# A Systematic Review of Cyber Range Taxonomies: Trends, Gaps, and a Proposed Taxonomy
### Overview and Limitations of Existing Taxonomies  
Taxonomies help researchers and practitioners understand and analyze a domain by reducing complexity and identifying similarities and differences among objects [9; 10]. Over the past decade, multiple taxonomies have been proposed to categorize and structure the functions and components of cyber ranges.  
Among the most influential is the work by [PERSON] et al. [11], who delivered the first functional-layer taxonomy of cyber ranges. Their framework introduced six foundational dimensions: _Scenario, Monitoring, Learning, Management, Teaming_, and _Environment_. This taxonomy offered an organized examination of various capabilities, such as scenario design and user roles (e.g., Red vs. Blue teams), while treating underlying technologies like virtualization and orchestration as subcomponents rather than primary focus areas.  
Building on [PERSON] et al.'s classification, [PERSON] et al. [12] extended the scope with two further dimensions--_Econometrics_ and _Recovery_-- thereby foregrounding cost-benefit analysis and post-incident processes as critical evaluation criteria. These additional dimensions started to tackle the broader question of how organisations can leverage cyber ranges for strategic cost-benefit analyses and system resilience.  
Since then, several methods and frameworks have been proposed to categorize and visualize cyber ranges, reflecting the rapid development of the domain. A brief review of publications, as shown in Figure 1, reveals a substantial increase in cyber range studies over the past decade, signalling rising academic interest.  
Figure 1: The number of research papers published on cyber ranges between 2014 and 2024, visualizing the increase in the number of papers over time. The boolean expression [“cyber range” OR “cyberrange” OR “cyber-range”] was last conducted on DTU Findit ([[https://findit.dtu.dk](https://findit.dtu.dk)]([https://findit.dtu.dk](https://findit.dtu.dk))) and Google Scholar ([[https://scholar.google.com](https://scholar.google.com)]([https://scholar.google.com](https://scholar.google.com))) on 16 November 2024 The \(x\)-axis shows the publication years and the \(y\)-axis indicates the total number of papers identified each year.  
A series of systematic reviews have further shaped the research community's understanding of cyber ranges. Studies by [PERSON] et al. [2], [PERSON] et al. [13], and [PERSON] et al. [12], for instance, concentrated on scenario design and architecture, each recognizing that modern cyber ranges often require flexible infrastructures capable of replicating complex network conditions. Moreover, a handful of works have highlighted federated or distributed approaches, in which multiple cyber ranges are interconnected to support large-scale or cross-organizational training exercises [14; 15; 16; 17; 18; 19; 20; 21; 22; 23; 24; 25]. Such trends underscore the increasingly collaborative and scalable nature of cyber ranges, while earlier frameworks tended to focus on single-site or self-contained environments.  
Taken as a whole, these existing bodies of work illustrate the evolving landscape of cyber range research. Earlier research provided limited but foundational insights, while contemporary literature broadens the conversation to include advanced virtualization, orchestration, and economic considerations. Despite this expansion, many of the taxonomies in use today still lack a dedicated focus on technology as a separate, high-level dimension, an oversight that could neglect the fundamental infrastructure elements that shape each range's capabilities. The present study builds on these identified strengths and gaps, employing a multiphase approach to refine and merge existing taxonomies into a comprehensive framework that captures both functional and technological aspects. To achieve the stated aims, we defined explicit research objectives (Section 2) to guide the systematic review and taxonomy development process.