Press play to start listening
Cyber ranges have become core infrastructure for security teams that want to rehearse against realistic attacks rather than read about them, and increasingly to test the AI tools entering their defences. The market spans established enterprise live-fire platforms, self-paced skilling tools, managed services, and specialists that bridge virtual and physical systems or focus on a single sector.
The fifteen Cyber range providers below are among those worth knowing in 2026, each suited to a different kind of program. The brief profiles describe what each does, who builds and backs it, and where it fits; they map the landscape rather than rank it, and the order does not imply preference.
The providers
CybExer Technologies
A European provider (founded 2016) focused on government, defence, and critical-infrastructure ranges. It builds high-fidelity environments including digital twins of a customer’s own network and ICS/SCADA equipment offers hosted, sovereign on-premises, air-gapped, and single-exercise deployment under European data governance, and prices by usage rather than per seat, with AI-assisted attack generation and AI-model testing among its newer capabilities.
It integrates with major cloud, hypervisor, and SIEM tools and lets customers author and own their scenarios, and its ISA oversight module was a category winner in NATO’s 2018 NCIA Defence Innovation Challenge.
Deployments span alliance defence bodies, a national army, and a space agency across more than sixty countries by the company’s own count. Its strengths are environment realism, deployment flexibility, and large-scale exercises; teams whose priority is extensive self-paced training libraries may look to providers such as Cyberbit, Immersive Labs, or SANS.
Cyberbit (with RangeForce)
Cyberbit has long-running live-fire exercises that put attacker and defender teams inside production-like networks, and its 2025 acquisition of RangeForce added a large catalogue of self-paced, browser-delivered labs giving it unusual end-to-end reach from a beginner’s first lesson to a coordinated team confrontation.
Both products were recognised in Forrester’s evaluation of cybersecurity skills and training platforms. It connects to common SIEM and security tooling and pairs a vendor catalogue with custom authoring; heavy AI validation and plant-floor OT coverage are less central to it.
SimSpace
SimSpace’s Cyber Force Platform stands up faithful copies of entire corporate networks and runs shifting, nation-state-style attacks against the defenders inside them. With roots in MIT Lincoln Laboratory research, it counts US Cyber Command, federal law enforcement, and many of the largest US banks among its users, and runs in the cloud or on a customer’s premises. Its American centre of gravity makes data residency a live question for buyers outside the United States, and it is priced for large programmes.
Hack The Box
Hack The Box grew from a large enthusiast community and gamified challenges into corporate accounts, delivered in the browser with single sign-on and enterprise management. In December 2025 it launched HTB AI Range to test and benchmark autonomous AI security agents alongside human operators.
It excels at hands-on offensive skill-building and, more recently, at evaluating AI agents; recreating a customer’s full network or plant-floor technology is outside what it sets out to do, and content and exercise data sit in HTB’s cloud.
Cloud Range
Cloud Range is a fully managed service: its staff design and deliver exercises for the customer, including ones that account for AI-driven threats, sold as recurring or dedicated packages, with a public-sector and armed-forces practice.
It suits groups that would rather buy an outcome than run a system of their own, the trade-off being limited control over and ownership of the material. As a managed offering, it handles integration and connects exercises to relevant tooling on the customer’s behalf, using vendor-designed rather than customer-authored scenarios.
Immersive Labs
Immersive Labs emphasises breadth of audience, with separate learning paths for security teams, engineers, executives, and the wider workforce, delivered as SaaS from a vendor-maintained library that is topped up as new threats appear.
CREST has mapped its content to several threat-intelligence certifications, and it issues role-based certifications across roughly forty career paths. It fits organisations lifting capability across many roles more than teams rehearsing one group against a faithful copy of their own network.
SANS Cyber Ranges
SANS brings the weight of its instructor corps and the NetWars competition format into hands-on, walled-off environments, with assessment tied to the GIAC certification family. For taught curricula and competitive practice it has few equals; recreating a buyer’s particular estate as a live replica is not its aim, and scenarios are faculty-authored and delivered through SANS’s hosted ranges.
CYBER RANGES (Silensec)
CYBER RANGES leans on automation and agent-driven attack generation to stage large, structured exercises, folding in threat intelligence and supporting customer-built content alongside its catalogue.
