# Cyber Range Exercises: Potentials and Open Challenges for Organizations

Magdalena Glas, Fabian Böhm, Falko Schönteich, Günther Pernul

## ► To cite this version:

Magdalena Glas, Fabian Böhm, Falko Schönteich, Günther Pernul. Cyber Range Exercises: Potentials and Open Challenges for Organizations. 17th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2023, Kent, United Kingdom. pp.24-35, 10.1007/978-3-031-38530-8_3. doi:10.1007/978-3-031-38530-8_3

HAL Id: hal-05462087

https://inria.hal.science/hal-05462087v1

Submitted on 16 Jan 2026

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Cyber Range Exercises: Potentials and Open Challenges for Organizations

Magdalena Glas<fnref n="1" />(✉) , Fabian Böhm<fnref n="2" />(✉) , Falko Schönteich<fnref n="2" />(✉) , and Günther Pernul<fnref n="1" />(✉)

**Abstract.** The shortage of skilled cybersecurity professionals poses a significant challenge for organizations seeking to protect their assets and data. To address this shortage, onboarding and reskilling employees for cybersecurity positions becomes a daunting task for organizations. Cyber ranges mirror digital infrastructures to provide a realistic yet safe environment for cybersecurity training. To date, the potential of cyber ranges has been leveraged primarily in academic education. This paper investigates how cyber range exercises (CRX) can enhance the onboarding and reskilling of cybersecurity professionals in organizations. To this end, we conducted semi-structured interviews with seven cybersecurity professionals from organizations in different industry sectors in Germany and India. Our findings indicate that the main potential of CRXs lies in conveying universal cybersecurity concepts that are transferable to the particular systems, technologies and tools of an organization. Thereby, CRXs represent a promising complement to existing organizational training strategies. Challenges to overcome were identified in establishing an organizational CRX infrastructure, building the necessary competencies to conduct the exercises, and ensuring the comparability of CRXs to validate personal competence development.

## 1 Introduction

Cybersecurity threats continue to grow in complexity, impact, and scale, making it crucial for organizations to have a strong cybersecurity workforce that provides an effective line of defense against these threats [10]. Meanwhile, the severe shortage of skilled professionals in the field poses a significant challenge to organizations seeking to protect their assets and data [14]. To address this shortage and meet the demands of the ever-changing threat landscape, there is a need to equip more people with the competencies to work as cybersecurity professionals. As conventional knowledge transfer methods lack the possibility to convey practical cybersecurity skills, hands-on training in cyber ranges has gained popularity in recent years [23]. Cyber ranges mirror real infrastructures

<footnote n="1">¹ University of Regensburg, Regensburg, Germany</footnote>

<footnote>{magdalena.glas,guenther.pernul}@ur.de</footnote>

<footnote n="2">² Q_PERIOR AG, Munich, Germany</footnote>

<footnote>{fabian.boehm,falko.schoenteich}@q-perior.com</footnote>
to provide a realistic yet safe cybersecurity training and testing environment. A cyber range can facilitate a variety of different training or testing scenarios. The execution of a training or testing scenario on a cyber range is referred to as CRX. In a CRX, a trainee can experience cybersecurity attacks against realistic digital infrastructures. Research on cyber ranges has rapidly evolved in the past three years [11]. Although cyber ranges are already being used to some extent in private or public organizations [1, 2, 13], innovations in the field are predominantly driven by academic research [6,23]. In this context, CRXs are primarily developed for the education of students in cybersecurity curricula. Prominent examples are the cyber range platforms KYPO [5,22], CyTrone [3,20] and THREAT-ARREST [12]. CRXs on these platforms with hundreds of participants provide far-reaching insights into how cyber ranges contribute to acquiring practical cybersecurity skills in academic curricula. While higher education institutions undoubtedly play a crucial role in educating the future cybersecurity workforce, they alone are not sufficient to close the workforce gap in cybersecurity in a timely manner. Therefore, the education of cybersecurity professionals must also become a priority for private and public organizations. Intra-organizational training is frequently identified as one of the most effective measures for organizations to mitigate organizational cybersecurity workforce gaps [14,19]. Creating CRX-based training enables organizations to equip employees with the precise skill set required for a cybersecurity position in the respective organization. Moreover, intra-organizational cybersecurity training enables organizations to grow internal cybersecurity talent by offering reskilling programs to employees outside cybersecurity with an IT or other technical background.

