Cybrary ForgeCYBRARY / FORGE
Back to Forge Offensive
Forge Anvil

Forge Anvil

Run scoped pentests with local tools and reviewable evidence.

Anvil is the pentest program and toolbox for an authorized engagement. It puts approved local tools in one controlled workspace, scopes them to that engagement's targets, ports and testing window, and keeps the evidence each action collects attached to the resulting finding.

Sign in to access Anvil See how it works

From permission to proof

One governed workflow

01

Authorize

Turn signed rules of engagement into approved addresses, ports, actions and testing windows.

02

Pair

Register a tester's device and issue a time-limited lease for one engagement.

03

Test

Run qualified local tools. Every operation is checked against scope before it starts.

04

Review, approve and close

Managers approve findings, sign off exports, retention and client notice, then close.

REAL ASSESSMENT — ADAPTER GOVERNEDStructured operations against the approved target. Broker enforces scope on every run.
engagement: Northbridge external assessment · demoruntime: approved adapter

Authorization preview

Every consequential action stops for a scope decision

Target, technique, testing window and signed rules are checked before an adapter can run. Out-of-scope work is refused and retained as evidence.

AUTHORIZED TO PROCEED

app.northbridge.example:443

Port scan · window open · scope signed

Why teams choose Anvil

Real tools, local execution

Assessment traffic originates from the tester's machine, not from Cybrary infrastructure.

Scope is enforced

The engagement governs targets, ports, testing windows and permitted actions before execution.

Evidence stays attached

Screen context, commands, original output, artifacts, network connections and known capture gaps remain traceable from action to finding.

Three explicit operating modes

Mode is always written on screen. Color is never the only signal.

LAB — SIMULATED

Forge Lab

Execution
Browser simulation
Scope
Simulated estate only
Control
No real network traffic

REAL ASSESSMENT — ADAPTER-SCOPED

Governed assessment

Execution
Qualified local tool adapters
Scope
Approved addresses, ports and window
Control
Broker and sealed-network checks

REAL — EXPERT MODE

Expert evidence workspace

Execution
Approved local or customer tools
Scope
Operator-controlled authorized targets
Control
Evidence capture with limited enforcement

Leaving a lab always requires a fresh authorized engagement and scope review. Simulated targets and permissions never transfer into real testing.

Evidence preview

A finding carries its proof

Reviewers can move from a finding to the exact action, output, artifact and connection that supports it. Missing or interrupted capture is shown as a gap, never silently hidden.

4 capture channels ship today. Other channels retain their literal Building or Planned status.

Walk through the evidence

Finding ANV-014

Administrative interface exposed

High · Review needed

  1. 14:03 · Scope check passed

    10.42.18.24:443 · authorized window open

  2. 14:04 · Tool output captured

    Command, original output and produced artifact linked

  3. 14:06 · Finding drafted

    Evidence citations retained for reviewer approval

Capabilities, grouped by the work

Engagement control

SOW intake, structured scope, rules of engagement, approvals and assignments.

Local toolkit

Qualified tool packs, real terminal sessions, run previews and emergency stop.

Evidence and reporting

Recorded actions, artifacts, findings, remediation guidance and portable packages.

Assisted workflow

Auto-Recon and copilot proposals remain scope-checked, attributed and human-approved.

Team collaboration

Engagement rooms with team chat, shared tasks and handoffs, live presence and a timeline that can't be edited.

Reviewer approval

Findings close only after a manager approves them, with notes. Authors can't approve their own work. Tester and reviewer portals on web and desktop.

Command authorization

The desktop checks assignment, role, stage and testing window with Forge before every command. Refusals are kept as evidence with the reason.

Evidence provenance

Real and practice work labeled apart, rules-of-engagement fingerprints on every command, capture-coverage flags and command-to-finding bookmarks.

Reports and replay

PDF and Word reports with approval status, manager notes, cleanup and proof codes; a printable final report for auditors; a replay of the whole engagement in time order.

Access and closure

The computers that ran commands, an encrypted credential store, an access map drawn only from recorded commands, cleanup tracking with a client link, and a manager sign-off before closure.

Safety and scopeFrequently asked questions Sealed Linux and Windows WSL

Integration status stays literal

Hand work off without flattening it

View all integrations
  • PlexTracBeta

    Reviewed pentest findings and client-facing reports.

  • DradisBeta

    Collaborative assessments with a shared issue library.

  • SysReptorBeta

    Reporting-first teams who want to control their own deployment.

  • GhostwriterBeta

    Enterprise red-team operations logging and reporting.

  • AttackForgeCustomer-led

    Customer-managed pentest programs that own the engagement record.

  • DefectDojoBeta

    Aggregated vulnerability management and engineering follow-up.

Bring governed local testing into Forge

Start with the public workflow, then sign in for entitlement-aware downloads, device management and engagement controls.

Sign in to access AnvilReview safety controls

Finding-to-exercise

From a real finding to team practice to a verified fix

When a manager approves an Anvil finding, Forge AI drafts a private practice lab from it. Your team reviews and publishes it, trains on it, and the real retest is recorded against the same finding, so you can see what was found, who practiced and whether the fix held.

A recorded rehearsal: four seats in one Crisis Sim room tick their steps and sign off.

  1. 1. Approved finding

    Only manager-approved findings can become exercises.

  2. 2. Private draft

    Forge AI writes an emulated practice lab from customer-safe details. Hosts, addresses, credentials and commands are stripped first.

  3. 3. Human review

    A person with lab creator rights edits and publishes. It stays private to your company.

  4. 4. Team practice

    People trained, pass rate and time to finish show on the finding.

  5. 5. Real retest

    Fixed, partly fixed or not fixed is recorded with a readiness snapshot. Not fixed? Draft an updated exercise.

  • Built only from manager-approved findings
  • Scrubbed of hosts, addresses, emails, secrets and commands before AI sees it
  • Always private to the finding's company
  • Published only by a person, through the normal completability check
  • Readiness snapshot saved with every retest result
  • Per-engagement summary export (CSV)

Practice results come from an emulated exercise and show readiness, not proof the real system is fixed. Training never authorizes a retest; that still needs its own window and signed rules of engagement.

See the loop in a demo