Method
How the matching works: from your answers to training types and platforms
Short answer
We read each platform's public pages, record which of four training types it sells and eight practical checks, and apply published rules to your finder answers. There are no scores or rankings. The same rules apply to all 12 platforms.
By The Range Desk · Cyber Range Compare · Published 2026-10-11 · Updated 2026-10-13
Desk research from public vendor, standards and regulator pages read on 27 September, 11 October and 13 October 2026. Profiles follow our published method; we did not run the products.
What do we record for each platform?
For each of the four training types we record one of three statuses with a note and a source: Sold (the platform's pages we read describe it), Sold with a condition (it is an add-on, an adjacent product, an individual plan, or covers only part of the type), and Not in our sources (we did not find it). We also record eight checks: hands-on keyboard work, executives and non-technical roles taking part, exercises built around your own environment or tools, reports or evidence for auditors, boards or regulators, a published price, a free start, sessions of an hour or less, and reach across the whole workforce. Each check is Matches, Partly or Not in our sources.
- Filled target: the platform sells this training type on the pages we read
- Hatched target: sold with a condition (an add-on, an adjacent product, or part of the type)
- Dashed target: not in our sources (it may exist; we did not find it)
- Green markers: how far each training type moved up the lane on your answers
How does the finder weigh the training types?
| Question | Answer | Points |
|---|---|---|
| Who is being trained? | SOC analysts and other technical staff | RANGE +3, LABS +3 |
| Who is being trained? | The incident response team, technical and non-technical | RANGE +2, LABS +1, CRISIS +3 |
| Who is being trained? | Executives and the board | CRISIS +5 |
| Who is being trained? | The whole company | LABS +1, AWARE +5 |
| What should they get better at? | Hands-on technical skills | RANGE +3, LABS +3 |
| What should they get better at? | Decisions and coordination under pressure | CRISIS +4 |
| What should they get better at? | Both, in the same programme | RANGE +2, LABS +1, CRISIS +2 |
| What should they get better at? | Spotting and reporting threats in daily work | AWARE +4 |
| Does anyone outside the team need proof? | No formal requirement | No points |
| Does anyone outside the team need proof? | Auditors or the board ask for evidence | RANGE +1, CRISIS +1 |
| Does anyone outside the team need proof? | A regulator we answer to expects exercise or testing evidence | RANGE +1, CRISIS +1 |
| What is the budget position? | Start free and prove value first | LABS +2, AWARE +1 |
| What is the budget position? | We need a published price before a sales call | LABS +1 |
| What is the budget position? | Budget agreed; a sales process is fine | No points |
| How much time can people give? | Minutes at a time, every week | LABS +2, AWARE +2 |
| How much time can people give? | An hour or two per exercise, a few times a year | CRISIS +2 |
| How much time can people give? | Days for a full exercise or a structured programme | RANGE +2 |
Types are ordered by points, highest first; ties keep the fixed order RANGE, LABS, CRISIS, AWARE. The first is Start here. Of the next two in that order, each is Also relevant if its points are at least 3 or half the first type's points, whichever is higher. Types with 0 points are Not suggested by your answers; the rest are Lower on your list. Start here and Also relevant together are your picked types.
How does the finder check platforms?
| Check | When it applies | Matches | Partly | Not in our sources |
|---|---|---|---|---|
| Sells a picked type | For each picked type | 4 | ||
| Sells it with a condition | For each picked type | 1 | ||
| Hands-on keyboard work | SOC analysts and other technical staff; Hands-on technical skills; Both, in the same programme | 2 | 1 | 0 |
| Executives and non-technical roles take part | The incident response team, technical and non-technical; Executives and the board | 2 | 1 | 0 |
| Built around your own environment or tools | Decisions and coordination under pressure; Both, in the same programme | 2 | 1 | 0 |
| Reports or evidence for auditors, boards or regulators | Auditors or the board ask for evidence; A regulator we answer to expects exercise or testing evidence | 2 | 1 | 0 |
| Price published | We need a published price before a sales call | 4 | 2 | 0 |
| Free start (free tier, trial or free material) | Start free and prove value first | 4 | 2 | 0 |
| Sessions of an hour or less | Minutes at a time, every week; An hour or two per exercise, a few times a year | 2 | 1 | 0 |
| Reaches the whole workforce | The whole company; Spotting and reporting threats in daily work | 2 | 1 | 0 |
Each check counts once, even if two answers trigger it. A platform is a candidate only if at least one picked type is sold, or sold with a condition, on its pages.