In this work, we seek to pave the way for organizations to foster the potential of cyber range training for cybersecurity professionals. We focus on CRXs for individual competence development during cybersecurity onboarding or reskilling programs. To explore the potentials and challenges of CRXs in this context, we conducted semi-structured interviews with seven cybersecurity professionals from different industry sectors in Germany and India. To familiarize the interviewees with the concept of CRXs, we deployed two cyber ranges scenarios by Vielberth et al. [21] and Glas et al. [11] that aim at teaching practical detection and mitigation techniques to future cybersecurity professionals. The interviewees had different levels of expertise in cybersecurity, from less than one year to over 14 years of experience in the field. This allows us to depict different perspectives on the topic – from interviewees in the role of organizational cybersecurity trainees to professionals with years of experience with cybersecurity operations in one or more organizations.

The rest of this paper is structured as follows. A brief account of background on cyber ranges and related work is given in Sect. 2. In Sect. 3, we outline the method of our study. We present the findings of the interviews we conducted in Sect. 4, including a description of current training methods in the participants' organizations and highlighting potentials (Sect. 4.2) and open challenges (Sect. 4.3) for utilizing cyber ranges for organizational cybersecurity training. In Sect. 4.4, we shed light on the limitations of our study and give an outlook on future work before concluding our work in Sect. 5.
## 2 Background and Related Work

The origin of cyber ranges traces back to the late 2000s when the US Department of Defense developed the first cyber range to prepare soldiers for cyber warfare [9]. The concept adapts to the idea of shooting ranges providing a safe environment for individuals to practice and test their skills. Cyber ranges have extended their applications beyond the military domain and are now utilized for training individuals in cybersecurity across various domains [6]. The prevailing definition of the concept originates from the National Institute of Standards and Technology (NIST) referring to cyber ranges as “interactive, simulated platforms and representations of networks, systems, tools, and applications” [18]. The potential of cyber ranges lies in providing a realistic facility for hands-on training and testing that can better prepare individuals and organizations for real-world cyber-attacks. Depending on the specific needs of the training, cyber ranges can be entirely virtual or include actual physical hardware [15].

Prior works widely acknowledge that CRXs provide benefits within academic education and for cybersecurity professionals in practice. For instance, Collins et al. [7] emphasize the importance of hands-on training for security operations centers (SOCs), proposing a cyber range concept to train SOC analysts at different levels of expertise. However, this CRX concept is not tailored to the context of a specific organization but represents a generic SOC infrastructure. Similarly, Brilingaîtė et al. [4] and Kim et al. [16] report about designing and conducting large-scale CRXs for professionals from different industries. These CRXs were centrally organized by research institutions to enable cybersecurity professionals from various public institutions to test and improve cybersecurity skills. The focus of these CRXs was not to provide professionals with an organization-specific skill set but to strengthen cyber resilience on a national level. These works show promising results regarding the suitability of hands-on training for cybersecurity professionals, however, consider CRXs from a national rather than an organizational perspective. The Austrian Institute for Technology (AIT) proposes a “professional training” module as one component of the AIT cyber range [17]. However, the authors focus on the functional description of the component and not on how this form of training can be incorporated into an organization’s cybersecurity strategy. With this paper, we build on these findings and look at the potential and challenge of CRXs from the perspective of organization-specific competence development.

