Skip to content
Crisis Simulation RankedCrisis Simulation Ranked

EDITION 2026.10 · UPDATED 2026-10-13

Cyber crisis simulation and tabletop exercise platforms, ranked for the real incident

THE SHORT ANSWER

We scored nine platforms on how well they prepare executives and response teams for a real incident. On our published weights iluminr and Reflex Security tie for first at 7.55, ahead of Immersive Labs at 7.30. They win on different things: iluminr leads on executive and board focus, measurement and after-action reporting and regulatory evidence, Reflex Security on scenario realism and exercise delivery effort.

By The Exercise Desk · Crisis Simulation Ranked · Published 2026-10-11

Desk research from public vendor pages, vendor announcements and standards documents read between 27 September and 13 October 2026. Editorial assessment; we did not run any exercise on these platforms.

Which crisis simulation platforms score highest?

Crisis simulation platform ranking. Crisis readiness score (editorial assessment, 0 to 10)
RankPlatformBest forExercise cycleScenario realism (20%)Executive and board focus (20%)Total
=1 TiediluminrBoard-level evidence for regulated firmsiluminr exercise cycle: documented at 4 of 6 stages, plus 2 partial. Build: documented; Adapt: partial; Seats: documented; Run: partial; Report: documented; Map: documented.
=1 TiedReflex SecurityReplacing the scripted tabletop with a live crisisReflex Security exercise cycle: documented at 6 of 6 stages. Build: documented; Adapt: documented; Seats: documented; Run: documented; Report: documented; Map: documented.
3Immersive LabsCrisis simulation inside a wider readiness platformImmersive Labs exercise cycle: documented at 5 of 6 stages. Build: documented; Adapt: documented; Seats: documented; Run: not described; Report: documented; Map: documented.
=4 TiedBreachRxExercises inside an incident response platformBreachRx exercise cycle: documented at 3 of 6 stages, plus 3 partial. Build: documented; Adapt: partial; Seats: documented; Run: partial; Report: documented; Map: partial.
=4 TiedConducttrTeams that design every inject themselvesConducttr exercise cycle: documented at 2 of 6 stages, plus 3 partial. Build: documented; Adapt: partial; Seats: documented; Run: partial; Report: partial; Map: not described.
6CytacticSimulations inside a cyber incident response hubCytactic exercise cycle: documented at 1 of 6 stages, plus 5 partial. Build: documented; Adapt: partial; Seats: partial; Run: partial; Report: partial; Map: partial.
7TryHackMeFast, security-team tabletops from a large training platformTryHackMe exercise cycle: documented at 3 of 6 stages, plus 2 partial. Build: documented; Adapt: partial; Seats: partial; Run: not described; Report: documented; Map: documented.
8CyberbitLinking a cyber range to executive decisionsCyberbit exercise cycle: documented at 2 of 6 stages, plus 2 partial. Build: not described; Adapt: documented; Seats: documented; Run: not described; Report: partial; Map: partial.
9Hack The BoxTechnical teams that want a platform-led tabletopHack The Box exercise cycle: documented at 3 of 6 stages, plus 2 partial. Build: partial; Adapt: partial; Seats: documented; Run: documented; Report: documented; Map: not described.

Full rankings, criteria and pairings

What separates a crisis simulation from a slide-deck tabletop?

The scripted tabletop

A facilitator reads a prepared scenario to the room, injects arrive on a fixed timeline, and someone takes notes for a report written days later. It is cheap to start and easy to run once a year, which is often how it is run.

The crisis simulation

The scenario is built from the organisation's own systems and threats, it changes with each decision, executives and technical responders face it together, and the record of what happened is produced by the platform. The questions are how realistic it is, who is in the room, and what evidence survives.

Our scores reward the second model without ignoring cost and control: scenario realism and executive focus carry 40% of the weight between them, and customisation and pricing clarity carry 20%. How we score

Which stages of an exercise does each platform cover?