Its firmest credentials lie in nation-level drills and skills programmes, including a continuing engagement with the UN’s telecommunications body (ITU), making it a natural choice for government exercise delivery. Top-tier environment realism and AI testing are not where it competes hardest.
Circadence (Project Ares)
Circadence runs the gamified, Azure-native Project Ares platform, learning games, tool-focused battle rooms, and team missions recently extended with Project Ares GEN3 and an AI engine, RangeGPT, following a 2026 funding round.
It has a strong footing in US federal and military training. Its core strength is gamified, sustained skill development; RangeGPT adds AI-driven scenario generation and resilience validation, placing it among the skilling-led providers now moving into AI.
CloudShare
CloudShare (formerly IT Structures) comes from on-demand lab hosting for software makers and training businesses; its appeal is how quickly environments can be created, shared by link, and removed online at scale, with strong APIs and enterprise data-residency options.
It optimises for volume and ease of delivery rather than a meticulous recreation of a corporate estate, with content customer-built on the platform rather than drawn from a security-scenario catalogue.
IBM X-Force Cyber Range
IBM delivers its range through physical X-Force Cyber Range centres in Cambridge, Washington DC, Ottawa, and Bangalore plus a trailer-based mobile unit, backed by X-Force threat intelligence. The model centres on immersive crisis simulations that put executive, legal, and technical responders in the same exercise, and IBM has run joint ranges with partners such as Palo Alto Networks.
It suits board-level rehearsal alongside hands-on defence rather than deep technical emulation or OT, and content is IBM-delivered.
Diateam (HNS Platform)
Diateam builds the HNS Platform (HNS: Hybrid Network Simulation) on its HYNESIM layer and KVM virtualisation, a hybrid model that interconnects virtual topologies with real physical equipment, and it underpins the Thales cyber range, which in turn powers facilities such as a Thales Cyberlab in Belgium and the Dutch Ministry of Defence’s cyber-command training.
The bridge between virtual and physical systems, and support for customer-authored scenarios, are its distinguishing strengths. It is a specialist platform for on-premises and sovereign deployments rather than a broad enterprise suite.
CYRIN
CYRIN, from Architecture Technology Corporation, pairs interactive online labs with a graphical exercise builder and progress tracking against learning objectives, and integrates with learning systems via the LTI standard.
It has built academic alliances including Munster Technological University and RIT’s Global Cybersecurity Institute. Its strength is accessible, practical training for education, government, and corporate learners rather than high-fidelity, full-network live-fire.
Keysight (CySOP)
Keysight’s CySOP cyber range is built on the BreakingPoint traffic engine from its network-testing line, which can reproduce hundreds of real application protocols and tens of thousands of attacks. That makes it unusually strong on traffic realism and on testing network and security tooling under load.
It is a natural choice where traffic fidelity and rigorous tool testing matter most; broad exercise design and narrative content are less central to it.
JYVSECTEC (RGCE)
JYVSECTEC, a Finnish university-run cybersecurity centre, operates the Realistic Global Cyber Environment (RGCE) and has built sector-specific ranges, including one for healthcare, combining an applied research base with national-level exercise experience.
Its strength is realistic, research-grounded environments and sector specialisation; as an institution-run capability, it is less a packaged commercial product than the platform vendors above.
Deployment and data residency
How a provider deploys is often the first filter, because it can rule a vendor out before capability even matters. The self-paced platforms Hack The Box, Immersive Labs, CloudShare, CYRIN, and Project Ares are cloud-delivered and quick to adopt, with the environment and exercise data held by the provider.
The live-fire and enterprise platforms offer more control: CybExer cyber range platform runs in the cloud, as a bespoke on-premises solution, as an air-gapped deployment, or as one-off deployments under EU data governance; SimSpace runs in the cloud and on-premises within a US footprint; Diateam is built for on-premises and hybrid setups that incorporate physical hardware.
Cloud Range and CYBER RANGES are delivered as hosted, managed services, and IBM’s experience is centre-based. For a regulated or classified buyer, where the platform runs and where data resides is a hard constraint; confirm air-gapped support and data residency early, and weigh the provider’s own country and ownership alongside them.
Pricing and commercial models
The commercial models differ as much as the platforms. Self-paced providers generally charge per user on an annual subscription predictable for a fixed team, but the bill climbs with every seat, which is why broad programmes outgrow them. Managed providers such as Cloud Range fold delivery into a subscription or per-engagement fee.