## 3 Method

To gain insights on the potential and challenges of CRXs in organizations, we conducted interviews with seven cybersecurity professionals in Germany and India. Interviewees were recruited with a snowballing system, initially recruiting cybersecurity professionals from the researchers' networks who recommended further colleagues. To consider a wide variety of professional contexts, we recruited participants with different levels of expertise and industry sectors.
<table><caption>**Table 1.** Interviewees' industry sector, country, position and experience in cybersecurity (in years).</caption><thead><tr><td>No.</td><td>Industry sector</td><td>Country</td><td>Position</td><td>Exp.</td></tr></thead><tbody><tr><td>I1</td><td>Machine Manufact</td><td>India</td><td>SOC Team Lead</td><td>6</td></tr><tr><td>I2</td><td>Machine Manufact</td><td>Germany</td><td>IT Governance Coordinator (Security)</td><td>1</td></tr><tr><td>I3</td><td>Machine Manufact</td><td>Germany</td><td>Chief Information Security Officer</td><td>14</td></tr><tr><td>I4</td><td>Banking</td><td>Germany</td><td>Information Security Officer</td><td>5</td></tr><tr><td>I5</td><td>Consulting</td><td>Germany</td><td>Manager</td><td>10</td></tr><tr><td>I6</td><td>Consulting</td><td>Germany</td><td>Consultant (Offensive Security)</td><td>1</td></tr><tr><td>I7</td><td>Consulting</td><td>Germany</td><td>Consultant (Offensive Security)</td><td>1</td></tr></tbody></table>

Table 1 provides details about the recruited interviewees. The planned user study was designed in accordance with the guidelines of the ethics committee of our university and did not raise any ethical concerns.

To familiarize the interviewees with the concept of CRXs we deployed two cyber range scenarios by Vielberth et al. [21] and Glas et al. [11]. These scenarios aim at training participants in responding to cyberattacks on a simulated industrial system. For this purpose, the participants engage with a Security Information and Event Management (SIEM) system for monitoring the industrial system. A Learning Management System (LMS) guides participants through the scenarios by providing information and dividing the scenarios into different tasks. For a more detailed description of the scenarios, we refer to the original works. We deployed the web-based CRXs a few days before the interviews, created user accounts for the interviewees and sent out the credentials to access the CRXs. Since this was just to introduce the interviewees to the idea of CRXs, the interviewees were left free to choose if they just wanted to actively participate in one of the exercises or were just given a brief overview on the CRXs at the beginning of the interview by the interviewer. To capture the interviewees' assessment of the possibilities of a CRX in a professional context, a semi-structured interview approach following the method of Corbin et Strauss [8] was chosen. To this end, we structured the interviews around three distinct topics. Each topic looked at the use of CRX in organizations from a different perspective:

1. **Status quo of cybersecurity onboarding and reskilling:** This topic aims to provide insight into how onboarding/reskilling is currently positioned in the participant's organization.
2. **Potential of CRXs:** In the second phase of the interview we asked the interviewee for their opinion and assessment of the potential and possible uses of CRX in the context of the status quo.

3. **Prospects on implementation and open challenges:** Within this interview phase, we wanted to understand how the interviewee envisions the implementation of CRXs in the organization to leverage the previously discussed potential. Subsequently, we talked to the participants about the obstacles and challenges to using CRX for onboarding and reskilling, investigating what could hinder the participants' organization from using a CRX.

The specific questions representing our interview guideline are provided in the appendix of this paper. For the participants to familiarize themselves with the questions, the interview guideline was sent to them in advance. All interviews were conducted virtually over a video conferencing tool. With the participants' consent, the interviews were recorded and transcribed afterward in preparation for the qualitative analysis. The captured raw data included 223 min of audio material and 32103 transcribed words. For data analysis, a structured coding approach was conducted. The first round of coding was performed by the first author, coding the interviews according to the three predefined topics. On this basis, the authors inductively drew conclusions from the interviews in several rounds of discussions. All findings were approved by the interviewees. Details about the individual interviews are given in Table 2.

