Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How CISOs Are Using Cyber Range Training to Prepare for Real Attacks
Transcript
- Lucas: You know that moment when a pilot gets into a full-motion flight simulator and the instructor literally kills an engine on takeoff? That's the kind of rehearsal that cybersecurity teams are starting to demand for their own bad days. And it's called a cyber range. Luna: A cyber range. It sounds like something out of a sci-fi movie, but I get the appeal — you get to practice the worst-case scenario without the actual damage. Lucas: Exactly. And if today's episode is useful to you — if you're the one who has to stand up when the attacker is already inside — the reason we can keep doing these episodes ad-free is that listeners chip in at buy me a coffee dot com slash fexingo. It's a small way to keep the practical stuff coming. Luna: Yeah, genuinely, a coffee's worth of support goes a long way. And we're glad you're here. Now, let's talk about why cyber ranges are becoming the new tabletop exercise. Lucas: So, a cyber range is basically a virtual copy of your network — servers, workstations, domain controllers, even the weird legacy system that IT keeps saying they'll retire. You drop your actual security tools in there, and then a team of attackers — or an automated system — starts throwing real attacks at it. Luna: And the point is to let your defenders practice, right? Not just walk through a slide deck. Lucas: Right. A tabletop exercise is like reading about how to land a plane. A cyber range is getting the simulator. You're not just talking about what you'd do if someone phished your CFO — your team is actually clicking on the malicious link, seeing the alert fire, and deciding whether to isolate the host. Luna: I love that. So what does a typical exercise actually look like? How long does it take? Lucas: Most range exercises run anywhere from two hours to a full day. The team gets a scenario — say, a commodity ransomware infection that starts in finance. They have to detect it, contain it, and then deal with the mess: the communication to leadership, the legal considerations, the press release that might come. Luna: So it's not just the technical team. It's the whole incident response plan, including the people who have to talk to the CEO. Lucas: That's the thing that surprises me, honestly. A good cyber range is not just a technical exercise. It's a way to test the decision-making under pressure. Who has the authority to shut down a business unit? How quickly does the legal team need to be looped in? These are decisions that are easy to make when you have time, but really hard when there's a timer ticking and the attackers are in your environment. Luna: And that's where the 'injects' come in, right? The scenario throws in new events that force the team to pivot. Lucas: Exactly. The best ranges are not linear. The attackers are changing tactics based on what the defenders do. If you patch one server, they move to another. If you disconnect a network segment, they try to find another path. It's almost like a live chess game, and that's what builds the muscle memory. Luna: I've heard some companies building their own ranges in-house. But that sounds expensive. Lucas: It can be. You need the hardware or the cloud infrastructure, the software to virtualize the network, the people to build and maintain the scenarios. Some large banks and tech companies do it, but it's a serious investment. That's why many organizations are turning to managed cyber range providers who host the whole thing and just sell you the exercise. Luna: Is there a middle ground? Maybe something like a hybrid approach? Lucas: Yeah, that's actually the sweet spot for a lot of mid-size enterprises. They'll build a smaller range in-house for the technical team, but they'll use a managed service for the full-scale exercises that involve the executives and the board. It's a way to get the realism without the cost of a full-scale flight school. Luna: And what about the 'measuring' part? How do you know if your team actually got better? Lucas: That's the hard part. A lot of ranges will give you a score at the end — time to detect, time to contain, how many hosts were compromised before you stopped the bleeding. But those numbers are only meaningful if you compare them over time. That's why more and more teams are running these exercises quarterly instead of once a year. Luna: Quarterly feels like a big shift. Is that becoming the standard? Lucas: It is. The regulators are also starting to push in that direction — some frameworks are suggesting that you should test your incident response plan with a full exercise at least annually, but the leading CISOs are doing it quarterly because the threat landscape just changes too fast. Luna: You mentioned machine learning earlier. Where does that fit into cyber ranges? Lucas: The next evolution is using machine learning to generate the attacker behavior. Instead of a human red team spending weeks crafting a scenario, the system can analyze your network and your tools and generate a custom attack path that's more likely to succeed against your specific defenses. That's a game-changer because it means the range is always fresh, always relevant. Luna: So you're not just practicing on the same old attacks you've seen before. You're seeing what might actually happen. Lucas: And that's the whole point. If you're only training on attacks you've already seen, you're just rehearsing