CYBRARY Forge Labs
Guided, hands-on labs on real-looking Windows and Linux desktops.
Your workspace
Jump into what your plan includes, then see how you're doing. Training room · Defender playbook · Response plan.
What you can do
A good place to start.
Forge Scenarios
Self-paced cases and drills you can do in a sitting.
Your progress
Coach score
0starting
decisions 0 · hands-on 0 · live runs 0 · ready at 85Next: Answer the decision drill for “Notice it”.
Stations
Notice it
lab not run · drill unanswered
Confirm it
lab not run · drill unanswered
Cut the machine off
lab not run · drill unanswered
Close the route
lab not run · drill unanswered
Keep the evidence
lab not run · drill unanswered
Remove the access
lab not run · drill unanswered
Put it back
lab not run · drill unanswered
Write it down
lab not run · drill unanswered
How you compare with real breaches
0 live runs · average response 0Global median dwell time: 11 days (Mandiant M-Trends, global median dwell). You have not held a breach on a run yet.
Median dwell before ransomware is deployed: 5 days (Sophos Active Adversary, median ransomware dwell). You have not held a breach on a run yet.
Average time to identify a breach: 181 days (IBM Cost of a Data Breach, mean time to identify). You have not answered an alert on a run yet.
Average time to contain a breach: 60 days (IBM Cost of a Data Breach, mean time to contain). You have not isolated a machine on a run yet.
Fastest observed breakout from first host to second: 51 minutes (CrowdStrike Global Threat Report, average eCrime breakout time). You have not isolated a machine on a run yet.
Source: CrowdStrike Global Threat Report, average eCrime breakout time
Your runs
No live breach runs recorded yet. Open a run on the defender page and the clocks land here.