<table><caption>**Table 2.** Details about the individual interviews: Degree of participation in the CRX, interview language and duration.</caption><thead><tr><td>No.</td><td>CRX participation</td><td>Interview language</td><td>Interview duration (minutes)</td></tr></thead><tbody><tr><td>I1</td><td>Active participation</td><td>English</td><td>24</td></tr><tr><td>I2</td><td>Active participation</td><td>German</td><td>27</td></tr><tr><td>I3</td><td>Overview given by interviewer</td><td>German</td><td>25</td></tr><tr><td>I4</td><td>Overview given by interviewer</td><td>German</td><td>42</td></tr><tr><td>I5</td><td>Active participation</td><td>German</td><td>57</td></tr><tr><td>I6</td><td>Active participation</td><td>German</td><td>30</td></tr><tr><td>I7</td><td>Active participation</td><td>German</td><td>17</td></tr></tbody></table>

## 4 Findings

In the following, we describe the findings of the seven interviews in relation to the three pre-defined topics *Status quo of cybersecurity onboarding and reskilling*, *Potential of CRXs*, *Prospects on implementation and open challenges* before outlining limitations of our study and giving an outlook on future work. A summary of our findings can be found in Table 3.
## 4.1 Status Quo of Onboarding and Reskilling in Cybersecurity

At the beginning of the interviews, all participants agreed that the cybersecurity workforce gap in cybersecurity is clearly noticeable in their respective organizations (I1–I7). The apparent symptoms of this problem are the low number of applicants for open positions (I3, I6) and the quality of applications regarding the suitability of candidates for the cybersecurity profiles they are looking for (I1–I4). The status quo of training for onboarding new colleagues and reskilling personnel from within the organization is currently limited to a mixture of on-the-job learning (I1, I3) and external training (I2–I7). In some cases, these two approaches are supplemented by training conducted privately (I5, I6, I7). The interviewees clarified that the organizations need training that focuses specifically on the skills and concepts required by the organization (I1, I2, I3, I5). However, internal resources and knowledge are lacking to develop and deliver such training (I6). Instead, generic, external training is used to map the onboarding and reskilling of employees. The role of generic certifications was seen ambivalently. While the consultants saw generic certificates as beneficial due to their cross-customer activities (I5, I6, I7), the other participants saw these external training as not being specific enough to the organization’s needs (I1–I4). Notably, none of the interviewees’ organizations have a formal training path for required roles and profiles in cybersecurity, despite the urgent need for such a formal but customized training approach was recognized.

## 4.2 Potential of CRXs

The status quo highlighted the organizations' need for formal defensive cybersecurity skills training tailored to their requirements. All participants stressed the potential of CRX in this context (I1–I7). CRXs can not only be used in the further training of IT security professionals but could also support the training of overall IT professionals concerning cybersecurity. Positions with a high turnover, such as SOC analysts, were named as a key target group for a CRX (I3). When onboarding new employees in this area, the interviewees felt it is most essential to provide an understanding of the overarching concepts and processes of the technology and the organization. Teaching general concepts and knowledge, as well as their applicability, is more important to almost all participants than the specific application of a particular technology or tool (I1, I3, I4, I5, I7). This is the core of the potential of CRXs, as seen by the participants: The opportunity to train concepts, processes, and procedures in a safe environment (I1–I5). Practically this means that it is more important for employees to understand, e.g., how a SIEM system generally works rather than being able to employ all functions of specific SIEM systems like Splunk<fnref n="1" />, QRadar<fnref n="2" /> or ArcSight<fnref n="3" />.

<footnote n="1">¹ https://www.splunk.com/.</footnote>

<footnote n="2">² https://www.ibm.com/qradar.</footnote>

<footnote n="3">³ https://www.microfocus.com/en-us/cyberres/secops/arcsight-esm.</footnote>
The potential content taught via the CRX can be separated into three levels (rf. Fig. 1). At the most general level, the CRX can be used to teach an understanding of overarching concepts (I1–I5, I7), e.g., network technology. At this level, participants might learn central concepts of cybersecurity. Specific tools do not matter at this point in a trainee’s education.

