Guide
What is a cyber range? A plain-words guide for SOC teams
A cyber range is a sealed practice environment where your security team meets a real attack and is measured on how it responds. This guide covers what a range is, what it is not, how a drill runs, and what to ask any vendor.
01 · What it is
A safe place to meet a real attack
A cyber range is a realistic network, sealed from the world, with real security tools and synthetic users and data. An attack runs inside it; your team detects it, raises the incident and reports what was hit; the range measures how fast. Because it is sealed, nothing inside can reach anything real.
02 · What it is not
What a cyber range is not
- Not a slide deck
- A slide deck talks about an attack. On a range, your team works one, in real time.
- Not a video course
- A course shows someone else doing the work. On a range, your own team does it and is measured.
- Not a scan report
- A scan lists weaknesses in your systems. A range shows how your team responds when an attack comes.
03 · A drill
How a drill runs on Setu Range
An automated attacker climbs from a branch desk toward the core. Real sensors raise real alerts. Your analyst raises the incident and reports what was hit. Two clocks run: how fast the tools detected the attack, and how fast the human responded.
- 02:14:07 · ControllerThe controller starts the run. Both clocks start.
- 02:14:07 · AttackerThe automated attack starts at a branch desk.
- 02:14:31 · AttackerA foothold on the branch workstation.
- 02:14:31 · SensorsA real alert on the branch workstation. Detected in 24s.
- 02:15:20 · AttackerThe attack moves toward core banking.
- 02:15:44 · SensorsA critical alert on core banking.
- 02:16:30 · AttackerThe attack reaches for the payments database.
- 02:16:40 · SensorsA critical alert on the payments database.
- 02:16:50 · SOC analystThe analyst works the alerts in the SIEM.
- 02:18:19 · SOC analystThe analyst raises the incident. Raised in 4m 12s.
- 02:18:25 · SOC analystThe analyst reports the systems hit: 2 of 3.
- 02:18:28 · ControllerThe run ends. The scorecard is ready.
example exercise · detected in 24s · raised in 4m 12s
Watch the same exercise play on one clock on the Platform page.
04 · Before you buy
Five questions to ask any cyber range vendor
- Is it sealed from the world?
- Nothing inside the range should reach anything real, and it should never connect to your production systems. On Setu Range, full isolation from the outside is proven.
- Is there a real SIEM?
- Your analysts should work real alerts from real sensors, not a scripted screen. Setu Range gives your analyst a real SIEM fed by real sensors.
- Does it measure two clocks?
- How fast the tools detected the attack, and separately how fast your team raised it. Setu Range measures both.
- Is there evidence behind each number?
- Every result should say how it was measured. On a Setu Range scorecard, every number does.
- Where does it run?
- Ask whether it is hosted, on your own servers, or both. Setu Range is hosted by us, or installed on your own servers.
05 · Who uses one
Who uses a cyber range
SOC teams in organisations that must show they can respond to an attack. These are sectors we shape drills for. The drill on the range today runs on a realistic bank network, and we shape it to your sector with you.
06 · Setu Range
Setu Range in one paragraph
Setu Range is a cyber range for cyber resilience drills. Your whole SOC team faces a real, automated attack on a realistic enterprise environment. Every drill ends with a scorecard that shows what was caught, how fast, and how each number was measured.
Made by Cyber Whisper. Hosted by us, or on your own servers. See how it works, or the drills your regulator asks for.
Questions
Questions buyers ask
- What is a cyber range?
- A sealed practice environment: a realistic network with real security tools, where your team meets a real attack and is measured on how it responds.
- Is it safe to run an attack on a cyber range?
- Yes, when the range is sealed. Setu Range is sealed from the world, uses synthetic users and data, and is never connected to your production systems. Its attack is automated and non-destructive.
- Who takes part in a drill?
- The whole SOC team: the analyst in a real SIEM, with observers and a controller.
- What do we get at the end of a drill?
- A scorecard that shows what was caught, how fast, and how each number was measured, with the evidence behind each number.
- Does Setu Range run on our own servers?
- It can. Setu Range is hosted by us, or installed on your own servers.
Your first exercise