Cyber range and security training glossary

A final hands-on task at the end of a training programme that the learner must complete to earn a certificate. Cyberbit states its four ANAB-accredited RangeForce programmes each end in one.

Source: Cyberbit news: ANAB accreditation of RangeForce certificate programs · Read 27 Sep 2026

A competition or challenge format in which players solve security problems to find hidden "flags". Used for training, hiring and team events.

A realistic environment, usually cloud-hosted, in which a team detects and responds to a simulated attack using real or realistic security tools.

Related page: Cyber range

How long an attacker stays in an environment before being found. M-Trends 2026 reports a global median of 14 days.

Source: Google Cloud: M-Trends 2026 · Read 27 Sep 2026

A short, guided technical task completed by one person in a browser-based environment, such as investigating an endpoint or analysing a log.

Related page: Hands-on lab libraries

The full catalogue of labs a platform offers, usually organised into paths by role or skill.

Related page: Hands-on lab libraries

An ordered set of labs or modules aimed at one role or certification.

A range exercise in which the attack actually runs while the team works, rather than being described on paper. Some platforms run it against the customer's own tools.

Related page: Cyber range

Attackers (red), defenders (blue), and the practice of the two working together so defenders learn from each attack step (purple).

A training environment that imitates a security operations centre's alert queue so analysts practise triage and investigation.

A range scenario played by several people at once, with shared findings and handovers, as opposed to a solo lab.

Related page: Team exercises versus solo labs: what changes when people train together

Proactively searching systems and logs for signs of an attacker that existing alerts have not caught.

A simulated attacker whose next move depends on what the players decide, rather than a fixed script.

The written record after an exercise: what happened, what was decided, what went wrong, and the fixes with owners. CISA's free packages include a template.

Source: CISA Tabletop Exercise Packages · Read 27 Sep 2026

An exercise that changes as it runs, with new information, simulated stakeholders and sometimes an adversary that reacts to the players' decisions.

Related page: Tabletop and crisis simulation

NIST's guidance on test, training and exercise programmes separates exercises where people talk through a response from those where they carry it out.

Source: NIST SP 800-84 (published September 2006) · Read 27 Sep 2026

The person, or on some platforms the software, that runs an exercise, releases injects and keeps the discussion on track.

The short debrief held immediately after an exercise, before the formal after-action report.

A new piece of information introduced into an exercise, such as an email, alert, news story or call, to move the scenario on or add pressure.

The planned timeline of injects for an exercise. Conducttr describes its LISA assistant as a text-to-MEL chatbot for drafting one.

Source: Conducttr homepage · Read 27 Sep 2026

A very short scenario, often a few minutes for one person, used to practise decisions frequently. iluminr describes 3–5 minute individual and 30–45 minute team versions.

Source: iluminr homepage · Read 27 Sep 2026

A discussion-based exercise in which decision-makers work through a written scenario and say what they would do, usually led by a facilitator.

Source: NIST SP 800-84 (published September 2006) · Read 27 Sep 2026

Related page: Tabletop and crisis simulation

October, when many organisations run awareness campaigns and vendors publish free material.

Source: KnowBe4 press release: free Cybersecurity Awareness Month kit · Read 27 Sep 2026

Training for every employee on spotting and reporting threats such as phishing, delivered as short modules.

Related page: Awareness training

Test phishing emails sent to staff without warning to measure who clicks and who reports.

Related page: Awareness training

Accreditation by the ANSI National Accreditation Board of a certificate programme against the ASTM E2659 standard for certificate programmes.

Source: Cyberbit news: ANAB accreditation of RangeForce certificate programs · Read 27 Sep 2026

Free exercise packages from the U.S. Cybersecurity and Infrastructure Security Agency, over 100 of them, with scenarios, questions and an after-action report template.

Source: CISA Tabletop Exercise Packages · Read 27 Sep 2026

The US Department of Defense Cyber Workforce Framework of work roles, which some training programmes align to.

Source: Cyberbit news: ANAB accreditation of RangeForce certificate programs · Read 27 Sep 2026

Regulation (EU) 2022/2554, the Digital Operational Resilience Act for financial entities. Its text requires entities to review the risk scenarios affecting them at least yearly, and requires advanced threat-led penetration testing at least every 3 years for entities their authorities identify. Several platforms here map exercise evidence to it.

Source: EUR-Lex: Regulation (EU) 2022/2554 (DORA) · Read 11 Oct 2026

The SEC disclosure for a material cybersecurity incident, generally due four business days after a company determines the incident is material.

Source: SEC press release 2023-139: cybersecurity disclosure rules · Read 27 Sep 2026

A publicly accessible knowledge base of adversary tactics and techniques based on real-world observations. Cloud Range aligns range scenarios to it, and Reflex Security maps after-action findings to its techniques.

Source: MITRE ATT&CK · Read 11 Oct 2026

The Workforce Framework for Cybersecurity, NIST SP 800-181 Rev. 1 (November 2020), a common language for cybersecurity work roles, tasks, knowledge and skills. Immersive Labs lists NIST NICE among its heat maps.

Source: NIST NICE Framework Resource Center · Read 11 Oct 2026

Directive (EU) 2022/2555 on a high common level of cybersecurity across the EU. It requires an early warning of a significant incident within 24 hours and policies to assess whether cybersecurity risk-management measures are effective.

Source: EUR-Lex: Directive (EU) 2022/2555 (NIS2) · Read 11 Oct 2026

NIST's incident response guidance; Revision 3 (April 2025) is written as a Cybersecurity Framework 2.0 Community Profile.

Source: NIST SP 800-61 Rev. 3 (published April 2025) · Read 27 Sep 2026

NIST's guide to test, training and exercise programmes for IT plans and capabilities, published September 2006.

Source: NIST SP 800-84 (published September 2006) · Read 27 Sep 2026

The SEC rule that requires US public companies to describe their cybersecurity risk management processes and board oversight each year.

Source: SEC press release 2023-139: cybersecurity disclosure rules · Read 27 Sep 2026

A product sold only with another product. Cyberbit's Crisis Sim 360 is an add-on to Cyberbit Readiness plans.

Source: Cyberbit: Crisis Sim 360 · Read 27 Sep 2026

A free plan with limited content, usually for individuals. TryHackMe publishes one.

Source: TryHackMe pricing · Read 27 Sep 2026

A short, scoped trial of a platform with your own people and goals before buying.

A price per named user, usually per month or per year. Hack The Box publishes its Professional plan at $2,500 per seat per year.

Source: Hack The Box business pricing · Read 27 Sep 2026

A price that assumes a multi-year commitment. KnowBe4's published awareness prices are per seat per month on a 3-year term.

Source: KnowBe4 security awareness training pricing · Read 11 Oct 2026