Are attack chains built by people or by AI?

Both. Testers build chains on the canvas, linked to their findings. Automated AI Attack Chains are generated from the same real findings through your AI assistant, AttackForge MCP and AttackForge Skills.

Do chains stay accurate after retesting?

Yes. Each step links to the live finding, so retest results are reflected in the chain.

Can attack chains go into reports?

Yes. Attack chains can be automatically included in your project reports.

Does AttackForge host the AI model?

No. AI-generated chains are produced by your own AI assistant connected to AttackForge over MCP.

What can the AI assistant see in AttackForge?

Only what you allow. An administrator enables each MCP tool per user or group, each user has to grant their own AI assistant access, and an administrator can see and revoke MCP sessions. You choose the assistant, and with a local model your findings never leave your computer.

What do I need for AI-generated chains?

AI MCP, which is included with AttackForge Enterprise and is an add-on for AttackForge Core, plus AttackForge Skills, which are available on request.

Attack Chains

Show the breach path, not just the findings.

Build attack chains on a canvas where every step links to the real finding, test case and evidence. Tag MITRE ATT&CK techniques, see the chokepoints, and keep the chain accurate through every retest.

Start Free Trial

Built for teams that explain, prioritize and fix risk.

Pentest providers

Deliver the story behind the findings: how an attacker gets from the first foothold to the outcome your client cares about.

CISOs reporting to the board

Explain risk as a path to a business outcome, with the one or two fixes that break it.

Remediation teams

Start with the chokepoint. Fixing the right step can close several routes at once.

Visual canvas

A canvas that's wired to the evidence.

Lay out each step of the attack on a visual canvas. Every node is a live link to a vulnerability, test case or piece of evidence in the project, so reviewers can click straight through to the proof.

Steps link live to vulnerabilities, test cases and evidence.
Open a chain directly from any linked vulnerability.
Build chains with the same findings your report already uses; there is no separate copy to maintain.

DetailsEvidence5Attack Chains1History

Full compromise of Office 365 Administration Portal1/1AddEdit

Attack ObjectiveFull compromise of Office 365 Administration PortalExternal AttackerAttacker who has gained access to an internal network host via a phishing, social engineering or malware attack; via compromised Internet-facing host; or by breaching physical security controls at any Wayne Enterprises site with connectivity to internal network.Initial AccessActionCollect information from internal network.ReconnaissanceVulnerabilityHosts Respond with Hashes/Challenge-Responses to Spoofed Hostnames

MITRE ATT&CK built in

Speak the language your defenders already use.

Tag each step with MITRE ATT&CK tactics and techniques. Chokepoints, the steps that several routes depend on, are highlighted so the highest-leverage fix stands out.

1. Initial Access
T1190Exploit Public-Facing Application
2. Privilege Escalation
T1068Exploitation for Privilege Escalation
3. Credential Access
T1003.005OS Credential Dumping: Cached Domain Credentials
4. Lateral MovementChokepoint
T1021Remote Services

Retest-aware

Downgrade a finding on retest and the chain knows.

Because each step is linked to the live finding, retest results flow through to the chain. When a step is fixed, the path it supported is no longer open, so the chain always reflects where the project stands today.

Before retest

V1Critical
V3High
V4High
V5High
OBJcustomer database accessed

After retest

V1Critical
V3Fixed
V4High
V5High
OBJcustomer database accessed

Automated AI Attack Chains

From real findings to board-ready attack chains.

Automated AI Attack Chains are generated from a project's real findings, using your AI assistant over AttackForge MCP together with AttackForge Skills.

Interactive Attack Chain Explorer

Animated attack routes with "Best fix" and "Break chain", so stakeholders can see what each remediation does to the path.

MITRE ATT&CK executive one-pager

A single page that maps the chain to ATT&CK for leadership and the board.

MITRE ATT&CK portrait debrief

A portrait-format debrief for walking stakeholders through the chain step by step.

Cyber Kill Chain view

The same findings arranged across the seven Cyber Kill Chain stages.

Your AI assistant sees only what you allow: an administrator enables each MCP tool per user or group, each user grants their own assistant access, and MCP sessions can be reviewed and revoked. With a local model, findings never leave your computer.

AI MCP is included with AttackForge Enterprise and is an add-on for AttackForge Core. AttackForge Skills are available on request.

Try it: break the chain.

Illustrative sample built with fictional data. In AttackForge, chains are built from a project's real findings.

Open routes to objective: 2 of 2