Cyber exercise and security training platform FAQ

A controlled environment that simulates networks and tools so teams can practise detecting and responding to attacks. In a live-fire range exercise, defenders respond to an attack actually running in it. More: What is a cyber range.

A discussion-based exercise in which decision-makers work through an incident scenario and decide what they would do. CISA publishes over 100 free Tabletop Exercise Packages to run one yourself. More: How to run a cyber tabletop exercise.

A classic tabletop follows a prepared scenario and injects. A crisis simulation reacts to players' decisions and usually delivers the incident through simulated channels such as email, calls and news. Both are discussion-based. More: Discussion-based vs operations-based exercises.

No. Awareness platforms such as KnowBe4 train every employee to spot and report threats like phishing. Incident response exercises prepare the smaller group that runs an incident. Most organizations need both, bought separately.

The people who would make the real decisions: the incident commander, technical leads, legal, communications, the business owner and the executive who makes the final call, plus a facilitator and an evaluator who do not play. More: Who should be in a cyber tabletop exercise.

Often enough to retest the gaps from the last one. Platforms that cut preparation time make more than one exercise a year practical. More: How to build an annual cyber exercise program.

Of the seven we score, Conducttr publishes all four team licences and Hack The Box publishes one business plan. TryHackMe publishes individual plans only. Reflex Security, Immersive Labs, Cyberbit and iluminr publish no price. More: Calculator.

Conducttr publishes four annual team licences from £11,950 to £25,725, each for up to 40 participants per session, excluding tax. Behavioural assessment (Assessment Toolkit) is extra, from £4,536 a year. More: Conducttr review.

The Professional plan is published at $2,500 per seat per year, or $250 per seat per month. The Lite, Base and Ultimate plans and Crisis Control are not priced publicly; Lite has a 14-day free trial. More: Hack The Box review.

Yes. CISA's Tabletop Exercise Packages are free templates you facilitate yourself. TryHackMe has a free individual tier, and HTB Academy offers a free start. Hack The Box's business Lite plan has a 14-day free trial.

Incident response firms, such as CrowdStrike and Palo Alto Networks Unit 42, sell facilitated tabletop exercises as a service. A platform suits teams that want to exercise more often on their own schedule. We score platforms only. More: Rankings.

Which roles can play in the same exercise, what happens when players make an unexpected decision, what the report contains, how many staff hours one exercise takes, and what the price is per. More: 12 questions for vendors.

An AI crisis simulation platform that replaces the scripted tabletop with an adaptive adversary and simulated stakeholders. It ranks 2 of 7 (6.8 of 10), leading on realism and effort to run, and scores 2 on hands-on depth, 2 on breadth and 1 on pricing. More: Reflex Security review.

One platform across every audience: hands-on labs, a live-fire range on your own tools, cyber drills and crisis simulation. It ranks 1 of 7 (7.5 of 10). It publishes no price. More: Immersive Labs review.

For technical teams, yes: it scores 9 on hands-on depth, and Crisis Control adds a facilitated tabletop with optional hands-on investigation. It ranks =3 of 7 (6.7 of 10). More: Hack The Box review.

It brings executive, legal, communications and risk teams into the same incident as the SOC, with SOC findings triggering executive decisions. It is sold only as an add-on to a Cyberbit Readiness plan. Cyberbit ranks =3 of 7 (6.7 of 10). More: Cyberbit review.

Browser-based labs with a free individual tier, plus a SOC Simulator, a Threat Hunting Simulator, Live Breach Exercises and AI-generated tabletops. It ranks 6 of 7 (6.5 of 10). More: TryHackMe review.

Evidence for boards and regulators: board-ready dashboards, benchmarking, and evidence trails for frameworks such as DORA, APRA CPS 230 and ISO 22301. It scores 9 on evidence, the highest in the set, and ranks =3 of 7 (6.7 of 10). More: iluminr review.

A crisis exercise platform for teams that design their own exercises, simulating news, social media and messaging around the players. It is the only vendor here with a full public price list and ranks 7 of 7 (6.1 of 10). More: Conducttr review.

KnowBe4 sells security awareness training and simulated phishing for the whole workforce, a different category from exercising the incident response team. It is reviewed so readers can see where it fits. More: KnowBe4 review.

Each platform gets a 0–10 score on seven criteria from public vendor material. The total is each score multiplied by its weight, divided by the sum of the weights: realism 22, cross-team 20, evidence 16, effort to run 14, hands-on depth 12, breadth and free access 8, pricing 8. More: How we assess.

No. Scores are assessed from vendor sites, product pages and published pricing, September 2026, with no trials, demos or vendor interviews. Every page says so.

Yes. The calculator lets you set your own weights and re-ranks the seven platforms, and every per-criterion score is published on the rankings.

Send a correction with a public source to editors@securitytraining.co. We check the source, update the data, and the scores recompute. Changes are dated on the affected page.