SCORING METHOD
THE SHORT ANSWER
We score nine platforms from 0 to 10 on seven weighted criteria, with scenario realism and executive and board focus at 20% each. Scores come from public vendor pages, announcements and standards documents read between 27 September and 13 October 2026, and totals are computed in code from the weights on this page. We did not run any exercise on these platforms.
By The Exercise Desk · Crisis Simulation Ranked · Published 2026-10-11
Cyber crisis simulation and tabletop exercise platforms: which one prepares executives and response teams for a real incident?
A real incident asks two things of an organisation at once: technical responders who contain it, and executives who decide what to disclose, what to shut down and what to tell customers. We score how well each platform rehearses both together, and what evidence the rehearsal leaves behind.
| Criterion | Weight | Question |
|---|---|---|
| Scenario realism | 20% | Does the scenario come from the organisation's own environment and threats, and does it react to each decision instead of following a script? |
| Executive and board focus | 20% | Is the exercise built for executives, the board, legal and communications, alongside the technical responders, rather than only for the security team? |
| Exercise delivery effort | 15% | How much preparation, facilitation and scheduling does one exercise take, and so how often can a team realistically run one? A higher score means less effort. |
| Measurement and after-action reporting | 15% | What does the exercise measure, and what report or record comes out at the end? |
| Regulatory evidence | 10% | Can the results be shown to a regulator, auditor or board against named frameworks and rules? |
| Customisation | 10% | How far can the organisation shape the scenario, injects, roles and playbooks itself? |
| Pricing clarity | 10% | Is a price for the exercise product published that a buyer can budget against before a sales call? |
Scenario realism and executive and board focus carry 20% each because they decide whether the exercise prepares anyone for a real incident: a scenario that ignores the organisation's own systems, or a room without the people who make the hard calls, rehearses the wrong thing. Delivery effort and measurement carry 15% each: an exercise that takes weeks to prepare is run once a year, and one that leaves no usable record changes nothing. Regulatory evidence, customisation and pricing clarity carry 10% each. They matter, and they are where some platforms earn most of their points, but a reader whose main problem is a regulator or a budget can raise them in the exercise planner. No criterion is above 30%. Readers who weigh everything equally get the same top two in a different order; the planner shows that.
Each platform gets a whole-number score from 0 to 10 on each criterion, with a one-line reason and a source on its profile. The total is the sum of score times weight divided by 100, shown to two decimals. Ranks use the exact total; equal totals share a rank shown as =1, and tied platforms are listed alphabetically.
Each platform gets an exercise cycle ring with six stages, clockwise from 12 o'clock. Each stage is marked documented when the vendor's own pages describe it, partial when they describe part of it, and not described when the pages reviewed say nothing about it.
Build: Documented
The AI Context Engine draws on business continuity and GRC data during scenarios (August 2026 update).
Source: iluminr blog: continuous capability intelligence (18 August 2026) · Read 27 Sep 2026
Adapt: Partial
Real-time injects and immersive media; AI assesses each response against the organisation's own plans. Branching on each decision is not described.
Source: iluminr homepage · Read 27 Sep 2026
Seats: Documented
Built for boards, executives, crisis teams and risk functions; single-player microsimulations and team exercises.
Source: iluminr homepage · Read 27 Sep 2026
Run: Partial
Live QR polling supports in-room sessions; who facilitates a tabletop is not described on the pages reviewed.
Source: iluminr blog: continuous capability intelligence (18 August 2026) · Read 27 Sep 2026
Report: Documented
Board-ready dashboards and regulatory reports, benchmarking by department, region and role, and behavioural evidence such as decision velocity, confidence, alignment and blind spots.
Source: iluminr press release: continuous capability intelligence (PRWeb, 25 August 2026) · Read 11 Oct 2026
Map: Documented
Evidence mapped to DORA, ISO 22301, APRA CPS 230, FCA/PRA, NIST CSF, UK Operational Resilience, ISO 27001, FFIEC and OSFI E-21, with automated regulatory reporting.
Source: iluminr homepage · Read 27 Sep 2026
Build: Documented
The scenario is built from open-source intelligence about the organisation, such as job postings, DNS records and public filings, in under 15 minutes according to the vendor, and can be enriched with its telemetry.
