Cyber ranges have turn into core infrastructure for safety groups that need to rehearse in opposition to practical assaults quite than examine them, and more and more to check the AI instruments coming into their defences. The market spans established enterprise live-fire platforms, self-paced skilling instruments, managed providers, and specialists that bridge digital and bodily methods or concentrate on a single sector.
The fifteen Cyber vary suppliers beneath are amongst these value understanding in 2026, every suited to a distinct sort of program. The transient profiles describe what every does, who builds and backs it, and the place it suits; they map the panorama quite than rank it, and the order doesn’t indicate choice.
The suppliers
CybExer Applied sciences
A European supplier (based 2016) centered on authorities, defence, and critical-infrastructure ranges. It builds high-fidelity environments together with digital twins of a buyer’s personal community and ICS/SCADA gear provides hosted, sovereign on-premises, air-gapped, and single-exercise deployment underneath European information governance, and costs by utilization quite than per seat, with AI-assisted assault technology and AI-model testing amongst its newer capabilities.
It integrates with main cloud, hypervisor, and SIEM instruments and lets clients creator and personal their eventualities, and its ISA oversight module was a class winner in NATO’s 2018 NCIA Defence Innovation Problem.
Deployments span alliance defence our bodies, a nationwide military, and an area company throughout greater than sixty international locations by the corporate’s personal rely. Its strengths are surroundings realism, deployment flexibility, and large-scale workout routines; groups whose precedence is in depth self-paced coaching libraries might look to suppliers equivalent to Cyberbit, Immersive Labs, or SANS.
Cyberbit (with RangeForce)
Cyberbit has long-running live-fire workout routines that put attacker and defender groups inside production-like networks, and its 2025 acquisition of RangeForce added a big catalogue of self-paced, browser-delivered labs giving it uncommon end-to-end attain from a newbie’s first lesson to a coordinated workforce confrontation.
Each merchandise have been recognised in Forrester’s analysis of cybersecurity abilities and coaching platforms. It connects to widespread SIEM and safety tooling and pairs a vendor catalogue with customized authoring; heavy AI validation and plant-floor OT protection are much less central to it.
SimSpace
SimSpace’s Cyber Drive Platform stands up devoted copies of total company networks and runs shifting, nation-state-style assaults in opposition to the defenders inside them. With roots in MIT Lincoln Laboratory analysis, it counts US Cyber Command, federal regulation enforcement, and lots of the largest US banks amongst its customers, and runs within the cloud or on a buyer’s premises. Its American centre of gravity makes information residency a dwell query for consumers outdoors america, and it’s priced for giant programmes.
Hack The Field
Hack The Field grew from a big fanatic group and gamified challenges into company accounts, delivered within the browser with single sign-on and enterprise administration. In December 2025 it launched HTB AI Vary to check and benchmark autonomous AI safety brokers alongside human operators.
It excels at hands-on offensive skill-building and, extra just lately, at evaluating AI brokers; recreating a buyer’s full community or plant-floor know-how is outdoors what it units out to do, and content material and train information sit in HTB’s cloud.
Cloud Vary
Cloud Vary is a totally managed service: its employees design and ship workout routines for the shopper, together with ones that account for AI-driven threats, bought as recurring or devoted packages, with a public-sector and armed-forces observe.
It fits teams that might quite purchase an final result than run a system of their very own, the trade-off being restricted management over and possession of the fabric. As a managed providing, it handles integration and connects workout routines to related tooling on the shopper’s behalf, utilizing vendor-designed quite than customer-authored eventualities.
Immersive Labs
Immersive Labs emphasises breadth of viewers, with separate studying paths for safety groups, engineers, executives, and the broader workforce, delivered as SaaS from a vendor-maintained library that’s topped up as new threats seem.
CREST has mapped its content material to a number of threat-intelligence certifications, and it points role-based certifications throughout roughly forty profession paths. It suits organisations lifting functionality throughout many roles greater than groups rehearsing one group in opposition to a devoted copy of their very own community.
SANS Cyber Ranges
SANS brings the load of its teacher corps and the NetWars competitors format into hands-on, walled-off environments, with evaluation tied to the GIAC certification household. For taught curricula and aggressive observe it has few equals; recreating a purchaser’s specific property as a dwell reproduction isn’t its purpose, and eventualities are faculty-authored and delivered by SANS’s hosted ranges.
CYBER RANGES (Silensec)
CYBER RANGES leans on automation and agent-driven assault technology to stage giant, structured workout routines, folding in menace intelligence and supporting customer-built content material alongside its catalogue.