DocumentedDocumentedPartialPartialNot describedNot describedClockwise from 12 o'clock: Build, Adapt, Seats, Run, Report, Map
  • iluminr exercise cycle: documented at 4 of 6 stages, plus 2 partial. Build: documented; Adapt: partial; Seats: documented; Run: partial; Report: documented; Map: documented.iluminr
  • Reflex Security exercise cycle: documented at 6 of 6 stages. Build: documented; Adapt: documented; Seats: documented; Run: documented; Report: documented; Map: documented.Reflex Security
  • Immersive Labs exercise cycle: documented at 5 of 6 stages. Build: documented; Adapt: documented; Seats: documented; Run: not described; Report: documented; Map: documented.Immersive Labs
  • BreachRx exercise cycle: documented at 3 of 6 stages, plus 3 partial. Build: documented; Adapt: partial; Seats: documented; Run: partial; Report: documented; Map: partial.BreachRx
  • Conducttr exercise cycle: documented at 2 of 6 stages, plus 3 partial. Build: documented; Adapt: partial; Seats: documented; Run: partial; Report: partial; Map: not described.Conducttr
  • Cytactic exercise cycle: documented at 1 of 6 stages, plus 5 partial. Build: documented; Adapt: partial; Seats: partial; Run: partial; Report: partial; Map: partial.Cytactic
  • TryHackMe exercise cycle: documented at 3 of 6 stages, plus 2 partial. Build: documented; Adapt: partial; Seats: partial; Run: not described; Report: documented; Map: documented.TryHackMe
  • Cyberbit exercise cycle: documented at 2 of 6 stages, plus 2 partial. Build: not described; Adapt: documented; Seats: documented; Run: not described; Report: partial; Map: partial.Cyberbit
  • Hack The Box exercise cycle: documented at 3 of 6 stages, plus 2 partial. Build: partial; Adapt: partial; Seats: documented; Run: documented; Report: documented; Map: not described.Hack The Box

3 of 9 platforms document a scenario that adapts to decisions; 4 of 9 document results mapped to named frameworks.

Where does each leader fall short?

iluminr

  • Scenario realism: iluminr 7 / 10; highest Reflex 9 / 10
  • Exercise delivery effort: iluminr 8 / 10; highest Reflex 9 / 10
  • Customisation: iluminr 7 / 10; highest Conducttr 10 / 10
  • Pricing clarity: iluminr 1 / 10; highest Conducttr 10 / 10

Reflex Security

  • Executive and board focus: Reflex 8 / 10; highest iluminr 9 / 10
  • Measurement and after-action reporting: Reflex 8 / 10; highest iluminr and Immersive 9 / 10
  • Regulatory evidence: Reflex 7 / 10; highest iluminr 10 / 10
  • Customisation: Reflex 8 / 10; highest Conducttr 10 / 10
  • Pricing clarity: Reflex 1 / 10; highest Conducttr 10 / 10

We show these rows because a ranking where one platform wins every criterion would not help anyone choose.

Which platform fits which job?

Jobs and the platform to look at first
JobLook first atWhy
Replace the annual scripted tabletop with something closer to a real breachReflex SecurityHighest scenario realism (9 / 10) and the lowest delivery effort (9 / 10) in the set.
Show a regulator or the board that exercising happensiluminrHighest regulatory evidence (10 / 10) with 11 named frameworks.
Exercise the crisis team and the SOC on one platformImmersive LabsCrisis Sim plus a live-fire range, and after-action measurement at 9 / 10.
Write every inject yourself and know the price up frontConducttrCustomisation 10 / 10 and the only full published price list.
Run quick tabletops for the security teamTryHackMeA stated 10-minute average launch and customisation at 9 / 10.
Connect SOC escalations to executive decisionsCyberbitNonlinear Crisis Sim 360 on top of a cyber range, sold as an add-on.
Give technical players hands-on work inside the tabletopHack The BoxCrisis Control adds optional hands-on investigation and a Golden Report.

What does this site measure, and what not?

We score crisis simulation and tabletop exercise platforms on how well they prepare executives and response teams for a real incident, using public vendor pages, announcements and standards documents read between 27 September and 13 October 2026. Every score has a written reason and a source. We did not run any exercise on these platforms. Read the scoring method

Where to go next

Latest from The Exercise Desk

All Exercise Desk notes

Frequently asked questions

What is a cyber crisis simulation?

A cyber crisis simulation is an exercise in which a team responds to a simulated cyber incident as it unfolds, with new information arriving and the scenario changing in response to their decisions. It differs from a discussion-based tabletop mainly in how far the scenario reacts and how much of the running and reporting the platform does. The tabletop school covers the formats.

Which crisis simulation platform ranks first?

iluminr and Reflex Security tie for first at 7.55 out of 10 on our published weights, followed by Immersive Labs at 7.30. The exercise planner re-ranks the nine platforms on your own weights.

Are CISA's free tabletop packages enough?

They are a sound baseline: over 100 packages with scenarios, discussion questions and an After Action Report template. What they do not do is adapt to decisions, simulate pressure or produce the report for you, which is what the paid platforms here compete on.