CYBRARY Forge Programs
Run cyber training for a whole team and report it honestly.
What is in it
For l&d lead, security capability owner, university program lead — put a cohort through real work and be able to show what each person actually did.
- Assign from the full library by role, difficulty and machine
- Cohorts share one estate, with seats, roles and a lead who starts the session
- Live instructor view of the work in progress, not a report the next morning
- Decision drills paired to the lab that teaches the step
- Progress mapped to NIST CSF, NICE and the DoD workforce framework for the training plan
What it is not
- Completion is inferred from the run, so there is no box to tick
- Forge scores are evidence of practice, not a certification
Forge Programs against the field
34 capabilities that matter for this purchase, next to the platforms a buyer shortlists in this lane: Immersive, RangeForce, TryHackMe for Business, Hack The Box Academy.
- Assignments, rosters and progress roll up per company, with per-company branding applied inside every lab.
- Skill is checked with the assistance removed at the end of each track.
| What you need | Forge ProgramsIncluded in the platform | HTB | THM | RangeForce | Immersive |
|---|---|---|---|---|---|
| Free entry route for an individual | Yes, in part Runs through Cybrary's existing free tier rather than a Forge-specific plan. | Hack The Box: Documented for Free entry route for an individual | TryHackMe: Documented for Free entry route for an individual | RangeForce: Limited for Free entry route for an individual | Immersive: Limited for Free entry route for an individual |
| Paid individual subscription | Yes, in part Sold as part of Cybrary, not separately packaged yet. | Hack The Box: Documented for Paid individual subscription | TryHackMe: Documented for Paid individual subscription | ||
| Guided hands-on labs | Yes See it live | Hack The Box: Documented for Guided hands-on labs | TryHackMe: Documented for Guided hands-on labs | RangeForce: Documented for Guided hands-on labs | Immersive: Documented for Guided hands-on labs |
| Job-role learning paths | Yes See it live | Hack The Box: Documented for Job-role learning paths | TryHackMe: Documented for Job-role learning paths | RangeForce: Documented for Job-role learning paths | Immersive: Documented for Job-role learning paths |
| Foundational command line and operating-system learning | Yes See it live Seven Linux distributions and Windows 11, each with distro-accurate command behavior. | Hack The Box: Documented for Foundational command line and operating-system learning | TryHackMe: Documented for Foundational command line and operating-system learning | RangeForce: Documented for Foundational command line and operating-system learning | Immersive: Documented for Foundational command line and operating-system learning |
| Advanced offensive target practice | Yes, in part See it live Attack paths are modeled, not executed. Genuine exploitation needs the native lane. | Hack The Box: Documented for Advanced offensive target practice | TryHackMe: Documented for Advanced offensive target practice | RangeForce: Limited for Advanced offensive target practice | Immersive: Documented for Advanced offensive target practice |
| Vendor's own practical certification program | Coming Cybrary certification exists; Forge-assessed credentials are not built. | Hack The Box: Documented for Vendor's own practical certification program | TryHackMe: Documented for Vendor's own practical certification program | ||
| Completion certificates and CPE route | Yes, in part See it live | Hack The Box: Documented for Completion certificates and CPE route | TryHackMe: Limited for Completion certificates and CPE route | RangeForce: Limited for Completion certificates and CPE route | Immersive: Documented for Completion certificates and CPE route |
| Cloud-specific learning | Yes See it live | Hack The Box: Documented for Cloud-specific learning | TryHackMe: Documented for Cloud-specific learning | RangeForce: Limited for Cloud-specific learning | Immersive: Documented for Cloud-specific learning |
| Application-security and developer exercises | Yes See it live Graded secure code review: a seeded pull request with one real flaw, a scanner report that is partly wrong, and a dependency list that is mostly a distraction. | Hack The Box: Documented for Application-security and developer exercises | TryHackMe: Documented for Application-security and developer exercises | RangeForce: Limited for Application-security and developer exercises | Immersive: Documented for Application-security and developer exercises |
| Operational-technology content and environments | Yes See it live A graded plant shift across Purdue levels, scored on the safe response rather than the IT one — containment that would blind the control room loses marks. | Hack The Box: Documented for Operational-technology content and environments | RangeForce: Documented for Operational-technology content and environments | Immersive: Documented for Operational-technology content and environments | |