Only platforms that sell at least one picked type are ordered; the others are listed separately. Platforms with the same total are shown as equals and listed alphabetically. We never show the total as a score.
Why do budget checks count double?
Because budget usually decides a purchase before features do. A team that must start free cannot buy a platform with no free start, however good its scenarios are, and a team that needs a published price before a sales call is better served by a platform that publishes one. Counting these two checks double keeps the finder honest about that.
What does Not in our sources mean, and is it fair?
It means we did not find the item on the pages we read. It counts zero, not against the platform. It does affect order: a platform whose pages describe a free tier can match a free-start check, and one whose pages do not cannot. Where this cuts against a platform that offers more than its pages say, the fix is a source, not a guess: send it through the contact page and we will add it.
Which platforms are covered, and why these 12?
12 platforms that sell security training, exercising or range validation with public pages detailed enough to record: BreachRx, Cloud Range, Conducttr, Cyberbit, Cytactic, Hack The Box, iluminr, Immersive Labs, KnowBe4, Reflex Security, SimSpace and TryHackMe. KnowBe4 is included because awareness training is the fourth type and buyers often confuse it with incident response training. SimSpace is included as a range vendor, although its pages now centre on validating AI agents and teams rather than on training. We do not cover consultant-delivered tabletops as platforms; they appear as context on the tabletop and crisis simulation page.
Where do the facts come from?
- Vendor product pages, pricing pages, blog posts and press releases, read on 27 September or 11 October 2026. Each fact on the site carries its source link and read date.
- Vendor figures such as learner counts, customer counts or time savings, and analyst placements such as Forrester or Gartner mentions, are quoted as the vendor's statement and are never our finding.
- Where a platform does not publish a price, we write Not published.
- Standards and regulator material comes from the public pages of CISA, NIST and the U.S. SEC.
What are the limitations?
Public sources only. No hands-on testing, no demos, no vendor interviews. A platform's pages describe what it sells, not how well it trains your people. Our notes are thinner in places than each vendor's full material, which is why the Not in our sources status exists. Use the finder to decide what kind of training to buy and what to ask in a trial or proof of concept, not as a test result.
How are platforms ordered?
Plain platform lists show Reflex Security first and the rest alphabetically. That does not change the rules or the facts: the same rules apply to every platform, they are published on this page, platforms with equal fit are listed alphabetically, Reflex is listed first only in plain platform lists outside the finder, and Reflex's profile lists its limits, including that it is not a hands-on lab platform or a cyber range (its Investigation Console lets technical players query simulated data, but there is no lab library or range), that it is not awareness training, and that it publishes no price and has no free tier. With other answers, other platforms come first: SOC analysts starting free are pointed to TryHackMe, a SOC team under a regulator with days to train to Cyberbit and Immersive Labs, executives who need a price first to Hack The Box, and a whole company starting free to KnowBe4.
How do we handle corrections?
Send a correction through the contact page with the topic Correction and a public source. We check it against the platform's page and update the data; finder results recompute automatically.
Questions people ask
Did you test these platforms?
No. Every fact comes from public vendor pages read on 27 September or 11 October 2026.
Can a vendor pay to appear first?
No. Order comes only from the published rules and your answers. Plain platform lists show Reflex Security first and the rest alphabetically; finder results are ordered by fit.
Why no scores?
Because the right training depends on who you are training and why. A single number would hide the thing that matters to you, such as whether a platform has a range at all, or whether you can start without a sales call.