Its firmest credentials lie in nation-level drills and abilities programmes, together with a unbroken engagement with the UN’s telecommunications physique (ITU), making it a pure alternative for presidency train supply. High-tier surroundings realism and AI testing usually are not the place it competes hardest.
Circadence (Undertaking Ares)
Circadence runs the gamified, Azure-native Undertaking Ares platform, studying video games, tool-focused battle rooms, and workforce missions just lately prolonged with Undertaking Ares GEN3 and an AI engine, RangeGPT, following a 2026 funding spherical.
It has a powerful footing in US federal and army coaching. Its core energy is gamified, sustained ability growth; RangeGPT provides AI-driven state of affairs technology and resilience validation, inserting it among the many skilling-led suppliers now shifting into AI.
CloudShare
CloudShare (previously IT Buildings)Â comes from on-demand lab internet hosting for software program makers and coaching companies; its enchantment is how shortly environments may be created, shared by hyperlink, and eliminated on-line at scale, with robust APIs and enterprise data-residency choices.
It optimises for quantity and ease of supply quite than a meticulous recreation of a company property, with content material customer-built on the platform quite than drawn from a security-scenario catalogue.
IBM X-Drive Cyber Vary
IBM delivers its vary by bodily X-Drive Cyber Vary centres in Cambridge, Washington DC, Ottawa, and Bangalore plus a trailer-based cell unit, backed by X-Drive menace intelligence. The mannequin centres on immersive disaster simulations that put govt, authorized, and technical responders in the identical train, and IBM has run joint ranges with companions equivalent to Palo Alto Networks.
It fits board-level rehearsal alongside hands-on defence quite than deep technical emulation or OT, and content material is IBM-delivered.
Diateam (HNS Platform)
Diateam builds the HNS Platform (HNS: Hybrid Community Simulation) on its HYNESIM layer and KVM virtualisation, a hybrid mannequin that interconnects digital topologies with actual bodily gear, and it underpins the Thales cyber vary, which in flip powers amenities equivalent to a Thales Cyberlab in Belgium and the Dutch Ministry of Defence’s cyber-command coaching.
The bridge between digital and bodily methods, and assist for customer-authored eventualities, are its distinguishing strengths. It’s a specialist platform for on-premises and sovereign deployments quite than a broad enterprise suite.
CYRIN
CYRIN, from Structure Expertise Company, pairs interactive on-line labs with a graphical train builder and progress monitoring in opposition to studying targets, and integrates with studying methods by way of the LTI customary.
It has constructed educational alliances together with Munster Technological College and RIT’s International Cybersecurity Institute. Its energy is accessible, sensible coaching for training, authorities, and company learners quite than high-fidelity, full-network live-fire.
Keysight (CySOP)
Keysight’s CySOP cyber vary is constructed on the BreakingPoint site visitors engine from its network-testing line, which might reproduce a whole lot of actual utility protocols and tens of hundreds of assaults. That makes it unusually robust on site visitors realism and on testing community and safety tooling underneath load.
It’s a pure alternative the place site visitors constancy and rigorous device testing matter most; broad train design and narrative content material are much less central to it.
JYVSECTEC (RGCE)
JYVSECTEC, a Finnish university-run cybersecurity centre, operates the Sensible International Cyber Atmosphere (RGCE) and has constructed sector-specific ranges, together with one for healthcare, combining an utilized analysis base with national-level train expertise.
Its energy is practical, research-grounded environments and sector specialisation; as an institution-run functionality, it’s much less a packaged industrial product than the platform distributors above.
Deployment and information residency
How a supplier deploys is commonly the primary filter, as a result of it may well rule a vendor out earlier than functionality even issues. The self-paced platforms Hack The Field, Immersive Labs, CloudShare, CYRIN, and Undertaking Ares are cloud-delivered and fast to undertake, with the surroundings and train information held by the supplier.
The live-fire and enterprise platforms supply extra management: CybExer cyber vary platform runs within the cloud, as a bespoke on-premises resolution, as an air-gapped deployment, or as one-off deployments underneath EU information governance; SimSpace runs within the cloud and on-premises inside a US footprint; Diateam is constructed for on-premises and hybrid setups that incorporate bodily {hardware}.
Cloud Vary and CYBER RANGES are delivered as hosted, managed providers, and IBM’s expertise is centre-based. For a regulated or labeled purchaser, the place the platform runs and the place information resides is a tough constraint; verify air-gapped assist and information residency early, and weigh the supplier’s personal nation and possession alongside them.
Pricing and industrial fashions
The industrial fashions differ as a lot because the platforms. Self-paced suppliers usually cost per consumer on an annual subscription predictable for a hard and fast workforce, however the invoice climbs with each seat, which is why broad programmes outgrow them. Managed suppliers equivalent to Cloud Vary fold supply right into a subscription or per-engagement price.