<figure><img src="image_3.png" /><figcaption>**Fig. 1.** Core potential of CRXs in organizations: We identified use cases on three levels (*Cybersecurity Tools*, *Cybersecurity Processes* and *Cybersecurity Foundations*).</figcaption></figure>

On the next, more concrete level, employees can enroll in CRX to learn the analytical procedures for detecting and analyzing security incidents, for example (I1, I2, I3, I5, I6, I7). Here, CRXs support employees in understanding the processes and frameworks applied within the organization. At this level, focusing on core cybersecurity processes, CRX can teach employees to understand and apply concepts like the Cyber Kill Chain<fnref n="4" />, the MITRE ATT&CK framework<fnref n="5" /> or related aspects of day-to-day cybersecurity work. The training on this level can range from more a knowledge-focused approach (e.g., understanding the different techniques within MITRE ATT&CK) to very practical (e.g., actually analyzing threats following a specific framework). Even more practical exercises like the process of on-boarding data sources to a SIEM system or defining use cases for incident detection within said SIEM system might be part of a CRX at this level.

Ultimately, a CRX can also support training on specific technologies (I2, I4, I5, I7). However, for the interviewees, the focus lies not on learning how to use a particular tool, but instead on the concepts of, e.g., anti-malware technology (I1, I3, I5). A CRX should enable employees to transfer general knowledge about, e.g., anti-malware technology to the specific tool which is used in the organization. Still, with regards to specific technologies, it might be feasible to implement a small set of CRXs focusing on these technologies. In practical terms, if an organization is using a particular SIEM system and has no intentions of transitioning to a different tool, it is reasonable to integrate this SIEM system in a CRX.

In addition to these technical aspects, some interviewees noted that a CRX could also be leveraged to train non-technical skills related to defensive security operations, such as stress resilience (I2) and analytical reasoning (I6), when

<footnote n="4">⁴ https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html.</footnote>

<footnote n="5">⁵ https://attack.mitre.org/.</footnote>
investigating an incident. From a practical perspective, this can be achieved through a more realistic simulation environment better reflecting the organization's actual circumstances regarding the number logs and related data artifacts. Further possible use cases for CRX as a test bed (I2) and “safe space” (I6) for process changes and optimizations were highlighted in the interviews.

## 4.3 Prospects on Implementation and Open Challenges

Regarding the implementation of a CRX and associated challenges, we talked with the participants about the required level of fidelity that a CRX must attain to offer an advantage to an organization over existing training options (rf. Sect. 4.1). The interviews revealed that achieving a high degree of fidelity in a CRX is hardly feasible but also not necessarily required. The participants pointed out that due to the immense complexity of IT infrastructures, exact replicas of these infrastructures cannot be created with a reasonable amount of effort (I3–I6). Interviewee I4 highlighted that IT landscapes are so dynamic that CRX pursuing a high degree of fidelity will always be subject to limited timeliness. However, this was not seen as an issue limiting the usefulness of CRXs:

> “You will never achieve a 100% replication of a system [for a CRX]. But I believe this isn’t necessary in a security context as you want to generate transferable knowledge.” (I3)

In the context of onboarding and reskilling, the interviewees described the potential of CRXs in transferring fundamental concepts in a CRX in a way that the trainees can apply them to different contexts in terms of tools and technologies (rf. Sect. 4.2). This sort of generic training does not require a CRX to mirror a particular organization. Instead, the interviewees considered a CRX for this purpose sufficient to provide a realistic training environment that takes into account industry-specific characteristics and the size of the organization (I3, I4, I5). These findings indicate that achieving a high level of fidelity is not a significant concern for the practical use of CRX in an organizational context. Instead, it is a walk along the lines of fidelity versus a limited budget. This demonstrates a mismatch between the requirements of practice and the current goals of academic research in the field of CRXs, for which fidelity is commonly prioritized as a vital objective in CRX design [11].

