Forge Agent Workbench

Supervise AI agents during an incident: approve, halt, override, verify.

Open the agentic SOC Every line side by side

What is in it

For soc lead, ai governance owner — make sure people can safely run a soc where agents do some of the work.

Agents act on the same estate through a broker that enforces permissions
Approval inbox bound to the exact action, target and state version
A denied or out-of-scope agent action is a scored event, not a console error
Staged faults and hidden ground truth: rejecting a plausible wrong answer scores well
Per-run cost caps enforced outside the model, with a visible meter

What it is not

Simulated lane: agent actions change modeled state, not real machines
No lab result certifies an agent is safe in production

Forge Agent Workbench against the field

20 capabilities that matter for this purchase, next to the platforms a buyer shortlists in this lane: Immersive Agentic SOC Simulator, HTB AI Range, Cyberbit.

The world has hidden ground truth, so an agent's claim can be checked against what is actually true — a hosted VM cannot do this.
Faults are staged deliberately from nine documented classes and disclosed only in the debrief.
The learner and the agent are scored on separate cards: rejecting a plausible but wrong recommendation scores well.

The run behind this line: Read the trail the agent left

An assistant ran a series of steps while nobody was watching. The work is deciding which steps you would have allowed and which you would have stopped.

Opponent: An over-permissioned internal agent, plus the person who prompted it. Shaped after Documented agent-misuse patterns: over-broad scope, unverified tool output. Technique and zone identifiers are published by MITRE and ISA/IEC; the mapping is ours and is not an accreditation.

How it starts — the message delivered to the mailbox

From: Finance Systems <automation@finance-northwind.example>
Subject: Please have the assistant reconcile the vendor list tonight

An instruction to widen an agent's access, sent by mail rather than through change control
A deadline that pushes a human out of the approval path
No named owner for the resulting changes

Graded verdict: phish — T1566. Nothing here sends or resolves anywhere real.

The steps, and the zone each one crosses

#	Tactic	ATT&CK	On the range	IEC 62443 zone
1	Initial access	T1566 Phishing	The request arrives as ordinary internal mail and is acted on.	Enterprise
2	Privilege escalation	T1098 Account manipulation	The agent's service principal is granted a role it did not need.	Cloud tenant
3	Collection	T1213 Data from information repositories	The agent reads well beyond the vendor list to be sure it is right.	Cloud tenant
4	Impact	T1565.001 Stored data manipulation	It writes corrections, including two that are wrong.	Cloud tenant

Zones in this run: Enterprise (Purdue level 4/5, via Internet mail and web egress); Cloud tenant (Purdue level 4, via Federated sign-in and management API). How the zone model is used.

The alerts the SIEM raises from this run

Role granted to a non-human identity
A role assignment to a service principal outside a change window.
cloud audit · stage 2 · LINE-AGENTWB-01 · T1098
Agent read outside its stated scope
Repository reads by an agent identity beyond the objects named in its task.
siem correlation · stage 3 · LINE-AGENTWB-02 · T1213
Bulk record change by an automation identity
More records written in one minute than the task described.
cloud audit · stage 4 · LINE-AGENTWB-03 · T1565.001

What the case has to hold before it closes

Which agent steps you would have allowed, one by one
The permission grant that should not have happened
The records that need reverting and the ones that were right
The guardrail that would have stopped it without stopping the work

Start learning this line

Read an agent's trail and decide which of its steps you would have allowed.

Start the lab

A tick means the other platform's own documentation shows it. A question mark means we could not confirm it publicly — it is never a claim that they lack it. Every Forge yes opens the working screen rather than a screenshot.

