Afterpath is an interactive report viewer for red team and purple team exercises. It turns a cybersecurity engagement into an attack path story that the board and senior management can take in within minutes, while blue teams, SOC analysts and engineers drill into the technical detail.
Use it for all sorts of red teaming and purple teaming reporting: adversary emulation, scenario-based and assumed-breach testing, detection and response exercises, and replay and purple teaming workshops after a test. It is built in particular for threat-led penetration testing (TLPT) projects under TIBER-EU, its national implementations such as TIBER-FI, and DORA, the EU Digital Operational Resilience Act: scenarios, flags, leg-ups, deviations, detections and root cause analysis follow the TLPT reporting requirements of Delegated Regulation (EU) 2025/1190.
Each scenario is drawn as a descent from the internet towards the critical systems, step by step through the In, Through and Out phases of the Unified Kill Chain. The report shows successful and prevented actions, alternative attack paths, how each detection was handled, MITRE ATT&CK techniques, root causes and prioritised recommendations, with every status given as colour, icon and text.
Afterpath is a viewer only. It does not run tests, collect data or store reports: you open your own engagement file, and it is read in your browser and never leaves your device. There is no backend, no tracking and no network traffic, and the whole app is one HTML file that also works offline.
Compatible files are Afterpath engagement files: JSON (.afterpath.json) in the Afterpath data format, usually written in YAML (.afterpath.yaml) and compiled with the Afterpath command-line tool, which validates the file, fills in ATT&CK technique names, produces separate board and full versions and can encrypt them (.afterpath, AES-256-GCM). The viewer checks every file it opens and lists any problems.
To create a file with an AI assistant, or by hand, follow the authoring reference at afterpathviewer.app/llms-full.txt (a summary is at afterpathviewer.app/llms.txt). Engagement data is highly sensitive: use only AI services approved for it, or a local model.
The viewer needs JavaScript: enable it to open engagement files and the demo engagements.