Immersive Labs scores highest overall (7.5 of 10) because it covers labs, a live-fire range and crisis simulation on one platform. If the job is replacing the annual scripted tabletop with an exercise the whole response team runs, Reflex Security is the pick (6.8), with the top marks for realism and effort to run. For board and regulator evidence, iluminr leads.
Editorial assessment · Assessed from vendor sites, product pages and published pricing, September 2026
2-1Which format does your team actually need?
Most buying mistakes in this category are format mistakes. A lab teaches one analyst to do one task. A live-fire range tests whether a SOC can detect and contain an attack on real tooling. A tabletop or crisis simulation tests whether the people who own the decisions, from the incident commander to general counsel to the CEO, can make them in time. Awareness training reaches every employee and teaches none of them to run an incident. Buy the format that matches the gap your last incident or audit exposed.
Executives and board
- Tabletop and crisis simulation
- Reflex SecurityImmersive LabsHack The BoxCyberbitiluminrConducttrCISA CTEP *
- Live-fire range
- No platform in this set
- Hands-on labs
- No platform in this set
- Awareness training
- No platform in this set
Incident response team (cross-functional)
- Tabletop and crisis simulation
- Reflex SecurityImmersive LabsHack The BoxCyberbitTryHackMeiluminrConducttrCISA CTEP *
- Live-fire range
- Immersive LabsCyberbit
- Hands-on labs
- No platform in this set
- Awareness training
- No platform in this set
SOC analysts
- Tabletop and crisis simulation
- No platform in this set
- Live-fire range
- Immersive LabsCyberbit
- Hands-on labs
- Immersive LabsHack The BoxCyberbitTryHackMe
- Awareness training
- No platform in this set
Whole company
- Tabletop and crisis simulation
- iluminr
- Live-fire range
- No platform in this set
- Hands-on labs
- Immersive Labs
- Awareness training
- KnowBe4
* CISA CTEP = CISA Tabletop Exercise Packages, free templates, not a platform. Shown as the free baseline.
2-2Top picks by requirement
| Requirement | Pick | Format | Readiness score | Why |
|---|---|---|---|---|
| One platform for analysts, responders and executives | Immersive Labs | Labs, range, crisis simulation | 7.5 | Hands-on labs across five domains, a live-fire range on your own tools, and crisis simulations with AI actors. |
| Replacing the scripted annual tabletop | Reflex Security | Crisis simulation | 6.8 | Scenario built from your footprint, an adversary that reacts to each decision, AI stand-ins for absent roles, report at the end. |
| Technical team first, tabletop second | Hack The Box | Labs, tabletop | 6.7 | Deep technical content and certifications; Crisis Control adds a platform-led tabletop with optional hands-on work. |
| Evidence for boards and regulators | iluminr | Crisis simulation, microsimulation | 6.7 | Board dashboards and evidence trails mapped to DORA, APRA CPS 230, ISO 22301 and NIST CSF. |
| Live-fire range with executives attached | Cyberbit | Range, labs, crisis simulation | 6.7 | 100+ team exercises and 2,800+ solo labs; Crisis Sim 360 links SOC findings to executive decisions. |
| Free starting point for SOC skills | TryHackMe | Labs, tabletop | 6.5 | Free individual tier, 800+ labs, SOC Simulator and AI-generated tabletops. |
| Designing your own crisis exercises | Conducttr | Crisis simulation | 6.1 | Simulated news and social media around the players, and a full public price list. |
Readiness score is an editorial assessment against seven weighted criteria. Hack The Box, iluminr and Cyberbit tie at 6.7 when rounded. Method: How we assess.
2-3Where does Reflex Security lose?
Reflex scores 2 of 10 on hands-on depth and 2 on breadth and free access: it has no labs, no range, no content library and no free tier. It scores 1 on pricing, because it publishes no price. iluminr beats it on evidence for boards and regulators. If your gap is analyst skills, Reflex is the wrong purchase and Immersive Labs, Hack The Box, Cyberbit or TryHackMe are the right shortlist.
2-4What should a CISO expect an exercise to produce?
A decision record
Who decided what, when, and on what information. This is what an after-action report should be built from, and what most slide-based tabletops lose by the next morning.
A gap list with owners
Findings that name the playbook step, the team and the fix. CISA's free tabletop packages include an after-action report template for this reason.
Something you can show the board
Since July 2023, US public companies have had to describe their processes for managing material cybersecurity risk and the board's oversight of it (SEC Regulation S-K Item 106). Exercise evidence is one of the few artefacts that shows those processes being used.
Sources: CISA Tabletop Exercise Packages, SEC press release 2023-139 · Reviewed Sep 2026
2-5What is in this edition?
2-6Latest news
- 2026-09-24iluminr
iluminr named a Chartis RiskTech100 2027 Disruptor
Chartis Research listed iluminr as a RiskTech100 2027 Disruptor in risk intelligence and data management. iluminr says more than 900 firms were evaluated.
- 2026-09-21Hack The Box
Hack The Box launches HTB PRO, one plan for individual training
HTB PRO bundles VIP+ access, 10 Pro Labs and SOC Range access from Q4 2026, at $49 a month or $490 a year. Legacy Pro Labs bundles close to new buyers on 30 September 2026.
- 2026-09-17Cyberbit
Cyberbit is technology partner for the second She Protects cohort
The UAE program delivered by Microsoft and CPX expands to more than 150 university students and recent graduates from November 2026 to May 2027, with hands-on labs on the Cyberbit Readiness platform.
2-7Frequently asked questions
What is the best cybersecurity training platform for a security team?
For one platform that covers analysts, responders and executives, Immersive Labs scores highest in our assessment (7.5 of 10). For hands-on technical skills on a budget, TryHackMe and Hack The Box are the usual shortlist. For exercising the response team as a whole, look at crisis simulation platforms such as Reflex Security and iluminr.
What is the difference between a cyber range and a tabletop exercise?
A cyber range is a technical environment where analysts detect and respond to a live simulated attack using real tools. A tabletop exercise is discussion-based: decision-makers work through a scenario and decide what to do. Ranges test hands and tooling; tabletops test decisions and coordination.
Are there free tabletop exercise resources?
Yes. CISA publishes over 100 free Tabletop Exercise Packages with objectives, scenarios, discussion questions, a slide deck, a feedback form and an after-action report template. They are templates you facilitate yourself, not a platform.
Is security awareness training the same as incident response training?
No. Awareness platforms such as KnowBe4 train every employee to spot and report threats like phishing. Incident response training and exercises prepare the smaller group that runs an incident. Most organizations need both, bought separately.
How are the scores calculated?
Each platform gets a 0–10 score on seven criteria from public vendor material. The weighted total uses published weights: realism 22%, cross-team 20%, evidence 16%, effort to run 14%, hands-on depth 12%, breadth 8%, pricing 8%.