Team exercises versus solo labs: what changes when people train together

A solo lab and a team exercise can use the same tools and the same attack techniques and still train completely different things. The difference is other people.

What does a team exercise test that a lab does not?

Three things. First, handovers: when one analyst finds something, does the next person get the context they need, and does the shift lead hear about it in time? Second, shared awareness: does everyone have the same picture of the incident, or are two people investigating the same host while nobody looks at the second one? Third, decisions under uncertainty: in a team exercise someone has to decide when evidence is good enough to escalate or contain, and the others have to act on that call.

None of these show up in a solo lab, where the learner has all the information they need and nobody to coordinate with.

How do platforms describe team exercises?

The vocabulary varies, so read the detail.

• Cyberbit lists 100+ team exercises on its cloud range, and its RangeForce content names team scenarios such as Severe Compromise, Under Siege and Red on Blue.
• Immersive Labs describes Cyber Drills that exercise technical and business teams, and a Dynamic Threat Range that runs live-fire attacks on the customer's own stack.
• On the decision side, Reflex Security describes asynchronous team play and AI agents in absent seats, so a team exercise can run when not everyone is free at once.
• Conducttr runs from one team to 1,000+ simultaneous teams, in person, online or hybrid.
• TryHackMe states unlimited exercises and unlimited participants for its tabletop exercises.

What does a team exercise cost in time?

More than a lab. Someone has to schedule the team, provision accounts and tool access, brief the players and run the debrief. That is why team exercises tend to run a few times a year while labs can run every week. Platforms that cut preparation time, or that let people take part asynchronously, change how often a team can realistically exercise.

How should the two work together?

Treat them as a loop. Labs build the skills each person needs. A team exercise tests whether the team can use those skills together, and its debrief produces a list of gaps. Some of those gaps are individual (an analyst did not know a tool), and they go back into lab paths. Others are team or process gaps (a handover failed), and they go into playbooks and the next exercise.

Which roles should be in the room?

At minimum the analysts, a shift lead or incident commander, and whoever owns the detections being tested. Adding a business representative for the last part of the exercise, when the team has to escalate, is a cheap way to test the hand-off from technical findings to business decisions.

What next?

The next lesson looks at price pages: what training vendors publish, what they leave out, and how to compare quotes.