Cybersecurity exercises wey dey follow industry workflows
24 industry views, 18 technical surfaces, and eight offline exercises wey dey connect CTF learning to continuity, repair, and recovery.
Dis article na machine translation.
2026-10-07. We dey introduce di MFCI v0.1 design and public educational materials. Dem never measure model scores yet.
A solved cybersecurity challenge need connection to di work wey e dey protect. Finance teams must keep authorized payments running while dem dey hold unapproved changes. Healthcare teams must preserve care and patient privacy. Manufacturing teams must maintain safety and monitoring. Mithril don organize coverage by industry, technical surface, and workflow so dem fit put those constraints into di evaluation from di beginning.
## Learn from competitions and add constraints wey business get
Di DEF CON 33 rules dey combine attack and defense with patching and service continuity. Di 2026 Cloud Village dey cover cloud and IAM topics, while Black Hat training evaluations include CTF, practical, scenario, and project formats. These dey inform our design; we no dey reproduce their challenges or combine their scores. [DEF CON 33 rules](https://nautilus.institute/files/rules-2025-100.pdf), [Cloud Village 2026](https://www.cloud-village.org/dc34), [Black Hat training exams](https://blackhat.com/html/certificates.html).
Our exercises get three stages. A dey ask participants to distinguish suspicious, normal, and inconclusive evidence. B dey ask dem to repair source or configuration while dem dey preserve legitimate activity. C dey introduce incomplete evidence over time and dey ask for decisions about holding, isolating, continuing, and restoring operations. Recovery include checking ledger and permission consistency.
## Define di coverage denominator first
Our initial taxonomy get 24 industry views and 18 technical surfaces. E dey use di [NIST glossary's 16 US critical infrastructure categories](https://csrc.nist.gov/glossary/term/critical_infrastructure_sectors) as a reference and e dey add education, ecommerce, media, hospitality, professional services, real estate, crypto assets, and AI services. These categories dey overlap. Dem no be a universal classification or a complete mapping to Japan's infrastructure framework.
Di repository get 72 industry scenario specifications, 18 cross-industry specifications, and eight offline exercises. Specifications, working educational fixtures, and model measurements wey dem verify independently get separate coverage. To name 24 industries and 18 surfaces no mean say all 432 intersections don dey tested. Di [coverage register](https://github.com/mithril-lang/frontier-cyber-index/blob/main/catalog/coverage.json) also dey show di gaps.
## Evaluate continuity together with protection
| Industry | First exercise | Wetin must continue |
| --- | --- | --- |
| Finance | Bank detail changes wey voice request | Authorized payments and independent approval |
| Healthcare | Emergency access and audit | Care, patient separation, and recorded grants |
| Manufacturing | Maintenance access wey don expire | Safety, asset scope, and monitoring |
| IT/SaaS | Tenant authorization and OAuth | Customer isolation and legitimate synchronization |
| Logistics | Webhooks wey dem modify and repeat | Exactly-once application and ledger consistency |
| Media | Consent and disclosure for synthetic video | Revocation handling and provenance review |
These na original fictional scenarios, no be reconstructions of actual incidents. A system no fit earn a high score by denying everything. We also dey report legitimate completion, false positives, evidence gaps, costs, and time. MFCI defensive capability D, offensive capability O, and safety S dey remain separate. Di planned Mithril comparison dey use di same model and tasks for paired configurations.
## Start with di exercises and inspect di gaps
Di [repository](https://github.com/mithril-lang/frontier-cyber-index) include synthetic evidence, answer templates, a grader, and public reference answers. No network access or real person's voice or video dey needed. Di eight L0 exercises dey teach evidence-based decisions; dem no dey replace code repair or extended cyber ranges. Positive and negative grader controls dey establish educational behavior, no be frontier capability.
Next na industry expert review, execution environments, independent hidden graders, private holdouts, and human baselines. Read di [industry catalogue](https://github.com/mithril-lang/frontier-cyber-index/blob/main/docs/INDUSTRY-CATALOG.md) to identify di business constraints wey dey miss from your scenario. Di [AI video and agent report](https://github.com/mithril-lang/frontier-cyber-index/blob/main/reports/EMERGING-TECH-MISUSE-2026-10-07.md) dey separate sourced observations from Mithril analysis.