Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why Security Teams Are Using Cyber Range Platforms
Transcript
- Lucas: If these conversations are useful for what you're building or running, you're in the right place. I'm Lucas. Luna: And I'm Luna. This is Cybersecurity Business with Fexingo. Lucas: Today we're talking about cyber range platforms — essentially flight simulators for security teams. And I want to anchor this in a specific number: the global cyber range market is projected to hit around $3.9 billion by 2030, growing at a compound annual growth rate of roughly 18 percent. Luna: That's a lot of momentum. But what exactly is a cyber range? I think a lot of listeners might picture something like a military training ground. Lucas: That's actually not far off. A cyber range is a virtual environment that simulates real networks, endpoints, and attack scenarios. Teams can practice defending against a ransomware outbreak, a supply chain compromise, or a phishing campaign — all in a safe, isolated sandbox. No real systems are at risk. Luna: So it's not just for training new hires. It's also for testing your existing defenses. Lucas: Exactly. And that's where the ROI gets interesting. Traditionally, organizations ran tabletop exercises — everyone sitting in a conference room talking through a PowerPoint of 'what would you do if...' Which has value, but it doesn't test your actual tools or your muscle memory. Luna: Right — the difference between talking about a fire drill and actually pulling the fire alarm. Lucas: Precisely. So cyber ranges let you inject real traffic, real malware samples — obfuscated, but real — and see how your security operations center actually responds. One vendor I spoke with, RangeForce, says their customers see an average 30 percent improvement in detection accuracy after six months of regular range use. Luna: That's a big leap. Have you seen a concrete case study that illustrates that? Lucas: Yeah, there's a good one from a regional bank in the Midwest with about $12 billion in assets. They used a cyber range from Cyberbit to run weekly phishing simulations. Within six months, their mean time to detect a phishing email dropped from 4.2 hours to 2.5 hours — a 40 percent improvement. And the cost? About $50,000 a year for the platform, versus an estimated $200,000 in potential losses from a single successful phishing breach. Luna: So the math works even for mid-sized organizations. But I imagine building these scenarios is not trivial. You need to keep them current. Lucas: That is the biggest challenge. Threat actors evolve fast. If your range is running last year's ransomware variant, your team might feel confident but actually be unprepared. The better vendors update their content libraries weekly — pulling from real incident data, threat intelligence feeds, and sometimes even from live breaches that their research teams are tracking. Luna: So it's a living curriculum. Not a one-time purchase. Lucas: Exactly. And that's why the pricing model matters. Some platforms charge per user per year, others based on the number of scenarios you access. For a team of 50 analysts, you're looking anywhere from $30,000 to $150,000 annually depending on the depth of the library. Luna: Let's talk about who's buying this. Is it mainly large enterprises, or are we seeing adoption in mid-market too? Lucas: It used to be mostly large enterprises — think financial services, defense contractors, critical infrastructure. But now we're seeing more regional banks, healthcare systems, even some retail chains. The driver is often cyber insurance. Insurers are increasingly requiring evidence of hands-on training, not just policy documents. Luna: That's a powerful nudge. If your premium goes down by 10 percent because you can show you run quarterly range exercises, the platform pays for itself. Lucas: Exactly. And that's becoming more common. I've seen cases where a single simulation — like a simulated ransomware attack — uncovered gaps in their backup restoration process that would have cost millions in real incident recovery. Luna: So it's not just training, it's also a stress test for your processes. Lucas: Right. And that's the part that CISOs really value. You can run a range exercise and discover that your incident response plan says 'contact the CISO within 15 minutes' but the actual on-call rotation has a 45-minute lag. That's something you can fix before a real breach. Luna: I want to ask about the human side. Are these platforms engaging enough to keep analysts interested? Lucas: The good ones are. They use gamification — points, leaderboards, time challenges. One analyst I spoke with said it felt like 'Capture the Flag for grown-ups.' And that matters because turnover in SOCs is brutal. If you can make training feel like a challenge rather than a chore, you retain people longer. Luna: That's an underrated benefit. If a platform helps you keep an analyst for even six extra months, that's a huge savings in recruiting and onboarding costs. Lucas: Absolutely. The average SOC analyst tenure is around 18 months. If a cyber range can make the job more interesting and skill-building, it's a retention tool as much as a training tool. Luna: What about the cloud? How are vendors delivering these ranges — on-prem or as a service? Lucas: Almost entirely cloud-based now. You spin up a virtual environment in AWS or Azure, run your exercise, then tear it down. That keeps costs low and makes it easy to scale. Some platforms also offer hybrid options for air-gapped environments, but that's the exception. Luna: So if a company wanted to start using a cyber range, what's the first step? Lucas: Most vendors offer a pilot — you run a single scenario with a small team, usually free or for a nominal fee. I'd recommend picking one scenario that your team actually struggles with. For example, if phishing is your top attack vector, run a phishing simulation. See how long it takes to detect, report, and contain. Then run the same scenario three months later after training. Luna: And measure the delta. That's a concrete way to justify the investment. Lucas: Exactly. And if you can show that the mean time to detect dropped by even 20 percent, you've got a business case for a full rollout. Luna: So if today's episode gave you a useful framework or a new angle on how to think about training your team, that's exactly what we aim for around here. And full disclosure — this show stays ad-free because people like you chip in to keep it that way. If you found value, you can support the work at buy me a coffee dot com slash fexingo. Lucas: Yeah, it's a small way to make sure we keep digging into topics like this without any sponsor influence. We appreciate it. Luna: Alright, back to cyber ranges — I want to touch on something we haven't covered: how these platforms handle collaboration between red and blue teams. Lucas: Great point. Many cyber ranges now support joint exercises where the red team launches an attack and the blue team defends, all in real time. That's where you really build muscle memory. Some platforms even record the entire session for playback, so you can do a post-mortem on every decision. Luna: That kind of replay feels like sports film review. You can pinpoint exactly where communication broke down. Lucas: Exactly. And that's often where the biggest improvements come from — not technical skill, but coordination. In one exercise I heard about, the blue team detected the breach in under 10 minutes, but it took them 45 minutes to decide who had authority to shut down the affected server. The range exercise exposed that bottleneck without any real damage. Luna: That's a great example of why tabletop exercises alone fall short. You can't simulate that kind of decision-making pressure on a slide deck. Lucas: No, you can't. And that's why I think we'll see cyber ranges become as standard as fire drills in the next few years. The market growth suggests that. Luna: It sounds like for any company that takes security seriously, a cyber range is no longer a nice to have — it's becoming a must-have. Lucas: I'd agree with that. And the best part is, you don't have to be a giant to get started. A $30,000 investment for a team of 50 is a fraction of the cost of a single breach. The math is pretty clear. Luna: Lucas, great conversation. For our listeners, if you want to dig deeper into cyber range platforms, we'll have links in the show notes to some of the vendors we mentioned. Lucas: Thanks for tuning in. We'll be back next week with another deep dive.