Skip to content
Range Compare

The Range Desk · Note

Cyber range or crisis simulation first? A decision for a team with one budget line

Short answer

If the last incident was lost in detection and containment, buy the range first. If it was lost in escalation, authority and communication, buy the crisis exercise first. Either way, cover the other gap cheaply until the next budget cycle: labs or free tabletop packages.

By The Range Desk · Cyber Range Compare · Published 2026-10-04 · Updated 2026-10-11

Desk research from public vendor, standards and regulator pages read on 27 September, 11 October and 13 October 2026. Profiles follow our published method; we did not run the products.

4 min readCyber rangeCrisis simulationBuying

Sources: vendor and regulator pages read 27 September and 11 October 2026.

Many security leaders have one training line in the budget and two obvious needs: a technical team that should practise on a range, and a leadership group that has never rehearsed a serious incident. This note is about choosing which comes first.

What does each one fix?

A cyber range fixes problems in detection and technical response: missed alerts, slow triage, poor hand-offs between analysts, containment steps nobody had practised. A crisis simulation fixes problems in decisions: who has authority to isolate systems or pay for outside help, when legal and communications are brought in, how the executive team agrees what to say and to whom.

The two overlap at one point, the hand-off from technical findings to business decisions. Some platforms exercise that hand-off directly. Cyberbit's Crisis Sim 360 links technical escalations to executive decisions, though it is sold only as an add-on to a Cyberbit Readiness range plan. Immersive Labs sells both a live-fire range and crisis simulation on one platform, and Cloud Range lists simulation-supported tabletop exercises next to its range.

How do you decide which comes first?

Look at the last real incident, or the nearest thing to one. Mark where the longest avoidable delay happened.

  • If it was before anyone with authority knew there was a problem, the gap is technical. Range first.
  • If the technical team knew quickly but decisions dragged, or the wrong people were told late, the gap is in decisions. Crisis simulation first.
  • If you have not had an incident, look at your last exercise or audit. If there has been no exercise at all, the decision side is almost certainly untested, and a crisis exercise is the faster way to find out how bad the gap is.

What does each leave undone?

A range leaves the boardroom untested. Your analysts may contain an intrusion well, and the organisation can still lose a day arguing about disclosure. A crisis exercise leaves the technical depth untested. Your executives may make crisp decisions on information the SOC took too long to produce.

How do you cover the other gap cheaply?

If you buy the range, cover decisions with a free CISA tabletop package: over 100 are published, with scenarios, discussion questions and an after-action report template. You will spend facilitation time instead of licence money.

If you buy the crisis simulation, cover technical skill with hands-on labs, which have the most transparent prices of any type. Free individual tiers exist, and Hack The Box publishes a Professional plan at $2,500 per seat per year.

What about time?

The two types demand different time from different people. A team range exercise takes analysts away from the queue for hours, scheduled in advance. A crisis exercise takes senior people's time, which is usually scarcer. Platforms differ a lot here: Reflex Security describes sixty-minute sessions with scenarios built in minutes, and iluminr describes microsimulations of 3–5 minutes for one person and 30–45 minutes for a team. Shorter formats make it realistic to exercise leaders more than once a year.

What about evidence?

If a regulator or auditor is asking specifically for evidence that your incident response plan has been exercised, the crisis exercise usually answers that question more directly, because its output is an after-action report about the plan. Range evidence answers a different question, about technical readiness. If the question you are being asked is about the plan, that is a reason to start there.

Where does Reflex Security fit?

Reflex Security sells crisis simulation only, built from the organisation's own environment, with an adversary that reacts to each decision. Technical players can query simulated logs, endpoint telemetry and network traffic in its Investigation Console, but it is not a range and has no lab library, so a team whose first gap is technical should look at the range and lab platforms instead.

The training type finder turns these questions into a recommendation for your answers.

Sources

  • Cyber range

    A team detects and responds to a live simulated attack in a realistic environment, using real security tools.

  • Tabletop and crisis simulation

    The people who own decisions in an incident work through a scenario and decide what to do, from a scripted discussion to an adaptive simulation.

  • Training type finder

    Five questions that weigh the training types and list matching platforms.