For use cases beyond onboarding and reskilling, the participants argued that the level of fidelity a CRX provides should align with the complexity of the training content (I2, I4–I7). In addition to technical expertise, higher-level cybersecurity professionals require a nuanced understanding of the organizational context in which they operate. They must be able to communicate effectively with both technical and non-technical stakeholders, e.g., to intermediate between the SOC detecting a cyberattack and the business departments whose systems are affected by the attack (I7). As such, CRXs designed for these roles must, to a certain degree of fidelity, reflect the respective organization's structures and processes.

In terms of sourcing, interviewees considered using CRXs provided by external vendors preferable to the option of internal sourcing (I1–I7). Interviewees I3 and I7 noted that smaller and medium-sized organizations might lack the competence and the resources to implement, manage, maintain, and conduct CRXs.
In addition, the potential of external sourcing was seen as a way to ensure that the content of a CRX is up-to-date (e.g., regarding recent attack vectors) (I4, I5, I6), based on best practices (I2) and enriched with external know-how (I3, I5). One interviewee specifically envisioned a “cyber range ecosystem” (I5), which provides a modular system with reusable learning and scenario components that can be individually orchestrated for an organization or industry.

<table><caption>**Table 3.** Summary of the interviews’ main findings per topic.</caption><thead><tr><td>Topic</td><td>Main findings</td></tr></thead><tbody><tr><td>Status quo</td><td><ul><li>All interviewees noted the cybersecurity workforce gap in their respective organizations evident by the low number of sufficiently qualified applicants for cybersecurity positions.</li><li>Current training methods involve a mix of on-the-job learning, external training, and occasional private training, but lack customization and specific focus on organizational needs.</li></ul></td></tr><tr><td>Potential</td><td><ul><li>The interviewees acknowledged the potential of CRXs providing a safe and isolated environment for hands-on cybersecurity skills training.</li><li>The main potential of CRXs was seen in conveying overarching cybersecurity concepts, rather than specific technologies or tools.</li></ul></td></tr><tr><td>Implementation and challenges</td><td><ul><li>CRXs providing a high degree of fidelity is not seen as a strong requirement for practical application as providing transferable knowledge is prioritized over exact replicas.</li><li>The advantages of CRXs in comparison to conventional training methods must be clearly differentiated to justify organizational investments in CRXs.</li></ul></td></tr></tbody></table>

During the interviews, several open challenges for the use of CRXs were discussed. The interviewees highlighted the significant investment of time, effort, and resources required to set up, operate, update, and maintain a cyber range (I2, I6, I7). To justify this investment, the advantages of CRXs over traditional training methods must be clearly differentiated for management stakeholders, as CRXs will compete with them over a limited budget (I1, I2, I3, I5, I6, I7). In this context, it was emphasized that CRXs, while undoubtedly beneficial, cannot replace on-the-job training entirely as they are not able to fully replicate the complexity and unpredictability of real-world cyberattacks (I1). In addition, the interviewees noted that participation in a CRX is not yet widely accepted as proof of competence compared to traditional certifications and, thus, cannot
be compared to them (I5). While participation in a CRX provides valuable experience, it may not carry the same weight as traditional certifications in the eyes of management or potential employers. Thus, participation may be less attractive to potential participants (I3, I5). Not only did the interviewees highlight the challenge of allocating budget for implementing a CRX, but also identified a hurdle in developing organizational competencies that are essential for managing a CRX. Specifically, the interviewees stressed the criticality of having a trainers conducting a CRX who possess both technical (I4) and didactic knowledge (I3, I6).

