# A Systematic Review of Cyber Range Taxonomies: Trends, Gaps, and a Proposed Taxonomy
## 3 Proposed Taxonomy
### Environment
We included it in our baseline taxonomy to reflect the growing interest among organizations in assessing cost impacts and return on security investments (ROI). This dimension captured the intersection between technical decision-making and financial evaluation, enabling analyses such as threat forecasting, cost-benefit trade-off, and financial risk estimation. Although under-represented in our results--likely also due to a search emphasis on architectural and technical features--its inclusion offers value for business-oriented stakeholders. We structured _Econometrics_ into five key characteristics, as shown in Table 6.  
The Econometrics dimension thus extended the taxonomy to accommodate organizations that prioritize quantifying ROI or evaluating the financial implications of their cyber training strategies. Teaming  
The _Teaming_ dimension refers to the organizational and role-based structure of participants in cyber range exercises. It was covered in several taxonomies [11; 12; 13; 30] and commonly revolved around color-coded teams. By treating _Teaming_ as a stand-alone dimension, we foregrounded its importance in structuring interactions, responsibilities, and objectives within a range scenario. _Teaming_ captured both human and automated participants and their respective function, as shown in Table 7. \begin{table}
\begin{tabular}{l l l l} \hline \hline
**Characteristic** & **Sub-Characteristic** & **Description** & **Refs** \\ \hline \multirow{2}{*}{Threat Forecasting} & \multirow{2}{*}{—} & Predicting the likelihood, timing, and financial consequences of future & [12; 62] \\  & & cyber-attacks. & \\ \hline \multirow{2}{*}{Choices and Implications} & \multirow{2}{*}{—} & Evaluating cost-benefit trade-offs, such as investing in cyber defence tools & [12; 62] \\  & & versus accepting residual risk. & \\ \hline \multirow{2}{*}{Mitigation Impact} & \multirow{2}{*}{—} & Analyzing the cost-efficiency of different defensive strategies under various & [12; 62] \\  & & threat conditions. & \\ \hline \multirow{2}{*}{Assessment Models} & \multirow{2}{*}{—} & Combining data from risk assessments, threat forecasts, and incidents to justify & [12; 62] \\  & & investment or gauge resilience. & \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Characteristics of _Econometrics_ dimension. \begin{table}
\begin{tabular}{l l l l} \hline \hline
**Characteristic** & **Sub-Characteristic** & **Description** & **Refs** \\ \hline Team Type & Red Team & Offensive actors who simulate attacks. Can be human participants or system-generated. & [11; 12; 13; 30] \\ \hline Team Type & Blue Team & Defensive participants—typically the main trainees—focused on detecting and & [11; 12; 13; 30] \\ \hline Team Type & Yellow Team & Roles that increase scenario realism (e.g., simulated users, IT staff). May be played or & [11] \\ \hline Team Type & White Team & Exercise facilitators, observers, and evaluators responsible for control and oversight. & [11] \\ \hline Team Type & Green Team & Technical support team maintaining infrastructure during the exercise. & [11] \\ \hline Team Type & Purple Team & Integrates Red and Blue team insights to improve tactical and strategic collaboration. & [11] \\ \hline Agent Type & AI-Based Agents & Machine learning-driven systems that dynamically plan, adapt, or execute scenarios. & [63] \\ \hline Agent Type & Autonomous Agents & Rule- or script-based agents that simulate behavior using deterministic logic (e.g., APT generators). & [64] \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Characteristics of _Teaming_ dimension. Learning  
The _Learning_ dimension appeared in several taxonomies, either as its own stand-alone category [11] or as part of a sub-branch, such as \"education\" in [12]. We defined it as encompassing both after-action analysis (e.g., gap analysis, scoring) and broader instructional support. Some authors, like [PERSON] et al. [13], did not label _Learning_ explicitly, instead referring to similar features under terms like _training setup_.