled.
Microsoft Fabric
Connect a workspace with your company's own credentials and Forge pulls new readings every hour. A test read and a drafted twin are one click away.
Telegraf, OpenTelemetry, MQTT and OPC UA
Point your existing collectors at one intake address with a per-company key. Each source page gives you the config snippet to copy and a paste-a-sample box to see how Forge reads it.
Streaming over WebSockets
Gateways can hold one open socket and push readings the moment they happen — no polling. Every message is acknowledged, uses the same per-company key and formats, and stays strictly one-way.
Inventory import
Bring a NetBox-style device list — names, sites, cables, power feeds — and it becomes the twin's cause-and-effect graph. Unknown references are flagged, never guessed.
Terraform and Helm
Read a plan or rendered chart to lay out a simulated estate: servers, firewalls and networks placed by site. Files are only read — never applied.
Live, replay and what-if
Watch the estate now, scroll back to any moment in the last 30 days, or ask “what if this UPS fails?” Modeled results are always labeled, never mistaken for live.
Cause and effect in 3D
Buildings glow with their worst status; click one for its machines, click a machine for its full chain — power, network, cooling — with adjustable quiet-feed thresholds.
A quiet feed means lost visibility, never an assumed outage. Two devices with the same name at different sites are never merged. Raw readings are kept 30 days; the latest state per device is kept for as long as you keep the twin.
What others call it
“Digital twin” means different things across the market. Here's how vendors name and sell it, from their public material.
| Vendor | Their term | What they sell |
|---|---|---|
| SimSpace | Enterprise replicas, AI Proving Grounds | High-fidelity cyber ranges with security tools and emulated users |
| Cyberbit (incl. RangeForce) | Cyber range | Team and individual live-fire exercises on modeled networks |
| Immersive | Cyber drills, crisis simulation | Workforce readiness exercises and labs |
| Forward Networks | Network digital twin | Mathematical model of network configuration for path and change analysis |
| RedSeal | Network model / digital twin | Network exposure and reachability modeling |
| XM Cyber | Digital twin for attack-path management | Continuous exposure management with attack graphs |
| AttackIQ / Cymulate / Pentera | Breach and attack simulation, validation | Testing real controls with safe attack actions |
Feature matrix
Features only — no pricing, since most of these vendors sell on quote. ✓ documented in the vendor's public material · ? not stated publicly — ask the vendor · – outside what they sell.
| Capability | Forge | SimSpace | Cyberbit | Immersive | Forward | RedSeal | XM Cyber | BAS vendors |
|---|---|---|---|---|---|---|---|---|
| The twin itself | ||||||||
| Twin built from your own estate facts, with the source on every fact | ||||||||
| Models identity, applications, services and policy — not only the network | ||||||||
| Self-service upload of your own exports, with a preview of what gets blanked out | ||||||||
| Customer facts encrypted at rest with a company key | ||||||||
| Recorded samples never shown as live; every source dated | ||||||||
| Flags conflicting sources and possible duplicates for a person to decide | ||||||||
| Dashboard and assurance | ||||||||
| A twin for each SIEM and tool, with health, alerts and history | ||||||||
| Compliance evidence view (NIST CSF, CIS) | ||||||||
| Drift review: what changed since the last locked baseline, plus source health (stale, partial, revoked) | ||||||||
| Approvals expire and are used up by the baseline they lock | ||||||||
| Two admins can't silently overwrite each other's review | ||||||||
| Full change-history timeline and audit log | ||||||||
| One attack step linked across every tool in the twin, with missing tools shown as gaps | ||||||||
| Deleted twins restorable for a set window, with who and when recorded | ||||||||
| Legal hold, retention controls and audited deletion | ||||||||
| Read-only view for learners; only admins edit facts | ||||||||
| Practice and scoring | ||||||||
| Locked baseline — every exercise starts from a known state | ||||||||
| Scored debrief: what you missed, limits, retest on a new variant | ||||||||
| Exercise opens on a full emulated desktop; desktop actions count toward the score | ||||||||
| A serious mistake caps the score and says why | ||||||||
| Linked to a training library and learning paths | ||||||||
| Nothing runs on your real systems | ||||||||
Use-case matrix
What a team would actually buy each platform to do, against the Forge twin and twin dashboard.
| Use case | Forge | SimSpace | Cyberbit | Immersive | Forward | RedSeal | XM Cyber | BAS vendors |
|---|---|---|---|---|---|---|---|---|
| Rehearse incidents on a copy of your own estateForward, RedSeal and XM Cyber model the estate but don't run team exercises on it. | ||||||||
| SOC investigation and detection practice | ||||||||
| Ransomware readiness and recovery drills | ||||||||
| Crisis simulation for the wider business, not just the SOC | ||||||||
| Segmentation and change validation before productionForward and RedSeal verify changes mathematically. Forge shows what a proposed rule opens or closes in the emulated twin, flags stale evidence, then rehearses the response to a change gone wrong. | ||||||||
| Attack-path and exposure analysisThe exposure vendors' home ground. Forge ranks attack paths derived from collected twin facts with a best-single-fix list and turns paths into team drills. | ||||||||
| Validate real security controls with safe attack actionsBAS vendors act on the production estate; Forge applies actions only within the emulated estate. | ||||||||
| Onboarding and upskilling analysts on your actual tools and layout | ||||||||
| Board- and audit-ready evidence of readiness | ||||||||
| AI-agent evaluation in a safe replica |
On-prem collector — in design
A small read-only collector inside your network will add what cloud tools can't see: local admins, host firewall rules, backup agent status and tested reachability between your own subnets. It will only answer a fixed, signed list of read-only questions, only inside subnets you approve, and it never collects file contents, passwords, memory or traffic. It makes outbound connections only, and you can uninstall it or switch it off at any time. It becomes available after a separate security review. Until then you can preview what it adds using a recorded sample.
Based on public vendor pages, checked October 2026; we revisit it regularly. Forge's connected tool views are emulated, not the vendors' original software. Sources:
- SimSpace: https://simspace.com/blog/from-it-to-ot-simspaces-cyber-range-for-simulation-and-testing-in-critical-infrastructure/
- Cyberbit / RangeForce: https://www.cyberbit.com/cyber-range/digital-twins-vs-digital-cousins/
- Immersive: https://www.immersivelabs.com/h2h/immersive-labs-vs-simspace
- Forward Networks: https://www.forwardnetworks.com/forward-enterprise/
- RedSeal: https://www.redseal.net/platform/
- XM Cyber: https://xmcyber.com/glossary/what-is-a-digital-twin-in-cybersecurity/
Put your people and AI to work.
Browse the library, try a demo, or talk to us about your team's goals.