Training type · CRISIS

Tabletop exercises and crisis simulation: what they train and who sells them

Short answer

Tabletop exercises and crisis simulations train the people who make decisions in an incident: incident commanders, executives, legal, communications and the responders who brief them. They test escalation, authority and timing rather than technical skill. Formats run from a scripted discussion once a year to an adaptive simulation a team can run in an hour.

By The Range Desk · Cyber Range Compare · Published 2026-10-11 · Updated 2026-10-13

Desk research from public vendor, standards and regulator pages read on 27 September, 11 October and 13 October 2026. Profiles follow our published method; we did not run the products.

What does it train?

Decisions under pressure with incomplete information: when to escalate, who can approve taking systems offline, when to bring in legal and outside counsel, what to tell customers, staff and regulators, and in what order. A traditional tabletop walks a group through a written scenario with injects at set points. A crisis simulation changes as it runs: new information arrives, simulated journalists, customers or regulators push back, and on some platforms the adversary reacts to what the players decide.

Who should take part?

The incident response team in its widest sense: the incident commander, security leadership, IT, legal, communications, HR and the executives who own business decisions, and in some exercises the board. Technical responders take part as advisers to the decision-makers. Some platforms fill empty seats with simulated roles so an exercise can run when not everyone is available.

What does a session look like?

From a few minutes to half a day. Microsimulations take 3–5 minutes for one person on iluminr; Reflex Security describes sixty-minute sessions; a facilitated tabletop with a full executive group often takes a morning. Preparation ranges from weeks of scenario writing for a consultant-run exercise to minutes on platforms that generate the scenario.

What should it leave behind?

An after-action report that records who decided what, when, and on what information; the gaps that showed up; and the fixes, each with an owner. Better reports tie each finding to the moment in the exercise it came from, and map findings to the frameworks your auditors use. Some platforms also benchmark decision-making across teams or over time.

Which platforms sell it?

From each platform's own pages, read 27 September or 11 October 2026. Alphabetical order.
Platform	Status	What their pages describe	Source
Reflex Security	Sold	Builds the scenario from the organisation's public footprint, can enrich it with telemetry, and runs an unscripted adversary that reacts to each decision.	Source: Reflex Security blog: Reflex Security vs Immersive Labs · Read 27 Sep 2026
BreachRx	Sold	AI Tabletops designs, runs and documents cyber incident simulations inside the Rex Platform, for executives or a single team, from scenario design to after-action report.	Source: BreachRx: AI Tabletops (Rex Platform) · Read 13 Oct 2026
Cloud Range	Sold with a condition	Simulation-supported tabletop exercises are listed; their format and participants are not described on the homepage.	Source: Cloud Range homepage · Read 11 Oct 2026
Conducttr	Sold	Virtual Desktop, Scenario Editor and Conducttr Worlds; exercises run virtual, in person or hybrid, from one team to 1,000+ simultaneous teams.	Source: Conducttr homepage · Read 27 Sep 2026
Cyberbit	Sold with a condition	Crisis Sim 360 brings executive, legal, communications, risk and SOC teams into one exercise, but is only offered as an add-on to a Cyberbit Readiness plan.	Source: Cyberbit: Crisis Sim 360 · Read 27 Sep 2026
Cytactic	Sold	"Risk-tuned, Realistic Crisis Simulation (Digital TTX)", with a Simulation Generator: five ready-made simulations plus an AI engine that builds new ones.	Source: Cytactic blog: the next generation of cyber tabletops · Read 13 Oct 2026
Hack The Box	Sold	Crisis Control runs platform-led tabletop exercises with scenario waves, injects, emails, news and social updates, and optional hands-on investigation.	Source: Hack The Box: tabletop exercises (Crisis Control) · Read 27 Sep 2026
iluminr	Sold	Microsimulations (3–5 minutes for one person, 30–45 minutes for a team), tabletop exercises and incident response management.	Source: iluminr homepage · Read 27 Sep 2026
Immersive Labs	Sold	Crisis Sim for executives, incident leaders and cross-functional teams, with dynamic injects, AI actors and AI scenario creation.	Source: Immersive Labs: Crisis Sim · Read 27 Sep 2026
KnowBe4	Not in our sources	Not described on the pages we read.	None
SimSpace	Not in our sources	Not described on the pages we read.	None
TryHackMe	Sold	Tabletop exercises generated from industry, attack vector and tech stack, with playbook upload and Co-Create.	Source: TryHackMe: tabletop exercises · Read 27 Sep 2026

10 of 12 platforms sell it; 2 sell it with a condition; 2 are not in our sources.

