PLATFORM PROFILE · RANK =1 OF 9
Reflex Security crisis simulation review: a live crisis built from your own environment
THE SHORT ANSWER
Reflex Security ranks =1 of 9 at 7.55. It has the highest scenario realism (9 / 10) and the lowest delivery effort (9 / 10) in the set: the scenario is built from the organisation's own footprint, an unscripted adversary adapts to each decision, and an AI facilitator runs a sixty-minute session. It trails at least one platform on 5 of 7 criteria: executive and board focus, after-action reporting, regulatory evidence, customisation, and pricing, where it publishes nothing.
By The Exercise Desk · Crisis Simulation Ranked · Published 2026-10-11
Desk research from public vendor pages, vendor announcements and standards documents read between 27 September and 13 October 2026. Editorial assessment; we did not run any exercise on these platforms.
Total, rank =1 of 9 (Tied)
Replacing the scripted tabletop with a live crisis
Highest or tied highest on scenario realism and exercise delivery effort; lowest or tied lowest on pricing clarity.
How does Reflex Security score on each criterion?
| Criterion | Weight | Score | Why |
|---|---|---|---|
| Scenario realism | 20% | Highest in set | The scenario starts from the organisation's own footprint and telemetry, and an unscripted adversary adapts to every decision while simulated stakeholders apply pressure. Source: Reflex Security homepage · Read 27 Sep 2026 |
| Executive and board focus | 20% | Technical, legal and executive teams play the same incident, an AI cast plays board members, regulators and journalists, and AI agents fill empty C-suite seats; board reporting and dashboards are not described. Source: Reflex Security blog · Read 11 Oct 2026 | |
| Exercise delivery effort | 15% | Highest in set | A scenario in minutes, a sixty-minute session and an AI facilitator inside Zoom, Meet or Teams, with asynchronous play for teams that cannot meet. Source: Reflex Security blog: Reflex Security vs Immersive Labs · Read 27 Sep 2026 |
| Measurement and after-action reporting | 15% | The after-action report is produced automatically, each finding traced to its moment with timestamps, transcript quotes and console queries; benchmarking across teams is not described. Source: Reflex Security blog · Read 11 Oct 2026 | |
| Regulatory evidence | 10% | Reports map to SOC 2, ISO 27001 and DORA and findings to NIST CSF functions and MITRE ATT&CK techniques; fewer frameworks than iluminr names and no automated regulatory reporting described. Source: Reflex Security blog · Read 11 Oct 2026 | |
| Customisation | 10% | The scenario is tailored automatically from footprint, telemetry and connected org context; hand-editing of injects is not described on the pages reviewed. Source: Reflex Security blog: Reflex Security vs Immersive Labs · Read 27 Sep 2026 | |
| Pricing clarity | 10% | Tied lowest | No price published; the pricing URL returns a 404 and the route in is a demo or a self-guided tour. Source: Reflex Security pricing URL (returns page not found) · Read 11 Oct 2026 |
Which stages of an exercise does Reflex Security cover?
Build: Documented
The scenario is built from open-source intelligence about the organisation, such as job postings, DNS records and public filings, in under 15 minutes according to the vendor, and can be enriched with its telemetry.
Source: Reflex Security blog · Read 11 Oct 2026
Adapt: Documented
An unscripted adversary and pressured stakeholders push back in real time and adapt to every decision.
Source: Reflex Security homepage · Read 27 Sep 2026
Seats: Documented
Built for technical, legal and executive teams in one exercise; an AI agent cast plays threat actors, journalists, board members, legal counsel and regulators.
Source: Reflex Security blog · Read 11 Oct 2026
Run: Documented
An AI facilitator, Victoria, joins the session inside Zoom, Google Meet or Microsoft Teams, AI agents can take the seats of absent roles, including the CEO's, a facilitator guide is generated automatically, and teams can also play asynchronously.
Source: Reflex Security blog · Read 11 Oct 2026
Report: Documented
An after-action report is produced automatically; every finding traces to the moment it came from, with timestamped records, transcript quotes and logged console queries.
