PLATFORM PROFILE · RANK 7 OF 9
TryHackMe crisis simulation review: quick tabletops for the security team
THE SHORT ANSWER
TryHackMe ranks 7 of 9 at 5.95. Its tabletops are generated from industry, attack vector and tech stack, take a stated 10 minutes to launch on average, and score 9 / 10 on customisation. They are aimed at the security team, so executive and board focus is the lowest in the set (4 / 10).
By The Exercise Desk · Crisis Simulation Ranked · Published 2026-10-11
Desk research from public vendor pages, vendor announcements and standards documents read between 27 September and 13 October 2026. Editorial assessment; we did not run any exercise on these platforms.
Total, rank 7 of 9
Fast, security-team tabletops from a large training platform
Highest or tied highest on no criterion; lowest or tied lowest on scenario realism and executive and board focus.
How does TryHackMe score on each criterion?
| Criterion | Weight | Score | Why |
|---|---|---|---|
| Scenario realism | 20% | Tied lowest | Built from industry, attack vector and tech stack, with injects the team can edit or re-prompt; adaptation to each decision is not described. Source: TryHackMe: tabletop exercises · Read 27 Sep 2026 |
| Executive and board focus | 20% | Lowest in set | Aimed at managers, practitioners and security leaders; the boardroom is not the focus. Source: TryHackMe: tabletop exercises · Read 27 Sep 2026 |
| Exercise delivery effort | 15% | The vendor states a 10-minute average launch, with unlimited exercises and participants. Source: TryHackMe: tabletop exercises · Read 27 Sep 2026 | |
| Measurement and after-action reporting | 15% | "Audit-ready reports" with performance insights. Source: TryHackMe: tabletop exercises · Read 27 Sep 2026 | |
| Regulatory evidence | 10% | Scenarios align to NIST and ISO 27035. Source: TryHackMe: tabletop exercises · Read 27 Sep 2026 | |
| Customisation | 10% | Industry, attack vector and stack inputs, Co-Create, editable injects and upload of the team's own IR playbooks. Source: TryHackMe: tabletop exercises · Read 27 Sep 2026 | |
| Pricing clarity | 10% | Individual plans are published; business plans with tabletop exercises go through sales. Source: TryHackMe pricing · Read 27 Sep 2026 |
Which stages of an exercise does TryHackMe cover?
Build: Documented
Scenarios generated from industry, attack vector and tech stack; teams can upload their own IR playbooks and co-create.
Source: TryHackMe: tabletop exercises · Read 27 Sep 2026
Adapt: Partial
Facilitators can edit injects or re-prompt; branching on each player decision is not described.
Source: TryHackMe: tabletop exercises · Read 27 Sep 2026
Seats: Partial
Aimed at managers, practitioners and security leaders rather than the boardroom.
Source: TryHackMe: tabletop exercises · Read 27 Sep 2026
Run: Not described
Who facilitates a session is not described; the vendor states a 10-minute average launch.
Source: TryHackMe: tabletop exercises · Read 27 Sep 2026
Report: Documented
"Audit-ready reports" with performance insights.
Source: TryHackMe: tabletop exercises · Read 27 Sep 2026
Map: Documented
Scenarios align to NIST and ISO 27035.
Source: TryHackMe: tabletop exercises · Read 27 Sep 2026
What does TryHackMe sell for crisis exercising?
Exercise product: AI-driven Tabletop Exercises (TryHackMe for business)
Packaging: Part of TryHackMe for business; business pricing through sales.
- Tabletop exercises
- Built from industry, attack vector and tech stack; Co-Create; playbook upload; aligned to NIST and ISO 27035; "10 min average time"; "Unlimited exercises, unlimited participants"; "Audit-ready reports".
Source: TryHackMe: tabletop exercises · Read 27 Sep 2026
- Vendor claim on cost
- "56% more affordable than the average consultancy tabletop exercise" (TryHackMe's claim; no price is shown).