## 4.4 Limitations and Future Work

While our research has yielded valuable insights, certain limitations should be taken into consideration when interpreting our findings. The interviews were of varying lengths due to the time constraints of the participants, which may have impacted the depth in which the three topics could be addressed in some interviews. However, the open-question approach we followed helped us to ensure that each interviewee was still able to express the aspects that they felt were particularly relevant. As all of our interviewees were from organizations in Germany and India, this sample represents a limited geographical scope. Nevertheless, our interviewees represent a range of industry sectors, positions within cybersecurity, and levels of experience. Thus, we are confident to have captured a broad range of perspectives on the potentials and challenges of CRXs in organizations. To validate our results and provide a more complete picture of the topic, future research shall include a larger sample size with experts from further regions and types of organizations (e.g., public and non-governmental institutions).

# 5 Conclusion

Our study explores the benefits of CRXs in supporting organizations to overcome the cybersecurity workforce gap. Our findings show that from an organizational perspective, the main potential of CRXs lies in complementing existing training methods with strategies to convey fundamental cybersecurity concepts. A CRX serving this purpose should reflect characteristics common to the industry sector and size of an organization but does not need to precisely mirror the organization's IT infrastructure. While research currently focuses on creating exact replicas (high-fidelity environments) for CRXs, our findings indicate that generalizability should be prioritized over fidelity. Although this indication needs further validation, it opens a new perspective on CRXs and a possible path for effectively utilizing CRXs in private and public organizations.

**Acknowledgement.** We kindly want to thank all interviewees for sharing our enthusiasm for the topic and dedicating their time and effort to participate in our study. Without their valuable insights, this research would not have been possible. This work was performed under the INSIST project, which is supported under contract by the Bavarian Ministry of Economic Affairs, Regional Development and Energy (DIK0338/01).
# Appendix: Interview Guideline

## Topic 1: Status Quo of onboarding and reskilling in cybersecurity

- Q1.1: Is onboarding and reskilling of cybersecurity professionals a topic relevant to your organization, and what strategies are in place to address this need?

- Q1.2: Have you received any hands-on cybersecurity training throughout your professional career?

## Topic 2: Potential of CRXs

- Q2.1: In your opinion, what specific target groups within an organization could benefit from participating in cyber range exercises, and why?

- Q2.2: What specific skills and tools do you believe should be covered in a cyber range exercise?

## Topic 3: Prospects on implementation and open challenges

- Q3.1: When it comes to cyber ranges, what level of fidelity (i.e., realism) do you think is necessary to provide an effective training experience?

- Q3.2: In terms of cyber range development, do you see more potential in in-house development or in utilizing cyber range as-a-Service offerings, and why?

- Q3.3: What are challenges that organizations face when implementing a cyber range, and what strategies can be employed to overcome these challenges?

## References

1. Accenture: Accenture Security ICS Cyber Range. https://www.accenture.com/us-en/services/security/cyber-resilience

2. Airbus: Airbus cyberrange: An advanced simulation solution. https://www.cyber.airbus.com/cyberrange/

3. Beuran, R., Tang, D., Pham, C., Chinen, K., Tan, Y., Shinoda, Y.: Integrated framework for hands-on cybersecurity training: cytrone. Comput. Secur. **78**, 43–59 (2018). https://doi.org/10.1016/j.cose.2018.06.001

4. Brilingaitė, A., Bukauskas, L., Kutka, E.: Development of an educational platform for cyber defence training. In: Proceedings of the 2017 European Conference on Cyber Warfare and Security, pp. 73–81. Academic Conferences International Limited (2017)

5. Čeleda, P., Čegan, J., Vykopal, J., Tovarňák, D.: Kypo-a platform for cyber defence exercises. M&S Support to Operational Tasks Including War Gaming, Logistics, Cyber Defence. NATO Science and Technology Organization (2015)

6. Chouliaras, N., Kittes, G., Kantzavelou, I., Maglaras, L., Pantziou, G., Ferrag, M.A.: Cyber ranges and testbeds for education, training, and research. Appl. Sci. **11**(4) (2021). https://doi.org/10.3390/app11041809

