Method
How we assess security training and exercise platforms
Each platform gets a 0–10 score on seven criteria, from public vendor material only. The weighted total leans toward exercising the response team: realism and cross-team exercising carry 42% of the weight. We did not test any product, and every score has a written reason.
Editorial assessment · Assessed from vendor sites, product pages and published pricing, September 2026
4-1What do we score?
| Criterion | Weight | What we look for |
|---|---|---|
| Realism | 22 | Scenario realism and adaptation: does the exercise react to what players decide, and is it built from the organization's own environment and threats? |
| Cross-team | 20 | Executive and cross-team exercising: can executives, legal, communications and the technical responders take part in the same exercise? |
| Evidence | 16 | Evidence for boards, auditors and insurers: what the exercise leaves behind (after-action reports, benchmarks, framework mapping). |
| Effort to run | 14 | Effort to run: how much preparation, facilitation and scheduling one exercise takes, and so how often a team can realistically run one. |
| Hands-on depth | 12 | Technical hands-on depth: labs, ranges and keyboard work for analysts and responders. |
| Breadth and free access | 8 | Content breadth and free access: size of the content library, audiences covered, free tier or community. |
| Pricing | 8 | Pricing transparency: is a price published that a buyer can budget against before a sales call? |
Weights sum to 100. The total is the sum of each score multiplied by its weight, divided by 100, computed on the page from the data. We display one decimal and treat equal displayed values as ties.
4-2Why these weights?
The reader we write for is a CISO deciding how to prepare the people who respond to an incident. That puts the most weight on whether the exercise behaves like an incident (realism, 22) and whether the people who make the hard calls are in it (cross-team, 20). Evidence (16) and effort to run (14) come next because an exercise that produces nothing usable, or takes a month to prepare, gets run once a year. Hands-on depth, breadth and pricing still count, at 28 combined, and they are where technical training platforms earn their points. A reader whose problem is analyst skill should re-weight toward hands-on depth; the per-criterion scores are published so that is easy to do.
4-3What counts as evidence?
- Vendor product pages, documentation and pricing pages, fetched and read in September 2026. Each review lists the pages used.
- Public standards and regulator pages (CISA, NIST, SEC) for definitions and requirements.
- Where a vendor does not publish something, we write "Not published" and score it on what is public. A missing price scores low on pricing transparency; it is not guessed.
- We do not use customer quotes, review-site ratings or testimonials, and we do not publish star ratings.
4-4What are the limits of this assessment?
Limitations
Public sources only; no hands-on testing, no trials, no demos and no vendor interviews. Vendor claims such as launch times and user counts are reported as the vendor states them. Products change quickly in this category, so every page carries its review date. A score is an editorial judgement against the criteria above, not a measurement.
4-5How are corrections handled?
Vendors and readers can send corrections with a public source to editors@securitytraining.co. We check the source, update the data file, and the scores recompute. Changes are dated on the affected page.
4-6Who is scored, and who is not?
Seven platforms are scored: Reflex Security, Immersive Labs, Hack The Box, Cyberbit, TryHackMe, iluminr and Conducttr. KnowBe4 is reviewed but not scored, because security awareness training is a different category. Consultant-delivered tabletop services and CISA's free packages are discussed but not scored.
4-7Frequently asked questions
Did you test these platforms?
No. It is assessed from vendor sites, product pages and published pricing, September 2026. We say so on every page.
Can I re-weight the scores?
Yes. Every criterion score is published on the rankings page and in each review. Multiply each by your own weights and divide by the total weight.