Source: TryHackMe: tabletop exercises · Read 27 Sep 2026
- Business platform
- SOC Simulator, AI-driven Tabletop Exercises, Custom Content Studio, Live Breach Exercises and Threat Hunting Simulator; "1000+ organizations", "8M+ users", "800+ labs".
Source: TryHackMe for business · Read 27 Sep 2026
What does TryHackMe cost?
Not published Individual plans are priced publicly; business plans, which include tabletop exercises, are not.
Source: TryHackMe pricing · Read 27 Sep 2026
Which frameworks does TryHackMe map results to?
- NIST
- ISO 27035
Source: TryHackMe: tabletop exercises · Read 27 Sep 2026
Where is TryHackMe strong, and where does it fall short?
Strengths
- Strong customisation: scenarios from your industry, attack vector and stack, with your own playbooks.
- Quick to launch, with unlimited exercises and participants stated by the vendor.
Limits
- Built for the security team more than for executives and the board.
- Business pricing, including tabletop exercises, is not published.
Where at least one platform scores higher
- Scenario realism: TryHackMe 6 / 10; highest Reflex Security 9 / 10
- Executive and board focus: TryHackMe 4 / 10; highest iluminr 9 / 10
- Exercise delivery effort: TryHackMe 8 / 10; highest Reflex Security 9 / 10
- Measurement and after-action reporting: TryHackMe 7 / 10; highest iluminr and Immersive Labs 9 / 10
- Regulatory evidence: TryHackMe 6 / 10; highest iluminr 10 / 10
- Customisation: TryHackMe 9 / 10; highest Conducttr 10 / 10
- Pricing clarity: TryHackMe 2 / 10; highest Conducttr 10 / 10
Who should shortlist TryHackMe?
Security teams that already use TryHackMe for skills and want frequent tabletops on their own playbooks without booking a consultant. Unlimited exercises and participants, playbook upload and editable injects make it a practical way to rehearse procedures.
Less suited to an executive or board exercise: the product centres on managers, practitioners and security leaders. Organisations exercising the boardroom should look at iluminr, Reflex Security or Immersive Labs.
How does TryHackMe compare head to head?
- BreachRx weighed against TryHackMe
BreachRx 6.75 / TryHackMe 5.95
- Conducttr weighed against TryHackMe
Conducttr 6.75 / TryHackMe 5.95
- Cyberbit weighed against TryHackMe
Cyberbit 5.90 / TryHackMe 5.95
- Cytactic weighed against TryHackMe
Cytactic 6.40 / TryHackMe 5.95
- Hack The Box weighed against TryHackMe
Hack The Box 5.60 / TryHackMe 5.95
- iluminr weighed against TryHackMe
iluminr 7.55 / TryHackMe 5.95
- Immersive Labs weighed against TryHackMe
Immersive Labs 7.30 / TryHackMe 5.95
- Reflex Security weighed against TryHackMe
Reflex Security 7.55 / TryHackMe 5.95
Desk notes that mention TryHackMe
- Add-On, Bundle or Standalone: How Crisis Simulation Is Packaged and Priced
- Reading Vendor Claims in Crisis Simulation Marketing
- Putting the Board in the Exercise: What Each Platform Documents for Directors
- Consultant-Led Tabletop or Platform: What Changes When Software Runs the Exercise
- AI in Crisis Exercises: What Each Vendor Says Its AI Actually Does
Frequently asked questions
How fast can a TryHackMe tabletop be launched?
TryHackMe states a 10-minute average time. We have not timed it.
Are TryHackMe tabletops included in the free plan?
Tabletop exercises are part of TryHackMe for business. Individual plans are priced publicly; business pricing goes through sales.
Which frameworks do TryHackMe tabletops align to?
NIST and ISO 27035, according to the tabletop exercises page, which also mentions audit-ready reports.
Read next
- Crisis simulation rankings
All nine platforms on every criterion.
- Side by side
TryHackMe next to the platforms closest in the ranking.
- Exercise planner
Re-weight the ranking for your own programme.
- How we score
Criteria, weights, and evidence rules.