Add-on, bundle or standalone: how crisis simulation platforms are packaged and priced

Why does packaging matter as much as price?

Eight of the nine platforms we score do not publish a price for their exercise product. In that situation, the way a product is packaged tells a buyer more than any number: whether the crisis simulation can be bought on its own, what else comes with it, and what you are committing to. Packaging also decides who owns the budget, security training, risk or the crisis management function, which affects how quickly a purchase can happen.

Model 1: standalone crisis simulation

Reflex Security sells a single-purpose incident simulation platform and publishes no price: reflexsecurity.io/pricing returns a 404, and the homepage says "for the cost of a single consultant-led exercise, Reflex gives you the whole platform. Run as many crises as you want", without a figure. Access is through a demo or a self-guided product tour. iluminr sells a resilience exercising platform with several modules (microsimulations, tabletops, incident response management and Capability Intelligence) and also publishes no price. The advantage of this model is focus: the product exists to run crisis exercises, and the buyer does not pay for content it will not use. The disadvantage is that technical training needs a separate purchase.

Model 2: a module of a wider platform

Immersive Labs sells Crisis Sim and digital tabletops inside Immersive One, alongside labs, cyber drills and a live-fire range. TryHackMe's tabletop exercises sit inside TryHackMe for business with SOC simulators and labs, and business plans are not priced publicly. Hack The Box's Crisis Control is part of Hack The Box for business. The advantage is one supplier and one contract for crisis and technical exercising. The disadvantage is that the crisis module is one priority among many for the vendor, and a buyer who only wants crisis exercises may pay for a broader platform.

Hack The Box is a useful example of why to read prices carefully. It publishes a business Professional plan at $2,500 per seat per year, or $250 per seat per month. That is a training plan; Crisis Control has no published price.

BreachRx sells AI Tabletops as a module of the Rex Platform, its incident response management platform. Cytactic's Simulation Generator is part of the Cytactic incident response management platform.

Model 3: an add-on to a cyber range

Cyberbit says Crisis Sim 360 is "only offered as an add-on, available for all Cyberbit Readiness plans". The executive exercise therefore comes with a cyber range purchase. For an organisation that already runs Cyberbit for its SOC, this is convenient and connects technical findings to executive decisions. For one that only wants an executive exercise, it means buying a range first.

Model 4: published licences

Conducttr publishes four annual team licences: Raven £11,950, Hawk £16,465, Osprey £21,000 and Eagle £25,725 a year, each for up to 40 participants per session, in GBP excluding tax, with an Assessment Toolkit from £4,536 a year and custom pricing for larger exercises. It is the only platform here whose exercise product can be budgeted from the website. The trade is effort: Conducttr gives you the tools, and your team designs and facilitates the exercise.

What should you ask each vendor?

• Can the crisis simulation be bought on its own, and is there a minimum term?
• What is the unit of pricing: organisation, participant, exercise, seat or module?
• How many exercises a year does the price allow, and how many participants per exercise?
• What happens to our scenarios, reports and data if we leave?
• Which features in the demo are in the tier we would buy?

Which model suits which buyer?

• A crisis management or risk function buying for executives only: a standalone product or published licences, so the purchase does not depend on a security training budget.
• A security team that already runs a training platform: the module model, if the crisis product is strong enough, to avoid a second supplier.
• An organisation already running a cyber range: the add-on model, which connects technical findings to executive decisions on one platform.
• A team with an exercise designer and a fixed budget: published licences, with the design effort accepted up front.

How we score pricing

Pricing clarity is 10% of our score. Conducttr scores 10 for its complete list. Hack The Box scores 3 because a business price is visible but not for Crisis Control. TryHackMe scores 2 for publishing individual prices only. The other six score 1, including our client Reflex Security. The planner lets you weight price more heavily if your budget process demands it, and its budget-first preset shows how much the order changes when price counts for 30%.