What Is a Cyber Range? Run One on a Small Budget
A cyber range is a safe, sandboxed environment where people practise security tasks on realistic simulated systems. NIST's glossary describes it as a platform that “provides a safe environment (i.e., ‘sandbox’) to deliver hands-on realistic training”.
You do not need a data centre to get the benefit. This guide explains the three kinds of range, how a range differs from a tabletop, and how to build a practical programme on a small budget.
Updated 3 November 2026
Three kinds of range and what each trains
| Format | What people do | Trains | Effort to run |
|---|---|---|---|
| Live-fire range | Defend or attack running virtual infrastructure with real tools. | Hands-on technique, tool fluency, team coordination under pressure. | Highest: infrastructure, scenario upkeep, a facilitator. |
| Browser simulation | Work scripted cases and labs in a web page: triage alerts, write rules, sequence a response. | Analyst technique and decisions, repeatable and self-paced. | Low: open a link. |
| Tabletop | Talk through an incident with injects, no systems involved. | Roles, escalation, communication, decisions. | Low to medium: a facilitator and a scenario. |
The categories overlap, and vendors use the words differently, so check what a product actually does before you buy. Our enterprise cyber range comparison sets out what each vendor says on its own site.
Immersive simulation in security training
“Immersive simulation” describes training where you act inside a scenario and it responds to you. A Virtual SOC case, where you gather evidence and question AI teammates before closing the case, and a Cyber War Room incident, where each decision changes the next injects, are both examples. The word is also the name of a vendor, Immersive Labs, so read results carefully.
Run a cyber range on a small budget
- Write down who trains and what they must be able to do. Analysts need technique; managers need decisions; executives need escalation judgement.
- Start with browser labs for technique. The SOC Triage Trainer, Detection Lab and Forensics Lab need no setup. The full set is on the labs page, and the Virtual SOC runs full cases.
- Add a decision simulation for leaders. The Cyber War Room runs branching incidents with a graded debrief, and the IR Playbook Lab drills the response sequence.
- Schedule a tabletop each quarter. Use the tabletop exercise library to pick a scenario for each team.
- Buy live-fire only where the job needs it. If a team defends complex infrastructure, trial a live-fire platform with a defined scenario and success measure first. See the vendor comparisons linked below.
- Measure and repeat. Record time to decide, correct first action and gaps found, then run the same scenario again after fixes.
Frequently asked questions
What is a cyber range?
A cyber range is a safe, sandboxed environment for hands-on security training. NIST's glossary (citing SP 800-50r1) says it provides a safe environment, a sandbox, to deliver hands-on realistic training, with scenarios, challenges and exercises in an easy-to-access, web-based format. Teams use ranges to practise defending, attacking and responding without risking real systems.
What is the difference between a cyber range and a tabletop exercise?
A range puts people in front of simulated systems and tools, so they practise technical actions. A tabletop is a discussion of an incident scenario that tests decisions, roles and communication. Most programmes need both: a range for analyst skill, a tabletop or decision simulation for managers and executives.
What is live-fire in a cyber range?
Live-fire means participants defend or attack running virtual infrastructure with real tools and, usually, real attack traffic or malware contained in the sandbox. It trains hands-on technique but takes more effort to build and maintain than a scripted simulation.
What is an immersive simulation in cyber security?
It is a training scenario you act inside rather than read about: you make decisions or run commands, the scenario responds, and you are scored. Both live-fire ranges and decision simulations such as a branching incident can be called immersive. Immersive is also the name of a commercial vendor, Immersive Labs, so check which one a search result means.
Can a small team run a cyber range on a small budget?
Yes, by matching the format to the skill. Use browser-based labs for analyst techniques, a branching incident simulation for decisions, and a quarterly tabletop for the whole organisation. Reserve a live-fire platform for the few people whose job needs it, and get a quote and trial before buying.
How do I choose a cyber range vendor?
Define who trains (analysts, managers, executives), what they must be able to do, and how you will measure it. Then compare platforms on scenario coverage, whether you can build your own scenarios, reporting, and price model. Our comparison of enterprise cyber ranges covers the main vendors and what each says it offers.