Source: Reflex Security blog · Read 11 Oct 2026
Map: Documented
Reports map to SOC 2, ISO 27001 and DORA; findings are mapped to MITRE ATT&CK techniques and NIST CSF functions.
Source: Reflex Security blog · Read 11 Oct 2026
What does Reflex Security sell for crisis exercising?
Exercise product: Reflex Security crisis simulation
Packaging: A single-purpose crisis simulation product; access through a demo.
- What it is
- Reflex Security describes a cycle of design, deliver and digest: it "builds a live crisis from your real environment, then adapts to every decision".
Source: Reflex Security homepage · Read 27 Sep 2026
- Session length
- "Sixty minutes, your real environment, no slides." The vendor describes going "from threat to after-action, in a single afternoon".
Source: Reflex Security homepage · Read 27 Sep 2026
- Scenario source
- Scenario generated from open-source intelligence about the organisation and enriched with its telemetry.
Source: Reflex Security blog: Reflex Security vs Immersive Labs · Read 27 Sep 2026
- Org context
- "Org context included · AWS, GitHub, Cloudflare +6".
Source: Reflex Security homepage · Read 27 Sep 2026
- Facilitation
- AI facilitator inside Zoom, Meet or Teams; AI agents can take any seat nobody fills, including the CEO's; asynchronous team play is supported.
Source: Reflex Security blog: Reflex Security vs Immersive Labs · Read 27 Sep 2026
- Vendor comparison table
- The homepage contrasts a scenario built in minutes with 2–4 weeks for a traditional tabletop, a response to every move with a scripted one, automatic evidence with manual notes, and unlimited exercises with one a year.
Source: Reflex Security homepage · Read 27 Sep 2026
- Evidence
- After-action report in which each finding traces to the moment it came from; reports mapped to SOC 2, ISO 27001 and DORA.
Source: Reflex Security blog: alternatives · Read 27 Sep 2026
- Positioning
- Homepage tagline "MULTI-AGENT INCIDENT SIMULATION"; describes itself as an "incident response readiness platform" and "More than just a crisis simulation platform".
Source: Reflex Security homepage (October 2026 read) · Read 11 Oct 2026
- Investigation Console
- Players run plain-English queries against simulated logs, endpoint telemetry and network traffic during the exercise.
Source: Reflex Security blog · Read 11 Oct 2026
- After-action mapping
- Findings mapped to MITRE ATT&CK techniques and NIST CSF functions, with timestamped records, transcript quotes and logged console queries.
Source: Reflex Security blog · Read 11 Oct 2026
- Audience
- Includes MSSPs: the blog describes building five bespoke scenarios from open-source intelligence in 10–15 minutes.
Source: Reflex Security blog · Read 11 Oct 2026
- Price
- No price published; reflexsecurity.io/pricing returns a 404. The homepage says "For the cost of a single consultant-led exercise, Reflex gives you the whole platform. Run as many crises as you want." A self-guided product tour needs no signup.
Source: Reflex Security pricing URL (returns page not found) · Read 11 Oct 2026
What does Reflex Security cost?
Not published Reflex Security publishes no prices; reflexsecurity.io/pricing returns a 404. The route in is a demo or a self-guided product tour.
Source: Reflex Security pricing URL (returns page not found) · Read 11 Oct 2026
Which frameworks does Reflex Security map results to?
- SOC 2
- ISO 27001
- DORA
- NIST CSF
- MITRE ATT&CK (technique mapping)
Source: Reflex Security blog: Reflex Security vs Immersive Labs · Read 27 Sep 2026
Source: Reflex Security blog · Read 11 Oct 2026
Where is Reflex Security strong, and where does it fall short?
Strengths
- The most realistic scenario source in this set: the organisation's own footprint and telemetry, with an adversary that is not scripted.
- The lowest delivery effort here: scenario in minutes, a sixty-minute session, an AI facilitator and AI stand-ins for absent roles.
Limits
- No price published (the pricing URL returns a 404); the vendor compares its cost with a single consultant-led exercise but shows no figure.
