Rankings · 2026
Best cyber range and tabletop exercise platforms of 2026
Immersive Labs ranks first (7.5 of 10) as the only platform with strong labs, a live-fire range and crisis simulation together. Reflex Security ranks second (6.8) and leads on realism and effort to run, which makes it the pick for replacing a scripted tabletop. Hack The Box, iluminr and Cyberbit tie at 6.7, each for a different reason.
Editorial assessment · Assessed from vendor sites, product pages and published pricing, September 2026
3-1How do the seven platforms rank?
Readiness score (editorial assessment, 0–10). It measures how well a platform helps a CISO exercise the people who respond to an incident, weighted toward the response team. It is not a measure of overall product quality.
| Rank | Platform | Realism | Cross-team | Evidence | Effort to run | Hands-on depth | Breadth and free access | Pricing | Weighted score |
|---|---|---|---|---|---|---|---|---|---|
| 1 | Immersive LabsTop pick for one platform across every audience | 8 | 8 | 8 | 7 | 9 | 9 | 1 | 7.5 |
| 2 | Reflex SecurityTop pick for replacing the annual tabletop | 9 | 9 | 8 | 9 | 2 | 2 | 1 | 6.8 |
| =3 | Hack The BoxBest for technical teams that also need a tabletop | 6 | 7 | 7 | 5 | 9 | 8 | 6 | 6.7 |
| =3 | iluminrTop pick for board and regulator evidence | 7 | 9 | 9 | 8 | 2 | 6 | 1 | 6.7 |
| =3 | CyberbitBest live-fire range with an executive add-on | 7 | 8 | 7 | 5 | 9 | 7 | 1 | 6.7 |
| 6 | TryHackMeBest free starting point for SOC skills | 6 | 5 | 7 | 8 | 8 | 9 | 3 | 6.5 |
| 7 | ConducttrBest for teams that design their own exercises | 7 | 8 | 6 | 5 | 1 | 5 | 10 | 6.1 |
Criterion leaders
- Realism: Reflex Security (9)
- Cross-team: Reflex Security and iluminr (9)
- Evidence: iluminr (9)
- Effort to run: Reflex Security (9)
- Hands-on depth: Immersive Labs, Hack The Box and Cyberbit (9)
- Breadth and free access: Immersive Labs and TryHackMe (9)
- Pricing: Conducttr (10)
KnowBe4 is listed but not scored: it sells security awareness training, a different category. See the KnowBe4 review.
3-2Which platform wins on each criterion?
No platform leads everywhere. The totals reward whoever fits a response-team brief; the criterion leaders tell you who fits yours.
- Realism 9 / 10: Reflex Security. Builds the scenario from the organization's public footprint, can add its telemetry, and runs an unscripted AI adversary that reacts to each decision.
- Cross-team 9 / 10: Reflex Security. Designed to put technical, legal and executive teams in one exercise; AI agents fill seats for absent roles, including the CEO. iluminr. Built for boards, executives, crisis teams and risk functions, from single-player microsimulations to multiplayer team drills.
- Evidence 9 / 10: iluminr. Board-ready dashboards, benchmarking by department, region and role, and evidence trails for DORA, APRA CPS 230, ISO 22301, NIST CSF and other frameworks.
- Effort to run 9 / 10: Reflex Security. Scenario in minutes, a sixty-minute session, and an AI facilitator that joins Zoom, Meet or Teams; asynchronous play is supported.
- Hands-on depth 9 / 10: Immersive Labs. Browser labs against live systems across AI, application, cloud, OT and offensive security; Dynamic Threat Range uses tools such as Sentinel, Elastic, Splunk and CrowdStrike. Hack The Box. Academy modules, Professional Labs, machines and CTFs, plus optional hands-on investigation inside the tabletop. Cyberbit. Cloud range with 100+ team exercises and 2,800+ solo labs; RangeForce content uses tools from CrowdStrike, Splunk, Palo Alto Networks, Fortinet and Microsoft.
- Breadth and free access 9 / 10: Immersive Labs. Labs, drills, ranges and crisis simulations for audiences from non-technical staff to SOC analysts and executives. TryHackMe. 8M+ users and a free individual tier; the largest open community in this set.
- Pricing 10 / 10: Conducttr. Four licences published, £11,950 to £25,725 a year, each for up to 40 participants per session.
3-3The ranked platforms
1. Immersive Labs: Top pick for one platform across every audience
Immersive Labs sells one platform, Immersive One, that covers most of this matrix. Hands-on labs run in the browser against live systems across AI, application, cloud, OT and offensive security. Dynamic Threat Range runs live-fire attacks against a customer's own stack using licensed tools such as Microsoft Sentinel, Elastic, Splunk and CrowdStrike. Crisis simulations put executives and incident leaders through scenarios with dynamic injects and AI actors they can question.
It scores 8 or 9 on five of seven criteria. The company says it is trusted by more than 30% of the Fortune 100 and describes itself as #1 in the Forrester Wave 2026.
Watch-outs
- No published pricing.
- Breadth means program ownership. Someone has to decide which of labs, drills, range and crisis simulation each team gets.
Sources: immersivelabs.com, Crisis Sim, Digital tabletop exercises, Technical exercises, Labs · Reviewed Sep 2026
2. Reflex Security: Top pick for replacing the annual tabletop
Reflex Security does one thing: it replaces the scripted tabletop with a crisis simulation. It builds a scenario from the organization's public footprint in minutes, can enrich it with the customer's telemetry, and runs an AI adversary that is not scripted, while simulated stakeholders apply pressure. The vendor describes a sixty-minute session with an AI facilitator inside Zoom, Meet or Teams, and AI agents in any seat nobody fills, including the CEO's.