The enterprise live-fire platforms are usually quote-based and shaped by scale and deployment: SimSpace is oriented to large budgets, while CybExer prices on usage rather than headcount with no per-seat cap. Specialist and crossover tools such as Keysight and Diateam, and centre-based experiences like IBM’s, are bespoke.
In every case the headline fee is only part of the figure: infrastructure, the people to run exercises, and keeping content current typically cost more across a multi-year deployment, so weigh the whole running expense, not the licence alone.
Implementation and content ownership
Two providers can look alike until you account for who actually does the work. With a managed service such as Cloud Range, the provider designs and runs the exercises, so onboarding is light, but you depend on them for every change. With a self-run platform, you operate the range yourself, standing up environments, building or curating scenarios, and interpreting results, which requires skilled staff.
Content ownership is the dividing line: some platforms let customers author and keep their own scenarios (CybExer, Diateam, and CloudShare among them), while others are built around a vendor-maintained catalogue (Hack The Box, Immersive Labs, SANS, Circadence).
Before committing, establish what a provider expects you to buy as professional services: scenario development, integration, and digital-twin construction are commonly chargeable, and what ongoing support and content refresh are included.
Matching your needs to a provider
The profiles answer different questions, so the practical move is to start from your primary objective and let it shorten the list:
- Team exercises against a faithful copy of your own network: CybExer and SimSpace build digital replicas of real infrastructure, with Cyberbit close behind.
- Validating your own AI tools and agents: A small but growing group: CybExer, Hack The Box (AI Range), and Circadence (RangeGPT).
- Building individual SOC skills over time: the self-paced platforms Immersive Labs, SANS, CYRIN, Cyberbit’s RangeForce modules, and Project Ares.
- Operational-technology and critical-infrastructure depth: CybExer’s protocol-level coverage and Diateam’s virtual-to-physical bridge, with sector specialists worth checking for specific systems.
- Exercises designed and run for you: Cloud Range’s managed service; for large national drills, CYBER RANGES and CybExer both operate at that scale.
- Other specific jobs: fast, scalable cloud labs (CloudShare); board-level crisis rehearsal (IBM); traffic fidelity and tool testing (Keysight).
- On-premises or air-gapped with data sovereignty as a hard requirement: The list narrows quickly to CybExer, SimSpace, and Diateam.
Whichever route fits, confirm it with a proof of concept on a representative part of your own environment before you commit.
Frequently asked questions
What is the difference between a cyber range and breach-and-attack simulation?
A cyber range trains people and, increasingly, tests AI tools by running realistic attacks in a safe replica environment. Breach-and-attack simulation continuously probes your live production defences for gaps. They are complementary: one exercises the team and its processes, the other audits the controls, and many organisations run both.
Are individual-skilling platforms and full live-fire ranges interchangeable?
No. Self-paced platforms such as Cyberbit’s RangeForce modules, Immersive Labs, Hack The Box, and SANS build individual skills through short, modular labs. Live-fire ranges such as CybExer, SimSpace, and Cyberbit put whole teams against an adversary in a realistic network. A mature programme often needs both part of why Cyberbit acquired RangeForce.
Can a cyber range replicate our own network?
The higher-fidelity providers can: CybExer and SimSpace build digital twins of a customer’s actual topology and systems, which is what helps training transfer to a real incident rather than a generic lab. Lighter, content-led platforms run standardised environments instead, fine for skills practice, less so for rehearsing your specific estate.
Which providers suit a regulated or government buyer?
Buyers that require on-premises or air-gapped deployment and control over where data resides narrow the field quickly. CybExer (EU-based, with air-gapped options) and SimSpace (US-based) are a common enterprise and defence shortlist, with Diateam for sovereign on-premises work, managed delivery from Cloud Range, and national-drill experience from CYBER RANGES depending on the requirement.
Are open-source cyber ranges a viable alternative?
For education, research, and tight budgets, yes, KYPO and its successor CyberRangeCZ are capable, and academic ranges exist alongside them. The catch is that they trade the licence fee for the engineering, hosting, and content work you take on yourself, which is why most enterprises with a sustained programme move to a commercial platform.