| SCADA practice mapped to IEC 62443 zones, conduits and security levels | Yes See it live The plant is built to a zone and conduit model with target security levels, and every graded decision is listed against the foundational requirement it exercises — so a coverage answer comes from what learners did, not from a syllabus. | Immersive: Limited for SCADA practice mapped to IEC 62443 zones, conduits and security levels | |||
| Structured feedback after practice | Yes See it live Referee scoring with per-step reasoning and a debrief that discloses what was staged. | Hack The Box: Documented for Structured feedback after practice | TryHackMe: Documented for Structured feedback after practice | RangeForce: Documented for Structured feedback after practice | Immersive: Documented for Structured feedback after practice |
| Organizational learning and administration product | Yes See it live | Hack The Box: Documented for Organizational learning and administration product | TryHackMe: Documented for Organizational learning and administration product | RangeForce: Documented for Organizational learning and administration product | Immersive: Documented for Organizational learning and administration product |
| Assign content and development plans | Yes See it live | Hack The Box: Documented for Assign content and development plans | TryHackMe: Documented for Assign content and development plans | RangeForce: Documented for Assign content and development plans | Immersive: Documented for Assign content and development plans |
| Team and sub-team reporting | Yes See it live | Hack The Box: Documented for Team and sub-team reporting | TryHackMe: Documented for Team and sub-team reporting | RangeForce: Documented for Team and sub-team reporting | Immersive: Documented for Team and sub-team reporting |
| Hiring or skills-assessment workflow | Yes, in part See it live | Hack The Box: Documented for Hiring or skills-assessment workflow | TryHackMe: Limited for Hiring or skills-assessment workflow | RangeForce: Limited for Hiring or skills-assessment workflow | Immersive: Documented for Hiring or skills-assessment workflow |
| Framework-linked readiness | Yes See it live ATT&CK coverage is computed from detections that actually fired, not from a content tag. | Hack The Box: Documented for Framework-linked readiness | TryHackMe: Documented for Framework-linked readiness | RangeForce: Documented for Framework-linked readiness | Immersive: Documented for Framework-linked readiness |
| AI-assisted custom technical content | Yes See it live | TryHackMe: Documented for AI-assisted custom technical content | RangeForce: Limited for AI-assisted custom technical content | Immersive: Documented for AI-assisted custom technical content | |
| Delegated content-creator role | Yes See it live | Immersive: Documented for Delegated content-creator role | |||
| Single sign-on documented in the reviewed source | Yes, in part Auth is in place; an enterprise SSO and LMS launch contract is still being built. | RangeForce: Limited for Single sign-on documented in the reviewed source | |||
| Public API or integration capability | Yes, in part See it live | Hack The Box: Limited for Public API or integration capability | Immersive: Documented for Public API or integration capability | ||
| 44 languages (7 native + 37 AI-translated) | Yes See it live 44 languages (7 native, 37 extended), and technical evidence left untranslated so investigations still work. | Hack The Box: Documented for 44 languages (7 native + 37 AI-translated) | RangeForce: Limited for 44 languages (7 native + 37 AI-translated) | Immersive: Limited for 44 languages (7 native + 37 AI-translated) | |
| Accessibility (WCAG / screen reader / keyboard)Immersive Labs publishes a WCAG 2.2 accessibility statement; Hack The Box documents text-to-speech. Others: verify. | Yes See it live Keyboard and screen-reader paths are verified on every change and the tested scope is published; an independent audit has not been done. | Hack The Box: Limited for Accessibility (WCAG / screen reader / keyboard) | TryHackMe: Limited for Accessibility (WCAG / screen reader / keyboard) | ||
| Voice navigationVoice-driven navigation and command entry. No competitor documents this publicly — verify with each. | Yes See it live Hands-free navigation and terminal input across the Arena and lab desktops. | ||||
| Published concurrency evidence for a full class | Yes See it live Convergence under hostile delivery is computed in front of the reader. A matched benchmark against another vendor exists for nobody, us included. | ||||
| Decision-level coaching from the learner's own trailWhat was opened, revisited, how long before committing, and whether the action had support. | Yes See it live Published with the list of what we never collect: no keystrokes, no clipboard, no screen recording. | ||||