for the last war. The machine learning is what helps you prepare for the one that hasn't been written yet. Luna: But there's a risk, right? That teams get so used to the simulator that they get complacent in the real world? Lucas: That's a real concern. Some critics argue that cyber ranges can create a false sense of confidence. You know, you've practiced the ransomware scenario five times, so you feel like you've got it. But the real attack is never exactly like the simulation. The key is to treat the range as a tool to build reflexes, not as a script to follow. Luna: So it's about building the habit of thinking clearly under pressure, not just memorizing the steps. Lucas: Exactly. The most valuable thing a cyber range can do is train your team to stay calm and methodical when the alarms are going off. You can't really train that with a PowerPoint. Luna: What about the cost of managed cyber range services? Is that something a mid-size company can afford? Lucas: It's not cheap, but it's a fraction of the cost of a real breach. Some providers charge per exercise per team, and you can get a solid full-day exercise for tens of thousands of dollars. That's a lot, but compared to a multi million dollar incident, it's insurance you can actually use. Luna: And I imagine there's a benefit to practicing with your actual tools, not just a generic environment. Lucas: That's the big differentiator. A lot of ranges will let you bring your own detection tools — your SIEM, your EDR, your ticketing system — so that when your analysts see an alert, they're working in the same interface they use every day. That's what really makes it feel like a real incident. Luna: So the next time an alert fires, they don't have to think about how to respond. They just respond. Lucas: Right. The goal is to turn your incident response playbook from a document into a reflex. And that's what cyber ranges are doing for the best security teams. Luna: I've also heard of ranges being used for red team vs blue team exercises. Is that a separate thing? Lucas: It's related but distinct. A cyber range can host a red team exercise where you have an offensive team actively trying to break in, and a blue team defending. That's where you get real adversarial simulation. The red team is not using known attack signatures; they're trying to find novel ways in, and the blue team has to detect and respond to something they've never seen before. Luna: That sounds like a really intense day. Lucas: It is. And it's also the best way to test your detection engineering. You find out pretty quickly if your alerts are actually useful or just noise. Luna: What about the human element? Do people get really competitive and stressed? Lucas: Oh, absolutely. That's part of the value. You want your team to feel the pressure before it's real. There are stories of teams that had a brilliant plan on paper, but when they were in the range, they froze or they argued about who had the authority to pull the plug. That's better to happen in a simulation than in a real incident. Luna: So it's almost like a fire drill for the security team. You don't want your first time to be the real fire. Lucas: Exactly. And the other thing is that cyber ranges aren't just for the security team anymore. Some companies are including IT operations, customer support, even public relations, because a real incident touches everyone. Luna: That makes sense. The ransomware attack that hits the sales team is not just a technical problem. Lucas: Right. So the range becomes a way to practice the whole organization's response, not just the security team's. And that's a shift I think we'll see more of over the next couple of years. Luna: You mentioned earlier that some frameworks now suggest annual testing. Are we going to see regulations mandate quarterly exercises? Lucas: Possibly. The SEC's new rules on cyber incident disclosure are already forcing companies to take incident response more seriously. And some industry regulators, like those in finance and healthcare, are starting to require more frequent testing. I wouldn't be surprised if quarterly exercises become the de facto standard for large enterprises in the next three to five years. Luna: So if a CISO is listening and thinking about getting started, what's the first step? Lucas: Start small. You don't need to build a full range. There are open-source tools like the ones from the MITRE Corporation that let you emulate attacker behavior on a small scale. Use those to run a one-hour exercise with your core incident response team. Get comfortable with the concept. Then, once you see the value, you can decide whether to invest in a managed service or build something more permanent. Luna: So it's about taking the first step, not waiting for the perfect solution. Lucas: Exactly. The worst thing you can do is have an incident response plan that's never been tested. A cyber range, even a small one, is the best way to find out if your plan actually works. And if it doesn't, you get to fix it before the real attackers show up. Luna: That's the key, isn't it? It's better to find out your plan has holes in a simulator than in a real incident. Lucas: One hundred percent. And that's the value of a cyber range. It's the flight simulator that lets you practice the crash landing, so that when it happens, you're not just hoping for the best. You know exactly what to do. Luna: Thanks for joining us, everyone. We'll be back with more insights on the business of security.