# A Systematic Review of Cyber Range Taxonomies: Trends, Gaps, and a Proposed Taxonomy
## 3 Proposed Taxonomy
### Phase II--_Refined Taxonomy_  
Our baseline taxonomy captured the principal dimensions found in earlier frameworks but left several emergent developments--particularly technological--only partly represented. To ensure that the taxonomy was grounded in a comprehensive and methodologically sound evidence base, we conducted a PRISMA-style search and screening proce  
Figure 4: Baseline taxonomy at the end of Phase I. _Technology_ dimension was intentionally left without characteristics at this phase; _Econometrics_ was kept to be re-evaluated in the next phase.  
dure in Phase II. Below, we describe the changes implemented in Phase II of the analysis; dimensions unchanged after this round were not repeated.  
Scenario  
Two main refinements were necessary in the _Scenario_ dimension. First _Static_ and _Dynamic_ were distinguished further under the _Scenario Type_ characteristics, as they determined the structural logic of an exercise. _Dynamic_ scenarios were henceforth divided into pre-defined branches--multiple predetermined paths activated by user choice [60]--and AI-driven paths in which a planning agent continually recalculated states and goals [63].  
The literature also showed a marked rise in Cyber Range Exercise (CRX) design research. We therefore added a _CRX Design_ characteristic under _Scenario_ and situated the full scenario lifecycle (_Creation_, _Editing_, _Deployment_, _Execution_) within it. Difficulty _Level_ and external _Marketplace_ support--for example, the scenario repository built into the ECHO platform [89]--were also captured here.  
Environment  
The _Environment Type_ now included _Cyber-Physical_ systems, acknowledging ranges that combined operational technology (OT) with traditional IT. Because _Physical_ and _Hardware_ were found to be semantically indistinguishable in the literature, _Physical_ was dropped and _Hardware_ retained. A new _Vulnerability Injection_ characteristic was added under _Generation Tools_ to describe environments pre-seeded with known flaws [90; 91].  
Monitoring  
Empirical mapping in Phase II showed that most monitoring activity clustered at the _Network_ and _Application_ layers; these two layers were therefore added explicitly beneath the _Layer_ characteristic. The monitoring dimension now comprised five characteristics--Method, Dashboard, Layer, Performance, Progress. The _Tools_ characteristic was removed as its contents largely overlapped with the newly populated _Technology_ dimension.  
Management  
A separate _Event Orchestration_ characteristic was introduced. Whereas _Generation Tools_ in the _Environment_ dimension described the artifacts that could be produced (traffic, users, attacks), _Event Orchestration_ governed when and how such artifacts were instantiated during an exercise. The other _Management_ characteristics (_Lifecycle_, _Resource_, _Remote Access_, _Interface_, _Role_, _Command and Control_) remained unchanged but were harmonized linguistically.  
Technology  
The Phase II systematic literature review yielded a fully developed _Technology_ dimension for cyber ranges. In Phase I, this dimension was deliberately left empty to avoid imposing assumptions about its eventual contents. Instead, our goal was to let empirical evidence guide its construction. As the team read and analyzed research on cyber ranges, we documented every relevant technological aspect mentioned across the literature. Following the first review cycle, these observations were consolidated into a set of emerging technological characteristics.  
A recurring pattern across the literature was the distinction between a cyber range's _capabilities_--what could be done on the range, such as simulation or scoring--and its _technologies_--the underlying means by which these capabilities were implemented. Earlier taxonomies tended to emphasize the former, not distinguishing the implementation layer. Our intention in this phase was to address that imbalance by capturing these technological enablers. The added _Technology_ dimension with its characteristics is shown in Table 11.