CYBRARY See which attack paths matter, and prove the fix worked.
Rank modeled attack paths to your crown jewels from your digital twin, re-ranked after every refresh, with choke points, what-if, verified fixes and one-click team drills.
Northbridge Payments, modeled right now
A fictional company built from five recorded samples, scored live in your browser by the same engine customers use. Pick a path, then break it.
Watch approved facts become ranked action
A 16-second walkthrough of attack paths, choke points, remediation economics and proof on the next twin snapshot.
- 01
Facts from your twin
Firewall rules, networks, accounts, admin rights, sign-ins and backups from your exports and read-only connectors — each dated.
- 02
Ranked, explained paths
Every route from the internet or a phished account to a crown jewel, scored by target value, ease of each step, length and evidence age.
- 03
Fix, verify, drill
Pick choke points, see the predicted score, save a plan. A later snapshot verifies it. Any path becomes a team exercise.
Rankings built from real inputs, not a black-box number.
Attack vector
Each step is named: internet exposure, remote service, phishing, credential theft, privilege abuse or lateral network reach — with its ATT&CK technique.
Severity
A 0–10 severity per step and a critical / high / medium / low label per path, so triage starts with the worst.
Likelihood × impact
Likelihood multiplies across every step (long chains are harder); impact comes from how valuable the crown jewel is. Old evidence lowers both.
Remediation cost
Every choke point carries a concrete fix, effort in hours, a cost band and the disruption it causes — ranked by risk removed per hour.
Same question — which paths reach what matters — answered a different way.
Forge Exposure
- Reads facts you already have: exports, read-only connectors and an optional read-only on-prem collector.
- Every ranking is explainable step by step — vector, severity, likelihood, impact and evidence age.
- What-if shows the predicted score before a change ships; a fix only counts once a later snapshot proves it.
- Any path becomes a scored team drill on an emulated copy of your environment — practice the response, not just the patch.
- Part of Cybrary Forge: the same twin powers recovery drills, change checks and training.
XM Cyber
- Uses its own sensors and integrations to discover assets and exposures continuously.
- Mature attack-graph engine with choke-point analysis across hybrid environments.
- Covers vulnerability and misconfiguration discovery that Forge does not do itself.
- Does not publicly describe turning paths into team exercises or proving fixes against later snapshots.
Best together or on its own: teams already running an exposure scanner can feed its findings into the twin and use Forge for ranking, proof and drills; teams without one get ranked paths from the data they already export.
Security leaders
One exposure score with a trend, the five fixes that cut it most, and proof when they land — ready for the board.
Network and identity teams
Concrete changes with effort and disruption up front, checked on the model before the change window.
SOC and IR teams
Rehearse the exact path an attacker would take, scored, before it happens for real.
How it compares
Features only, from public vendor material. ✓ documented · ? not stated publicly — ask the vendor · – outside what they sell. Forge Exposure models paths from collected facts; it does not scan, run agents or attack anything.
| Capability | Forge Exposure | XM Cyber | Tenable One | Wiz | Forward |
|---|---|---|---|---|---|
| Ranks attack paths to critical assets | |||||
| Combines network reach with identity (no MFA, admin rights, sign-ins) | |||||
| Choke points: fixes that break the most paths | |||||
| Re-ranks automatically when facts changeForge: after every scheduled twin refresh. | |||||
| Severity, likelihood and attack vector on every path | |||||
| Fixes ranked by risk removed per hour of effort, with cost band | |||||
| MITRE ATT&CK names on each step | |||||
| What-if: predicted score before a fix ships | |||||
| Fix counted as done only when a later snapshot proves it | |||||
| Turns a path into a scored team drill | |||||
| Discovers assets itself with sensors or scanningForge only reads exports and read-only connectors. | |||||
| Mathematically verifies network behavior |
Questions buyers ask
Does Forge scan or attack our network?
No. It models paths from facts you export or collect read-only. Nothing is probed or exploited.
How fresh are the rankings?
They re-rank after every twin refresh — scheduled from every 24 hours, or whenever the on-prem collector reports (hourly by default).
Where do the cost numbers come from?
Each fix type carries a standard effort estimate, cost band and disruption level. They are planning figures to compare fixes, not quotes.
Can we see why a path ranks where it does?
Yes. Every path lists its steps, attack vectors, severity, likelihood, impact and how old the evidence is.
Based on public vendor pages, checked October 2026. Sources:
- XM Cyber: https://xmcyber.com/continuous-exposure-management/
- Tenable One: https://www.tenable.com/products/tenable-one
- Wiz: https://www.wiz.io/solutions/attack-path-analysis
- Forward Networks: https://www.forwardnetworks.com/
Put your people and AI to work.
Browse the library, try a demo, or talk to us about your team's goals.