7. Collins, M., Hussain, A., Schwab, S.: Towards an operations-aware experimentation methodology. In: Proceedings of the 2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), pp. 384–393 (2022). https://doi.org/10.1109/EuroSPW55150.2022.00046
8. Corbin, J., Strauss, A.L.: Basics of Qualitative Research: Techniques and Procedures for Developing Grounded Theory, 4th edn. Sage, Thousand Oaks (2015)

9. Davis, J., Magrath, S.: A survey of cyber ranges and testbeds. Technical report, Defence Science and Technology Organisation Edinburg (Australia) Cyber and Electronic Warfare DIV (2013)

10. Furnell, S., Fischer, P., Finch, A.: Can't get the staff? The growing need for cyber-security skills. Comput. Fraud Secur. **2017**(2), 5–10 (2017)

11. Glas, M., Vielberth, M., Pernul, G.: Train as you fight: evaluating authentic cyber-security training in cyber ranges. In: Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems (2023, forthcoming)

12. Hatzivasilis, G., et al.: The threat-arrest cyber range platform. In: Proceedings of the 2021 IEEE International Conference on Cyber Security and Resilience (CSR), pp. 422–427 (2021). https://doi.org/10.1109/CSR51186.2021.9527963

13. IBM: IBM Security X-Force Cyber Range. https://www.ibm.com/services/security-operations-center

14. (ISC)²: (ISC)² Cybersecurity Workforce Study 2022 - A critical need for cybersecurity professionals persists amidst a year of cultural and workplace evolution. Technical report (2022)

15. Kavallieratos, G., Katsikas, S.K., Gkioulos, V.: Towards a cyber-physical range. In: Proceedings of the 5th on Cyber-Physical System Security Workshop, CPSS 2019, pp. 25–34. Association for Computing Machinery, New York (2019). https://doi.org/10.1145/3327961.3329532

16. Kim, J., Maeng, Y., Jang, M.: Becoming invisible hands of national live-fire attack-defense cyber exercise. In: Proceedings of the 2019 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), pp. 77–84 (2019). https://doi.org/10.1109/EuroSPW.2019.00015

17. Leitner, M., et al.: AIT cyber range: flexible cyber security environment for exercises, training and research. In: Proceedings of the European Interdisciplinary Cybersecurity Conference. EICC 2020. Association for Computing Machinery, New York (2021). https://doi.org/10.1145/3424954.3424959

18. National Initiative for Cybersecurity Education (NICE): The Cyber Range: A Guide. Technical report (2020)

19. Oltsik, J., Lundell, B.: The life and times of cybersecurity professionals. Technical report, The Enterprise Strategy Group (ESG) and Information Systems Security Association International (ISSA) (2021)

20. Pham, C., Tang, D., Chinen, K., Beuran, R.: Cyris: A cyber range instantiation system for facilitating security training. In: Proceedings of the Seventh Symposium on Information and Communication Technology, SoICT 2016, pp. 251–258. Association for Computing Machinery, New York (2016). https://doi.org/10.1145/3011077.3011087

21. Vielberth, M., Glas, M., Dietz, M., Karagiannis, S., Magkos, E., Pernul, G.: A digital twin-based cyber range for SOC analysts. In: Barker, K., Ghazinour, K. (eds.) DBSec 2021. LNCS, vol. 12840, pp. 293–311. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-81242-3_17

22. Vykopal, J., Vizvary, M., Oslejsek, R., Celeda, P., Tovarnak, D.: Lessons learned from complex hands-on defence exercises in a cyber range. In: 2017 IEEE Frontiers in Education Conference (FIE), pp. 1–8 (2017). https://doi.org/10.1109/FIE.2017.8190713

23. Yamin, M.M., Katt, B., Gkioulos, V.: Cyber ranges and security testbeds: scenarios, functions, tools and architecture. Comput. Secur. **88**, 101636 (2020)