Cyber range consultancy, exercise design and delivery

Complexity creates practical design problems. The story may depend on a service that the range does not contain. An attack may produce evidence that does not match the scenario. Participants may defend a system successfully without the scoring recognising it.

An exercise can also be technically convincing but miss how the industry actually operates: which services matter, who has authority to act and what disruption means for the organisation.

ObsidianCorps starts with those connections. The aim is to make the technical work, participant decisions and evaluation serve a coherent exercise.

Our approach begins with a deep investigation of your industry and operational context. Before developing the story or architecture, we need to understand what the organisation does, which systems and services it depends on, and what participants should learn or demonstrate.

For an exercise involving operational technology, a containment decision may affect the operation being simulated. For a government exercise, the relationship between organisations may shape escalation and coordination. These are examples of the questions that should inform the design; the relevant details depend on your objectives.

Realism means choosing the details that make participants' actions meaningful. It includes the services they use, the traffic they investigate, the logs available to them and the consequences described in the story. The required fidelity should follow the exercise objectives and the maturity of the participants.

Understand the context and define objectives

Investigate the industry, operational dependencies and participant roles. Establish what the exercise should explore, what participants should practise and what evidence will help evaluate their work.

Plan the exercise and develop the story

Build a narrative that makes sense for the setting. Connect events, decisions and technical activity so the exercise remains coherent as it develops.

Design and build the range environment

Develop the architecture, networks, services and supporting tools. Address the traffic and custom software needed to make the selected scenario work. Decide which behaviours require technical implementation and which can be represented through exercise material.

Develop technical scenarios and facilitate attacks

Connect attack activity to the story and the systems participants will defend. Facilitate that activity during execution so it serves the agreed exercise objectives.

Guide participants during execution

Help participants follow the developing exercise and understand the information relevant to their roles. Match guidance and challenge to the objectives and participants' experience.

Score, evaluate and support learning

Bring technical activity and participant decisions back to the objectives. Examine what participants demonstrated, where limitations appeared and what deserves further practice or improvement.

Commissioning an exercise

You may know the capability you need to develop without having the specialist capacity to design and build the exercise. ObsidianCorps can help turn that need into objectives, a relevant scenario and a technical environment, with support through execution and evaluation.

Delivering exercises through your own range

You may already have a platform and a delivery team but need expertise for a particular scenario, architecture, network, service, custom tool or exercise role. ObsidianCorps can contribute to those parts of the lifecycle and help connect them to the exercise as a whole.

Our founder reports over six years of cyber range experience, including work with CybExer, CDEX, Range42 and custom ranges. This describes the founder's experience; it does not imply an official partnership or certification with those platforms.

This anonymised example comes from an expert's previous experience. It was not an ObsidianCorps engagement.

The expert contributed story development, architecture, attack facilitation and evaluation to an exercise involving government and energy-sector contexts, including SCADA and operational technology systems. SCADA systems help operators monitor and control industrial processes.

Licences for the original software were unavailable. Custom software was built to reproduce selected functions and logs needed for the exercise. Its scope was the behaviour required for that exercise, rather than a complete replica or a validated digital twin.

The practical lesson is to define what participants need to do and what they need to observe. Which selected functions support the task? Which logs provide useful evidence? Where would a simplification change the meaning of a defensive action?

Those questions help decide where to invest in fidelity when software availability limits the design. They also make the simulation's limitations explicit when interpreting the exercise.

Scenarium guides participants through dynamic tabletop exercises: exercises in which people work through a developing situation and discuss their decisions. It can also operate alongside a cyber range to guide participants throughout an exercise.

In that combined format, the range provides the technical environment where participants work with systems. Scenarium provides participant guidance as the exercise develops. The two roles complement each other.

The informal interview term “tabletop++” describes this idea of taking participant guidance beyond a conventional tabletop and using it alongside technical exercise activity.

Our exercise philosophy values learning over winning. Participants should face enough challenge to reveal limitations and create opportunities to improve, with difficulty matched to the objectives and their maturity.

A team may need help interpreting unfamiliar evidence. Another may be ready to investigate a more complex sequence of events. Difficulty alone does not establish exercise quality, and universal failure is not a useful success criterion.

Practical defensive capability matters alongside learning and decisions. Participants need opportunities to investigate, defend systems and understand the effects of their actions.

Recommended assessment approaches

The following are recommendations to discuss when planning an exercise, not a statement of an established ObsidianCorps assessment standard:

Agree the criteria before execution. Record assistance and environment faults so they are not mistaken for participant performance. A leaderboard can summarise selected activity; the evaluation should explain what that activity demonstrates and what remains to be improved.

Can you help with only one part of the lifecycle?

Yes. Discuss the area where you need expertise, such as story development, range architecture, networking, custom tooling, technical scenarios, attack facilitation, participant guidance or evaluation. That contribution needs to fit the objectives and the work of the wider exercise team.

Can you work with our existing range?

The founder's experience spans several platforms and custom ranges. Share the environment you use and the help you need so we can assess the scope. Experience with a platform does not establish compatibility with every configuration or an official vendor relationship.

Do we need to reproduce our whole production environment?

The required detail depends on the objectives. We recommend identifying the functions, dependencies and observable behaviour participants need, then deciding what to implement, simplify or explain through exercise material. Describe those limits when evaluating results.

Can tabletop participants and technical teams take part in the same exercise?

Yes. A combined exercise can connect discussion and decisions with activity in a technical environment. Scenarium can guide participants through a dynamic tabletop and can also provide guidance alongside a cyber range. The shared scenario and facilitation need to keep the different roles connected.

Can a cyber range exercise support DORA resilience testing?

For applicable financial entities, an appropriately scoped exercise may contribute to a wider resilience-testing programme. DORA's general testing provisions include scenario-based tests; selected entities also face separate advanced TLPT requirements. A cyber range exercise alone does not establish DORA compliance or satisfy TLPT requirements. CSSF guidance on DORA testing.

We recommend agreeing the exercise's purpose and evidence needs with the people responsible for your testing programme before technical design begins.

What determines the scope, timing and cost?

The objectives, participant roles, environment complexity, software availability, custom development and delivery responsibilities all affect the work. Bring any existing range, scenario or schedule constraints to the initial conversation so the required support can be scoped.