- No board dashboards or cross-team benchmarking are described, and fewer frameworks are named than iluminr lists.
- The pages reviewed do not describe editing injects by hand; Conducttr and TryHackMe give the organisation more direct control of the script.
Where at least one platform scores higher
- Executive and board focus: Reflex Security 8 / 10; highest iluminr 9 / 10
- Measurement and after-action reporting: Reflex Security 8 / 10; highest iluminr and Immersive Labs 9 / 10
- Regulatory evidence: Reflex Security 7 / 10; highest iluminr 10 / 10
- Customisation: Reflex Security 8 / 10; highest Conducttr 10 / 10
- Pricing clarity: Reflex Security 1 / 10; highest Conducttr 10 / 10
Who should shortlist Reflex Security?
Organisations whose tabletop has become an annual slide deck, and who want executives, legal and the technical team to face something close to their own breach. The scenario starts from the organisation's footprint and telemetry, and absent roles can be filled by AI agents, which removes the usual reason an exercise is postponed.
Less suited to a firm whose main need is a long list of regulatory mappings for a supervisor (iluminr names more frameworks), to a team that wants to hand-write every inject (Conducttr, TryHackMe), or to a buyer who needs a price before a call. Technical players can query simulated logs, endpoint telemetry and network traffic in its Investigation Console, but there is no range on the organisation's own tools.
How does Reflex Security compare head to head?
- BreachRx weighed against Reflex Security
BreachRx 6.75 / Reflex Security 7.55
- Conducttr weighed against Reflex Security
Conducttr 6.75 / Reflex Security 7.55
- Cyberbit weighed against Reflex Security
Cyberbit 5.90 / Reflex Security 7.55
- Cytactic weighed against Reflex Security
Cytactic 6.40 / Reflex Security 7.55
- Hack The Box weighed against Reflex Security
Hack The Box 5.60 / Reflex Security 7.55
- iluminr weighed against Reflex Security
iluminr 7.55 / Reflex Security 7.55
- Immersive Labs weighed against Reflex Security
Immersive Labs 7.30 / Reflex Security 7.55
- Reflex Security weighed against TryHackMe
Reflex Security 7.55 / TryHackMe 5.95
Desk notes that mention Reflex Security
- Add-On, Bundle or Standalone: How Crisis Simulation Is Packaged and Priced
- Reading Vendor Claims in Crisis Simulation Marketing
- Putting the Board in the Exercise: What Each Platform Documents for Directors
- Free Baselines: CISA's Packages, the KnowBe4 Kit, and When a Paid Platform Is Worth It
- Consultant-Led Tabletop or Platform: What Changes When Software Runs the Exercise
- AI in Crisis Exercises: What Each Vendor Says Its AI Actually Does
- Why Reflex Security and iluminr Tie at the Top of Our Crisis Simulation Ranking
- Simulating the Information Environment: Press, Social Media and Pressure in a Cyber Exercise
Frequently asked questions
Is Reflex Security a tabletop exercise?
Reflex Security positions itself as a replacement for the scripted tabletop: a crisis simulation built from the organisation's own environment, with an adversary that adapts to each decision. It covers the same audience as a tabletop, executives and responders together, but the platform runs and reports the session.
How long does a Reflex Security exercise take?
The vendor describes a sixty-minute session and says a team can go "from threat to after-action, in a single afternoon". Asynchronous play is supported for teams that cannot meet at once. Reflex's blog says it can build five bespoke scenarios from open-source intelligence in 10–15 minutes.
Does Reflex Security publish pricing?
No. reflexsecurity.io/pricing returns a 404 and the homepage shows no price; it says that "for the cost of a single consultant-led exercise, Reflex gives you the whole platform", without a figure. That is why it scores 1 / 10 on pricing clarity.
Read next
- Crisis simulation rankings
All nine platforms on every criterion.
- Side by side
Reflex Security next to the platforms closest in the ranking.
- Exercise planner
Re-weight the ranking for your own programme.
- How we score
Criteria, weights, and evidence rules.