| Contracted rapid custom-delivery service level | Coming | ||||
| NIST CSF, NICE, DoD 8140 and ATT&CK mapping on every activityReported in the customer's own workforce and coverage vocabulary. | Yes See it live | Hack The Box: Documented for NIST CSF, NICE, DoD 8140 and ATT&CK mapping on every activity | RangeForce: Limited for NIST CSF, NICE, DoD 8140 and ATT&CK mapping on every activity | Immersive: Documented for NIST CSF, NICE, DoD 8140 and ATT&CK mapping on every activity | |
| Whole exercise reachable by screen reader and keyboardNot just the portal around the lab — the terminals and consoles themselves. | Yes See it live Our own verification; an independent audit has not been done. | ||||
| A working corporate mail client inside the exerciseOutlook on the Windows desktop, Evolution on Linux: folders, threads, attachments, full headers and message source. | Yes See it live Phishing training is graded both ways — a missed lure costs the same as reporting a legitimate message. | TryHackMe: Limited for A working corporate mail client inside the exercise | |||
| Prospect-driven demo room a seller can run liveA shared session the prospect drives, mirrored read-only, with domain kits, a run sheet and answers to the usual objections. | Yes See it live Bounded profiles and join codes; nothing of the customer's own network is touched. | ||||
| Paste a scenario document and get a wired, editable labEvents, journal records, alerts and the case console are wired automatically, and shown back for checking before anything is created. | Yes See it live Windows log records are corrected against a canonical channel and provider table; a rename writes both journal records, so the old name stays answerable. | TryHackMe: Limited for Paste a scenario document and get a wired, editable lab | Immersive: Limited for Paste a scenario document and get a wired, editable lab | ||
| The full desktop exercise usable on a phoneA trackpad cursor, edge-following viewport, gestures, an on-screen keyboard and the taskbar folded into one reachable control. | Yes See it live | TryHackMe: Limited for The full desktop exercise usable on a phone |
The run behind this line: The morning shift, rung one
The first rung of a role program: a real queue, ordinary tickets, and one item that turns out to matter.
Opponent: Low-skill intruder using a password found in a public breach dump. Shaped after Credential-stuffing intrusions described in annual incident reports. Technique and zone identifiers are published by MITRE and ISA/IEC; the mapping is ours and is not an accreditation.
How it starts — the message delivered to the mailbox
- From
- VPN Gateway <vpn-alerts@northwind-remote.example>
- Subject
- New device enrolled for remote access — was this you?
- Link
- shows “Review enrolled devices”, really points at https://northwind-remote.example/device/confirm
- A security alert that asks for a password rather than telling you to change one
- The time is real — the attacker's enrollment did happen at 03:14
- The domain belongs to the attacker, not the gateway
Graded verdict: phish — T1566.002. Nothing here sends or resolves anywhere real.
The steps, and the zone each one crosses
| # | Tactic | ATT&CK | On the range | IEC 62443 zone |
|---|---|---|---|---|
| 1 | Credential access | T1110.004 Credential stuffing | Reused passwords are tried against the remote-access portal overnight. | Identity |
| 2 | Initial access | T1133 External remote services | One account works and a session opens from an unusual country. | Enterprise |
| 3 | Discovery | T1018 Remote system discovery | The session sweeps for anything answering on 3389 and 445. | Enterprise |
Zones in this run: Enterprise (Purdue level 4/5, via Internet mail and web egress); Identity (Purdue level 4, via LDAP and Kerberos to the domain controllers). How the zone model is used.
The alerts the SIEM raises from this run
Failed sign-ins across many accounts from one address
A single source failing against more than 20 accounts in ten minutes.
directory audit · stage 1 · LINE-PROGRAMS-01 · T1110.004
Remote access session from an unexpected country
A successful VPN session from a geography the account never uses.
network sensor · stage 2 · LINE-PROGRAMS-02 · T1133
Port sweep from a remote-access address
One source touching the same port on many hosts inside a minute.
network sensor · stage 3 · LINE-PROGRAMS-03 · T1018
What the case has to hold before it closes
- The account that worked and where its password came from
- The session start and everything reached inside it
- The tickets in the queue that were genuinely unrelated
- The control change that stops the next attempt
Start learning this line
The first rung of a role program: the morning shift.
Start the lab
A tick means the other platform's own documentation shows it. A question mark means we could not confirm it publicly — it is never a claim that they lack it. Every Forge yes opens the working screen rather than a screenshot.