Source: Reflex Security blog · Read 11 Oct 2026
Adapt: Documented
An unscripted adversary and pressured stakeholders push back in real time and adapt to every decision.
Source: Reflex Security homepage · Read 27 Sep 2026
Seats: Documented
Built for technical, legal and executive teams in one exercise; an AI agent cast plays threat actors, journalists, board members, legal counsel and regulators.
Source: Reflex Security blog · Read 11 Oct 2026
Run: Documented
An AI facilitator, Victoria, joins the session inside Zoom, Google Meet or Microsoft Teams, AI agents can take the seats of absent roles, including the CEO's, a facilitator guide is generated automatically, and teams can also play asynchronously.
Source: Reflex Security blog · Read 11 Oct 2026
Report: Documented
An after-action report is produced automatically; every finding traces to the moment it came from, with timestamped records, transcript quotes and logged console queries.
Source: Reflex Security blog · Read 11 Oct 2026
Map: Documented
Reports map to SOC 2, ISO 27001 and DORA; findings are mapped to MITRE ATT&CK techniques and NIST CSF functions.
Source: Reflex Security blog · Read 11 Oct 2026
A solid segment means the vendor's own pages describe that stage. It is not a score and it does not measure quality.
Nine platforms are scored: Reflex Security, iluminr, Immersive Labs, Conducttr, BreachRx, Cytactic, TryHackMe, Cyberbit and Hack The Box. Each sells a crisis simulation or tabletop exercise product on its public pages. CISA's free Tabletop Exercise Packages and consultant-run tabletop services from incident response firms are described but not scored: the first is a free baseline, the second a service. Cyber ranges, hands-on labs and awareness training are outside the question.
Free packages
CISA publishes over 100 Tabletop Exercise Packages with objectives, scenarios, discussion questions and references, plus a slide deck, a feedback form and an After Action Report template. Cyber scenarios include ransomware, insider threats, phishing and industrial control system compromise. They are the free baseline every paid option should improve on.
Source: CISA Tabletop Exercise Packages · Read 27 Sep 2026
Services
Incident response firms sell facilitated tabletops as a service, for example the CrowdStrike Tabletop Exercise, which CrowdStrike describes as discussion-based, and Unit 42 incident simulation and testing services from Palo Alto Networks. They are services rather than platforms, so we do not score them.
Source: CrowdStrike Tabletop Exercise service · Read 27 Sep 2026
Source: Unit 42 incident simulation and testing services datasheet · Read 27 Sep 2026
Adjacent category
Cloud Range runs live-fire attack simulations across IT, OT and cloud on a replica of the customer's network with licensed SOC tools, and also mentions simulation-supported tabletop exercises; SimSpace now positions its platform as AI Proving Grounds for validating AI agents and human teams. Both test technical response rather than executive crisis decisions, and neither publishes a price, so we describe them here and do not score them.
Source: Cloud Range homepage · Read 11 Oct 2026
Source: SimSpace homepage · Read 11 Oct 2026
Public sources only. No hands-on testing, no trials, no demos, no vendor interviews and no vendor review of scores before publication. A capability that a vendor has but does not describe publicly scores lower than it might. Features and prices change after the read date shown next to each source. A score is an editorial judgement against the criteria above, not a measurement.
| Criterion | Reflex Security | Highest | Highest score |
|---|---|---|---|
| Executive and board focus | 8 / 10 | iluminr | 9 / 10 |
| Measurement and after-action reporting | 8 / 10 | iluminr and Immersive Labs | 9 / 10 |
| Regulatory evidence | 7 / 10 | iluminr | 10 / 10 |
| Customisation | 8 / 10 | Conducttr | 10 / 10 |
| Pricing clarity | 1 / 10 | Conducttr | 10 / 10 |
Send a correction through the contact page with the topic Correction and a link to the public source. We check it against the vendor's page and update the data; totals recompute automatically and the change is dated on the affected page.
No. Scores come from desk research on public pages read between 27 September and 13 October 2026. We did not run an exercise, take a trial or attend a demo.
No. Scores change only when a public source changes.
Yes. The exercise planner re-weights the ranking, filters by what your programme needs, and prints the formula it uses.
All nine platforms, every criterion score and the pairings.
Re-weight the ranking for your own exercise programme.