The enterprise live-fire platforms are normally quote-based and formed by scale and deployment: SimSpace is oriented to giant budgets, whereas CybExer costs on utilization quite than headcount with no per-seat cap. Specialist and crossover instruments equivalent to Keysight and Diateam, and centre-based experiences like IBM’s, are bespoke.
In each case the headline price is barely a part of the determine: infrastructure, the individuals to run workout routines, and holding content material present sometimes price extra throughout a multi-year deployment, so weigh the entire working expense, not the licence alone.
Implementation and content material possession
Two suppliers can look alike till you account for who really does the work. With a managed service equivalent to Cloud Vary, the supplier designs and runs the workout routines, so onboarding is gentle, however you rely upon them for each change. With a self-run platform, you use the vary your self, standing up environments, constructing or curating eventualities, and deciphering outcomes, which requires expert employees.
Content material possession is the dividing line: some platforms let clients creator and maintain their very own eventualities (CybExer, Diateam, and CloudShare amongst them), whereas others are constructed round a vendor-maintained catalogue (Hack The Field, Immersive Labs, SANS, Circadence).
Earlier than committing, set up what a supplier expects you to purchase as skilled providers: state of affairs growth, integration, and digital-twin development are generally chargeable, and what ongoing assist and content material refresh are included.
Matching your must a supplier
The profiles reply totally different questions, so the sensible transfer is to start out out of your main goal and let it shorten the listing:
- Workforce workout routines in opposition to a devoted copy of your personal community: CybExer and SimSpace construct digital replicas of actual infrastructure, with Cyberbit shut behind.
- Validating your personal AI instruments and brokers: A small however rising group: CybExer, Hack The Field (AI Vary), and Circadence (RangeGPT).
- Constructing particular person SOC abilities over time: the self-paced platforms Immersive Labs, SANS, CYRIN, Cyberbit’s RangeForce modules, and Undertaking Ares.
- Operational-technology and critical-infrastructure depth: CybExer’s protocol-level protection and Diateam’s virtual-to-physical bridge, with sector specialists value checking for particular methods.
- Workout routines designed and run for you: Cloud Vary’s managed service; for giant nationwide drills, CYBER RANGES and CybExer each function at that scale.
- Different particular jobs: quick, scalable cloud labs (CloudShare); board-level disaster rehearsal (IBM); site visitors constancy and gear testing (Keysight).
- On-premises or air-gapped with information sovereignty as a tough requirement: The listing narrows shortly to CybExer, SimSpace, and Diateam.
Whichever route suits, verify it with a proof of idea on a consultant a part of your personal surroundings earlier than you commit.
Steadily requested questions
What’s the distinction between a cyber vary and breach-and-attack simulation?
A cyber vary trains individuals and, more and more, assessments AI instruments by working practical assaults in a secure reproduction surroundings. Breach-and-attack simulation repeatedly probes your dwell manufacturing defences for gaps. They’re complementary: one workout routines the workforce and its processes, the opposite audits the controls, and plenty of organisations run each.
Are individual-skilling platforms and full live-fire ranges interchangeable?
No. Self-paced platforms equivalent to Cyberbit’s RangeForce modules, Immersive Labs, Hack The Field, and SANS construct particular person abilities by quick, modular labs. Dwell-fire ranges equivalent to CybExer, SimSpace, and Cyberbit put entire groups in opposition to an adversary in a practical community. A mature programme typically wants each a part of why Cyberbit acquired RangeForce.
Can a cyber vary replicate our personal community?
The upper-fidelity suppliers can: CybExer and SimSpace construct digital twins of a buyer’s precise topology and methods, which is what helps coaching switch to an actual incident quite than a generic lab. Lighter, content-led platforms run standardised environments as a substitute, fantastic for abilities observe, much less so for rehearsing your particular property.
Which suppliers swimsuit a regulated or authorities purchaser?
Consumers that require on-premises or air-gapped deployment and management over the place information resides slender the sector shortly. CybExer (EU-based, with air-gapped choices) and SimSpace (US-based) are a standard enterprise and defence shortlist, with Diateam for sovereign on-premises work, managed supply from Cloud Vary, and national-drill expertise from CYBER RANGES relying on the requirement.
Are open-source cyber ranges a viable various?
For training, analysis, and tight budgets, sure, KYPO and its successor CyberRangeCZ are succesful, and educational ranges exist alongside them. The catch is that they commerce the licence price for the engineering, internet hosting, and content material work you tackle your self, which is why most enterprises with a sustained programme transfer to a industrial platform.
