Cyber range and security training FAQ

A cyber range lets a SOC or incident response team practise detecting and responding to a live simulated attack together, usually on real security tools. It is the closest training gets to a real incident for technical staff.

Read more: Cyber range

A range trains a team under a live attack; labs train one person on one skill at a time. Labs are shorter, cheaper and self-paced; ranges test coordination and tooling.

Read more: Hands-on lab libraries

An exercise for the people who make decisions in an incident, in which the scenario changes as it runs: new information arrives, simulated stakeholders push back and, on some platforms, the adversary reacts to each decision.

Read more: Tabletop and crisis simulation

Yes, if it leads to fixes. A discussion-based tabletop tests whether people know their roles and authority. Its weakness is preparation time and how rarely it runs; platforms that generate scenarios make it easier to run more often.

Read more: Tabletop and crisis simulation

It covers the requirement that staff are trained on threats such as phishing. It does not show that your response team has exercised its incident response plan, which is a separate expectation in most frameworks.

Read more: Awareness training

The one that matches the gap your last incident or audit exposed. Technical misses point to labs or a range; slow decisions and confused escalation point to a crisis exercise; clicks and unreported phishing point to awareness training. The finder turns that into a recommendation.

Read more: Training type finder

Of the twelve platforms here, Conducttr publishes a full licence list (£11,950 to £25,725 a year), Hack The Box publishes its Professional plan ($2,500 per seat per year), and KnowBe4 publishes awareness prices from $1.63 to $3.75 per seat per month on a 3-year term. TryHackMe lists business plans at $99 and $199 per month, though we could not confirm whether that is per user. The others do not publish prices on the pages we read.

Read more: Platform fact grid

Yes. TryHackMe has a free individual tier, HTB Academy has a free start, and Hack The Box's Lite business plan lists a 14-day free trial.

Read more: Hands-on lab libraries

Yes. CISA publishes over 100 free tabletop exercise packages, and KnowBe4's free October 2026 awareness kit includes four tabletop exercise documents. Both are material you run yourself.

Read more: Tabletop and crisis simulation

None of the platforms here that sell a team range publishes its price, so expect a quote. Ask what is included: number of team exercises, seats, whether the range can use your own tools, and reporting.

Read more: Cyber range

Consultant prices are not published on the pages we read. TryHackMe states its tabletop exercises are 56% more affordable than the average consultancy tabletop; that is the vendor's own figure.

Read more: TryHackMe

Real people from the team you want to train, one scenario or lab path that matches your gap, a fixed time box, and an agreed test of what the output must show, such as an after-action report your auditors would accept.

Read more: Reading a training vendor's price page

Cloud Range, Cyberbit and Immersive Labs sell hands-on labs and a cyber range without a condition. Hack The Box and TryHackMe sell labs and list simulators or range access with conditions.

Read more: Cyber range

No. Reflex Security sells crisis simulation: it builds a crisis from your environment and runs an adversary that reacts to each decision, for technical, legal and executive teams. Technical players can query simulated logs in its Investigation Console, but it has no lab library or range.

Read more: Reflex Security

Labs, cyber drills, a live-fire range on the customer's own tools, and crisis simulation, all on Immersive One. It is the only platform here selling the first three types without a condition. It does not publish prices.

Read more: Immersive Labs

No. Cyberbit states Crisis Sim 360 is only offered as an add-on to a Cyberbit Readiness plan.

Read more: Cyberbit

Hack The Box's platform-led tabletop: scenario waves, injects, emails, news and social updates, optional hands-on investigation, and a Golden Report at the end. Its price is not published.

Read more: Hack The Box

Boards, executives, crisis and risk teams, with short microsimulations and evidence mapped to regulations such as DORA, ISO 22301 and APRA CPS 230. It has no technical labs.

Read more: iluminr

It is built for designing and running your own crisis exercises, simulates news and social media around the players, and publishes a full price list.

Read more: Conducttr

Awareness training and simulated phishing for every employee, with published per-seat prices. It is not incident response training and sells no range, labs or crisis simulation platform.

Read more: KnowBe4

Live-fire attack simulations across IT, OT/ICS, cloud and hybrid environments on a replica of your network with licensed SOC tools, 1,500+ hands-on labs and team exercises, and simulation-supported tabletop exercises. It does not publish prices.

Read more: Cloud Range

SimSpace builds an environment and runs an attack against your team, your tools or your AI agents, but its pages now centre on validating AI agents under the name AI Proving Grounds. Labs and crisis exercises are not described.

Read more: SimSpace

Each answer adds points to the training types it makes more relevant. Platforms that sell a picked type then get points for selling it and for matching your constraints, with budget checks counted double. All rules are published.

Read more: How the matching works

Because the right training depends on who you train and why. A score would hide the constraint that matters, such as whether a platform has a range at all.

Read more: /how-the-matching-works#ordering

No. Every fact comes from public vendor pages read on 27 September or 11 October 2026. Vendor figures are labelled as vendor statements.

Read more: /how-the-matching-works#limits