When is it the wrong choice?

When the gap is technical skill. A tabletop will show that the SOC took too long to confirm an intrusion; it will not teach the analysts to do it faster. That takes labs or a range. Crisis simulation is also not awareness training: it reaches the response team, not every employee.

What does it cost, and what do platforms publish?

Platforms in this type range from a full public price list to quote-only. Free templates and paid consultant-run exercises sit on either side of the platforms.

Reflex SecurityNot published
Not published. reflexsecurity.io/pricing returned a 404 when we read it.
Source: reflexsecurity.io/pricing (returned 404) · Read 11 Oct 2026
BreachRxNot published
Not published; the route in is a demo. A free, facilitated exercise is offered to qualifying healthcare providers.
Source: BreachRx homepage · Read 13 Oct 2026
Cloud RangeNot published
Not published on the homepage; the route in is a demo request.
Source: Cloud Range homepage · Read 11 Oct 2026
Conducttr
Raven £11,950, Hawk £16,465, Osprey £21,000 and Eagle £25,725 a year, each for up to 40 participants per session, GBP excluding tax. Assessment Toolkit from £4,536 a year. Larger exercises and Conducttr Local are priced on request.
Source: Conducttr pricing · Read 27 Sep 2026
CyberbitNot published
Not published. The cyberbit.com/pricing address returned a 404 when we read it.
Source: cyberbit.com/pricing (returned 404) · Read 27 Sep 2026
CytacticNot published
Not published; the route in is a demo.
Source: Cytactic homepage · Read 13 Oct 2026
Hack The Box
Professional: $250 per seat per month or $2,500 per seat per year. Lite, Base and Ultimate are not priced publicly; Lite lists a 14-day free trial. Crisis Control: price not published.
Source: Hack The Box business pricing · Read 27 Sep 2026
iluminrNot published
Not published. The pricing page shows no figures.
Source: iluminr pricing · Read 27 Sep 2026
Immersive LabsNot published
Not published.
Source: Immersive Labs homepage · Read 27 Sep 2026
TryHackMe
Business: Foundation $99 per month and Advanced $199 per month; Enterprise on request. Whether these prices are per user, and the billing period, were not confirmed in our read, so check before budgeting. A free individual tier and paid individual plans are also published.
Source: TryHackMe business pricing · Read 11 Oct 2026

What if you do not buy a platform?

Two other routes exist: free templates you run yourself, and exercises delivered by an incident response firm as a paid service. We list them for context; they are not platforms and the finder does not include them.

CISA Tabletop Exercise Packages (CTEP)
CISA publishes over 100 free tabletop exercise packages with objectives, scenarios, discussion questions and references, plus a slide deck, a feedback form and an after-action report template. Cyber scenarios include ransomware, insider threats, phishing and industrial control system compromise, with sector versions. They are templates you facilitate yourself, not a platform.
Source: CISA Tabletop Exercise Packages · Read 27 Sep 2026
CrowdStrike Tabletop Exercise
CrowdStrike describes its tabletop exercise as discussion-based, delivered as a paid service.
Source: CrowdStrike Tabletop Exercise service · Read 27 Sep 2026
Unit 42 incident simulation and testing
Palo Alto Networks' Unit 42 sells incident simulation and tabletop services.
Source: Unit 42 incident simulation and testing services datasheet · Read 27 Sep 2026

Questions people ask

How is a crisis simulation different from a tabletop exercise?

A tabletop is discussion-based and usually follows a script. A crisis simulation adds live pressure and change: new information, simulated stakeholders and, on some platforms, an adversary that reacts to each decision. Both train decisions rather than keyboard skills.

Can we run tabletop exercises for free?

Yes. CISA publishes over 100 free tabletop exercise packages with scenarios, discussion questions, a slide deck and an after-action report template. You supply the facilitator, the time and the follow-up.

Should executives and technical staff be in the same exercise?

For at least part of the year, yes. Most incident delays happen at the handover between technical findings and business decisions, and an exercise with both groups is where that handover gets tested.