University

Cyber exercise university: lessons and a glossary for security leaders

Field note

11 lessons in three tracks and a 50-term glossary for security leaders who plan, buy or sit in exercises. Start with Basics if you are new to exercising, or go straight to Running an exercise if your next tabletop is on the calendar.

Editorial assessment · Assessed from vendor sites, product pages and published pricing, September 2026

U-1Basics: formats and roles

What each exercise format tests, and who belongs in it.

Lesson 1 · 2 min readWhat is a cyber range?A cyber range is a controlled environment where security teams practise detecting and responding to simulated attacks. Types, what to look for, and example platforms.Lesson 2 · 2 min readDiscussion-based vs operations-based exercises: which one to runWhat each kind tests, what it costs in time, and where crisis simulation fits.Lesson 3 · 3 min readCyber range vs tabletop exercise vs hands-on labsCyber range, tabletop exercise, crisis simulation, hands-on labs and awareness training compared: what each tests, who it trains, time needed and example platforms.Lesson 4 · 3 min readWho should be in a cyber tabletop exercise, and what each seat is forPlayers, facilitator, evaluator and observers, and how to handle absent decision-makers.

U-2Running an exercise

Planning, injects, facilitation and the debrief.

Lesson 5 · 4 min readHow to run a cyber tabletop exerciseA practical plan for an incident response tabletop exercise: objectives, scenario, roles, injects, hotwash and after-action report, built on CISA's free Tabletop Exercise Packages.Lesson 6 · 2 min readHow to write exercise objectives you can gradeTurn 'improve readiness' into objectives an evaluator can mark met or not met.Lesson 7 · 3 min readHow to write tabletop exercise injects and a master scenario events listAnatomy of an inject, the MSEL columns, pacing, and contingency injects.Lesson 8 · 3 min readHow to run a hotwash after a cyber exerciseThe debrief straight after the exercise, and what it must capture.

U-3Evidence and programs

Turning single exercises into evidence and a program.

Lesson 9 · 2 min readHow to read an after-action report: five checks for a CISOFive checks that separate a useful report from a meeting summary.Lesson 10 · 3 min readHow to map cyber exercise evidence to frameworks and regulationsWhat framework mapping means, and which records actually count as evidence.Lesson 11 · 3 min readHow to build an annual cyber exercise programFrom one tabletop a year to a calendar that retests its own findings.

U-4Glossary

50 terms from tabletop exercises, crisis simulation, cyber ranges and the regulations that ask for them, with sources for terms that come from a standard or regulator.

Read the full glossary

U-5Frequently asked questions

Where should I start?

With What is a cyber range and discussion-based vs operations-based exercises if the formats are new to you, or with writing exercise objectives if you are planning an exercise now.

Are the lessons based on standards?

Where a lesson relies on a standard or regulator, it cites it: mainly CISA's Tabletop Exercise Packages, NIST SP 800-84, NIST SP 800-61 Rev. 3 and the SEC's 2023 disclosure rules. The rest is general practice, and each lesson lists its sources.

Do the lessons recommend a vendor?

No. Where a vendor feature illustrates a point, the lesson names it and links to the review. Scores live on the rankings.