Reading vendor claims in crisis simulation marketing: launch times, analyst placements and savings

Why read claims carefully?

Because they are written to be quoted. A figure on a vendor's homepage is chosen because it sounds good, and it is usually accurate in a narrow sense that the page does not spell out. Our method reports vendor statements as the vendor's own words and never as our finding. This post shows how we read them, so you can do the same.

Time claims

Examples: TryHackMe states a "10 min average time" for its tabletops. Reflex Security describes "Sixty minutes, your real environment, no slides" and going "from threat to after-action, in a single afternoon". iluminr describes microsimulations of 3–5 minutes.

What to ask: time from what to what? Launch time is not preparation time, and session length is not total effort. Does the figure include writing objectives, inviting people and reviewing the report? Ask the vendor to walk through the total internal hours for one exercise, start to finish.

Savings and comparison claims

Example: TryHackMe says its tabletops are "56% more affordable than the average consultancy tabletop exercise". Reflex Security's homepage compares a scenario in minutes with 2–4 weeks for a traditional tabletop, and unlimited exercises with one a year, and says that "for the cost of a single consultant-led exercise, Reflex gives you the whole platform".

What to ask: compared with which baseline, measured how, and by whom? A percentage saving without a price cannot be checked. A comparison with a traditional tabletop depends on which traditional tabletop. Ask for the price and do the comparison yourself.

Analyst placements

Examples: Immersive Labs says it is a Leader in The Forrester Wave: Cybersecurity Skills and Training Platforms, Q1 2026, and its homepage describes it as #1 in that report. Hack The Box also states a Leader placement in the same report. iluminr says its microsimulations appear in the Gartner Hype Cycle for Risk, Compliance and Audit Technologies, 2026, for a third year, and that Chartis named it a RiskTech100 2027 Disruptor. Reflex Security's blog says an industry map of 1,318 AI security vendors lists only Reflex in its Crisis Simulation category.

What to ask: which category, which year, and does the report assess the product you are buying? A skills and training platform report may weigh labs and content libraries more than crisis simulation. A Hype Cycle entry places a technology category, not a vendor's quality. We report these placements as vendor statements and do not score them.

Customer and user counts

Examples: Immersive Labs says it is "Trusted by 30%+ of the Fortune 100"; TryHackMe cites "1000+ organizations" and "8M+ users"; Hack The Box cites "1.5k+ organizations".

What to ask: how many of those customers use the crisis simulation product, rather than the wider platform? User counts for training platforms usually include free individual accounts. For a crisis exercise purchase, ask for the number of organisations running executive exercises, and ask to speak to one in your sector.

Framework lists

Example: iluminr names DORA, ISO 22301, APRA CPS 230, FCA/PRA, NIST CSF, UK Operational Resilience, ISO 27001, FFIEC and OSFI E-21.

What to ask: mapped how? A framework list can mean a report template with headings, a mapping of each exercise objective to a control, or automated evidence packs. Ask for a sample report against the framework your regulator uses.

What do the claims not tell you?

Almost none of the numbers on these pages speak to the outcome a buyer wants: whether executives decide faster and better in a real incident after using the product. That is hard to measure, and no vendor in this set publishes evidence of it that we could read. The closest proxies are the measures a platform records across repeated exercises, such as decision time, and whether customers re-test fixes. Ask vendors how their customers show improvement over a year, and what that evidence looks like.

A short checklist

• Every number: from what, to what, measured by whom?
• Every comparison: against which baseline, and what is the price?
• Every placement: which report, which category, which product?
• Every count: which product, paying or free?
• Every framework: show me the mapped output.

None of this means the claims are false. It means they are claims, and the vendor who answers these questions clearly and quickly is telling you something useful about how it will behave as a supplier. Our scoring page explains how we treat them.