Cyber Range Training evaluation questionnaire

This evaluation is stored in your browser only. We cannot see it, and it is not tied to any account. Save it to a link or create an account to keep it across devices — you can export it at any time either way.

• baselineAre training environments live, isolated virtual infrastructure running real OS/network stacks, or a simulated/gamified interface — and can custom scenarios replicate the customer's actual network topology and technology stack?weight 12345Remove
• baselineDetail the scenario content library — how many scenarios exist, how they map to current real-world attack techniques (e.g., MITRE ATT&CK coverage), and the stated cadence for adding new scenarios as threats evolve.weight 12345Remove
• baselineHow is individual and team performance measured during an exercise — objective scoring (time-to-detect, time-to-contain, specific actions taken) versus subjective facilitator grading — and is scoring benchmarked against peer organizations?weight 12345Remove
• baselineDescribe support for purple-team/collaborative exercises where red and blue teams operate simultaneously with real-time visibility for facilitators, and whether after-action reports map identified gaps to specific, actionable remediation recommendations.weight 12345Remove
• baselineCan the platform run tabletop/executive-level exercises alongside hands-on technical ranges, with content genuinely tailored by audience (SOC analyst versus executive/board), rather than a single format for everyone?weight 12345Remove
• baselineWhat is the scalability model for large-scale exercises — e.g., a company-wide, hundreds-of-participants incident-response drill — and what infrastructure or licensing constraints apply at that scale?weight 12345Remove
• baselineExplain how training completion and skill-progression data integrates with broader workforce/compliance systems (LMS, HR platforms) for certification tracking and organization-wide skills-gap reporting to leadership.weight 12345Remove
• baselineIs the range hosted in the vendor's cloud, deployable on-prem/air-gapped, or both — and for regulated or classified environments, what isolation guarantees exist to prevent customer data or scenario details from leaving the environment?weight 12345Remove
• baselineWhat is the pricing model — per participant, per exercise, or an annual platform license — and how does cost scale for running frequent, recurring exercises versus a single annual event?weight 12345Remove
• baselineDoes exercise completion count toward any recognized industry certification or accreditation (continuing-education credits for existing certs, or a vendor-issued credential with real market recognition), or is completion purely internal with no external credentialing value?weight 12345Remove
• baselineDoes the scenario library include OT/ICS-specific exercises (distinct from generic IT-focused scenarios), and how are those scenarios validated for physical-safety-aware realism by someone with genuine OT expertise?weight 12345Remove
• baselineIs this purely a training/exercise platform, or does it double as a real assessment/red-team-as-a-service capability that could be used for an actual security evaluation — and if the latter, how is training data kept separate from real assessment findings?weight 12345Remove
• baselineDoes after-action reporting integrate with the customer's own ticketing/remediation workflow so identified skill or process gaps automatically generate tracked follow-up items, or does the after-action report remain a standalone document requiring manual follow-through?weight 12345Remove
• baselineWhat historical trend reporting exists showing organizational readiness improvement over time (average time-to-detect/contain across successive exercises), suitable for demonstrating program maturity to leadership?weight 12345Remove
• baselineWhat support exists for multi-language/international distributed teams participating in the same exercise — is content and facilitation available in multiple languages, and how does that affect scoring consistency across language groups?weight 12345Remove
• baselineWhat is the vendor's own content-update cadence for incorporating newly observed real-world attack techniques into scenarios, and can they cite a specific recent example of a new technique added shortly after it became prevalent in the wild?weight 12345Remove
• baselinePerform periodic incident response exercises with a deliverable report and debriefing upon completion.weight 12345Remove
• baselineMSSP must deliver at least one annual tabletop exercise (scenario themes prioritizing phishing compromise, ransomware, privileged account misuse), with technical teams and leadership participation and a mutually agreed after-action reporting format.weight 12345Remove
• baselineContractor shall lead enterprise IR readiness via an annual Incident Response Tabletop Exercise (TTX) plan developed with the Privacy team, designing at least 3 distinct high-fidelity scenarios per exercise (incorporating both cybersecurity e.g. ransomware and privacy e.g. PII breach components), and delivering a formal After-Action Report within 10 business days of TTX conclusion.weight 12345Remove