The after-action report is generated when the session ends, and each finding points back to the moment in the simulation it came from. Reflex scores 9 for realism, cross-team exercising and effort to run. It scores 2 for hands-on depth and 2 for breadth, and 1 for pricing.
Watch-outs
- No labs, no range and no content library: analysts do not build technical skills here.
- No published pricing and no free tier.
Sources: reflexsecurity.io, Reflex vs Immersive Labs, Alternatives · Reviewed Sep 2026
=3. Hack The Box: Best for technical teams that also need a tabletop
Hack The Box is a technical training platform first: Academy modules, Professional Labs, machines and capture-the-flag events, with 4.3m+ learners. Crisis Control, its tabletop product, runs platform-led exercises with scenario waves, injects, emails, news and social updates, and can add hands-on investigation for technical players.
It is the only scored platform besides Conducttr that publishes a business price: the Professional plan lists at $2,500 per seat per year. Six baseline tabletop scenarios are documented, each based on a named threat actor or incident.
Watch-outs
- Crisis Control pricing is not published.
- Tabletops are tailored with facilitator guidance, which takes more lead time than a self-serve generator.
Sources: Business, Tabletop exercises, Pricing, hackthebox.com, HTB Academy · Reviewed Sep 2026
=3. iluminr: Top pick for board and regulator evidence
iluminr comes from operational resilience rather than security training. Its microsimulations run 3–5 minutes for one person and 30–45 minutes for a team, alongside facilitated tabletops and incident response management.
It leads the set on evidence: board-ready dashboards, benchmarking by department, region and role, and evidence trails for DORA, APRA CPS 230, ISO 22301, NIST CSF, ISO 27001, FFIEC and others. That makes it strong for regulated firms that must show exercising to a supervisor.
Watch-outs
- No technical hands-on content.
- No published pricing.
Sources: iluminr.io, Pricing · Reviewed Sep 2026
=3. Cyberbit: Best live-fire range with an executive add-on
Cyberbit runs a cloud cyber range for SOC and incident response teams with more than 100 team exercises and 2,800 solo labs. RangeForce has joined Cyberbit, adding team exercises on tools from CrowdStrike, Splunk, Palo Alto Networks, Fortinet and Microsoft.
Crisis Sim 360 connects the range to the boardroom: SOC findings trigger decisions for executive, legal, communications and risk teams in one exercise, and exercises can branch on each answer.
Watch-outs
- Crisis Sim 360 is only sold as an add-on to a Cyberbit Readiness plan.
- No published pricing.
Sources: cyberbit.com, Crisis simulation, RangeForce · Reviewed Sep 2026
6. TryHackMe: Best free starting point for SOC skills
TryHackMe has the widest reach in this set: 8M+ users, 800+ labs and a free individual tier. The business product adds a SOC Simulator, a Threat Hunting Simulator, Live Breach Exercises and AI-generated tabletop exercises.
Its tabletops start from industry, attack vector and tech stack, launch in a stated 10 minutes on average, and align to NIST and ISO 27035. They are built for security teams more than for executive crisis groups.
Watch-outs
- Business pricing is not published.
- Executive and board participation is not the product's focus.
Sources: Business, Tabletop exercises, Pricing · Reviewed Sep 2026
7. Conducttr: Best for teams that design their own exercises
Conducttr is a crisis exercise platform for organizations that design their own exercises. Its virtual desktop shows each player a first-person view of the crisis, with simulated news, social media and messaging, and an AI assistant drafts exercises.
It publishes a full price list: four annual team licences from £11,950 to £25,725, each for up to 40 participants per session. It is general crisis software, not cyber-specific, and has no technical training.
Watch-outs
- Exercise design is your job: templates help, but this is not a one-click scenario.
- Behavioural assessment is a paid add-on (Assessment Toolkit, from £4,536 a year).
Sources: conducttr.com, Pricing · Reviewed Sep 2026
3-4Which should you shortlist?
- Your SOC cannot detect or contain fast enough: Cyberbit, Immersive Labs, or on a tighter budget TryHackMe and Hack The Box.
- Your last tabletop was a slide deck nobody remembers: Reflex Security, then Immersive Labs Crisis Sim.
- A regulator or board wants proof of exercising: iluminr, then Immersive Labs.
- You have an exercise designer and want control of every inject: Conducttr.
- You need every employee to report phishing: an awareness platform such as KnowBe4, not anything on this list.
3-5What did we leave out?
Consultant-run tabletop services from incident response firms (such as those sold by CrowdStrike and Palo Alto Networks Unit 42) are services, not platforms, and are not scored. CISA's free Tabletop Exercise Packages are the baseline every paid option should beat; the field guide shows how to use them. Pure awareness training is covered in one unscored review.
3-6Frequently asked questions
Which cyber range is best for a SOC team?
In our assessment, Immersive Labs and Cyberbit score highest for hands-on depth among range vendors (9 of 10). Immersive's Dynamic Threat Range attacks your own stack; Cyberbit offers 100+ team exercises and 2,800+ solo labs on a cloud range.
Which tabletop exercise platform is best for executives?
Reflex Security and iluminr both score 9 of 10 for cross-team exercising. Reflex focuses on a live breach with an adaptive adversary; iluminr focuses on operational resilience evidence for boards and regulators.
Which platforms publish their prices?
Conducttr publishes all four team licences (£11,950 to £25,725 a year). Hack The Box publishes one business plan ($2,500 per seat per year). TryHackMe publishes individual plans. Reflex Security, Immersive Labs, Cyberbit and iluminr do not publish prices.