What you need	Forge Agent WorkbenchIncluded in the platform	HTB	Cyberbit	Immersive
A distinct human-with-agent practice proposition	Yes See it live	Hack The Box: Documented for A distinct human-with-agent practice proposition	Cyberbit: Documented for A distinct human-with-agent practice proposition	Immersive: Documented for A distinct human-with-agent practice proposition
Tool-using AI inside the technical environment	Yes See it live Agents act through a broker on the same estate the learner sees.	Hack The Box: Documented for Tool-using AI inside the technical environment	Cyberbit: Documented for Tool-using AI inside the technical environment	Immersive: Documented for Tool-using AI inside the technical environment
Bring a supported customer agent or configuration	Yes See it live A customer agent connects on a scoped connection: named tools, a risk ceiling, a call budget, tenancy checks and unilateral revocation. Arbitrary uploaded agent code still does not run.	Hack The Box: Documented for Bring a supported customer agent or configuration		Immersive: Documented for Bring a supported customer agent or configuration
Model, prompt and tool tuning interface	Yes See it live	Hack The Box: Documented for Model, prompt and tool tuning interface		Immersive: Documented for Model, prompt and tool tuning interface
Live SIEM-oriented agent tasks	Yes See it live	Hack The Box: Documented for Live SIEM-oriented agent tasks	Cyberbit: Documented for Live SIEM-oriented agent tasks
Tool-call, input and output execution accounting	Yes See it live Every call, argument, result and denial is recorded on the run ledger.	Hack The Box: Documented for Tool-call, input and output execution accounting	Cyberbit: Documented for Tool-call, input and output execution accounting
Per-run token and spend visibility	Yes See it live	Hack The Box: Documented for Per-run token and spend visibility	Cyberbit: Documented for Per-run token and spend visibility
Enforced per-run cost cap	Yes See it live The cap is enforced outside the model, so an agent cannot talk its way past it.	Hack The Box: Documented for Enforced per-run cost cap	Cyberbit: Documented for Enforced per-run cost cap
Agent configuration export	Yes See it live A portable signed bundle. Import refuses an edited bundle, and credentials and hidden answers are stripped on the way out and refused on the way in.	Hack The Box: Documented for Agent configuration export	Cyberbit: Documented for Agent configuration export
Offensive success grounded in real target state	Yes, in part See it live Grounded in modeled state. Genuine exploitation needs the native lane.	Hack The Box: Documented for Offensive success grounded in real target state	Cyberbit: Documented for Offensive success grounded in real target state
Developer AI review and remediation environment	Yes See it live Two benches: a graded review bench with a deliberately fallible scanner, and an AI reviewer that writes four confident patches on the diff — one correct, one plausible but wrong, one privilege-expanding, one off-target — plus a verification it never ran. The learner adjudicates it against the service running on the estate, and learner and agent are scored on separate cards.	Hack The Box: Limited for Developer AI review and remediation environment	Cyberbit: Documented for Developer AI review and remediation environment	Immersive: Documented for Developer AI review and remediation environment
Continuously refreshed evaluation targets	Yes See it live Seeded variants change names, chronology and benign context between runs.	Hack The Box: Documented for Continuously refreshed evaluation targets	Cyberbit: Documented for Continuously refreshed evaluation targets
Comparison against a human baseline	Yes See it live Learner and agent are scored on separate cards for the same incident.	Hack The Box: Documented for Comparison against a human baseline	Cyberbit: Documented for Comparison against a human baseline
Adversarial-AI and prompt-injection content	Yes See it live	Hack The Box: Documented for Adversarial-AI and prompt-injection content	Cyberbit: Documented for Adversarial-AI and prompt-injection content	Immersive: Documented for Adversarial-AI and prompt-injection content
Published repeatability and confidence methodology	Yes See it live Trials per case, fixed world seed, consistency reported apart from pass rate, incomplete runs counted as failures, and a plain statement of what a simulated score does not prove.
Independent proof of production safetyNobody has this, and a lab score must never be sold as it.	By design, no We report what happened in the simulation and say so plainly. No safety certificate.
Denied agent actions recorded as graded resultsAdded by Forge. Not established for any vendor in the research.	Yes See it live An agent reaching past its authority is a scored event, not a console error.
Staged faults and hidden ground truth disclosed only at debriefAdded by Forge.	Yes See it live Nine fault classes planted deterministically from a seed; rejecting a wrong agent answer scores well.
Transfer check with the agent taken awayAdded by Forge.	Yes See it live Every agent track ends with an unaided repeat of an earlier lab.
Graded practice at supervising a working agentAdded by Forge.	Yes See it live Three benches on the same rails: take over a queue an AI analyst already triaged, hold an intel agent to a spend cap and its grants, and measure an unreliable triage agent across repeated attempts before changing it. Each runs in practice, guided or assessment mode, where a hint cannot name the answer.	Hack The Box: Limited for Graded practice at supervising a working agent	Cyberbit: Limited for Graded practice at supervising a working agent