Compare
How Cyber Ambush compares
Here is where each option is strong, where it is thin, and what it usually costs. We do not name commercial vendors, and every figure below is a range, not a quote.
| Compared on | Cyber AmbushLive, cloud-based tabletop exercises your own staff run on a clock. | Consultant-run tabletopA firm facilitates a session on site or over a call, usually once a year. | Enterprise readiness suiteCrisis simulation bundled inside a large training platform. | CISA Tabletop Exercise PackagesFree situation manuals you facilitate yourself from documents. |
|---|---|---|---|---|
| Cost | $1,500 for a single exercise; $4,900–$12,000 per year for a plan | $5,000 to $50,000 per exercise | Contract values commonly $30,000 to $80,000+ per year | Free |
| Who runs it | Your Operator runs it; the platform keeps the clock and the record | An outside facilitator, in the loop for every session | Your team, inside the vendor's platform | Your team, manually, from a document |
| Live shared clock and timed injects | Shared clock, injects released manually or automatically | Facilitator-paced, no shared clock for Participants | Varies by product; often module-paced, not exercise-paced | No built-in shared clock for Participants |
| AI kept away from Participants | AI helps planners and evaluators only; Participants never see it | No AI in the room | Depends on the product; often surfaced to learners | No AI |
| NIST CSF 2.0 / SP 800-61r3 / SP 800-84 / SP 800-53 mapping | Objectives, injects and findings are mapped | Varies by firm and statement of work | Often mapped to the vendor's own competency model | Aligned to CISA guidance; you do the control mapping |
| Instant after-action review and evidence pack | AAR and evidence pack ready at ENDEX (end of exercise) | A written report, typically two to four weeks later | Completion reporting, rarely audit-ready evidence | You write the report yourself |
| Improvement-plan re-testing | Open items carry forward into the next exercise as injects | No re-test of prior findings unless you buy another engagement | Tracked as training records, not re-tested in scenario | Not tracked |
| Evaluator role | Read-only evaluator seats with an HSEEP-style evaluation guide | The facilitator evaluates; independent seats cost extra | Admin or observer views, not exercise evaluation | Evaluation is manual, using the supplied templates |
| Transparent pricing | Published on our pricing page | Quoted per engagement | Pricing not public | Free and public |
Typical market ranges, September 2026. Cost ranges for the other options are Cyber Ambush's own estimates, drawn from public price lists and from what buyers tell us they have paid. They are not sourced to a published study and are not a quote from any provider.
CISA does not endorse or sponsor Cyber Ambush.
Custom options for the best fit
If you have never exercised before and want an experienced facilitator in the room, we can coach your executives through their first session. You can start with a free CISA Tabletop Exercise Package and adapt its scenario into a Cyber Ambush exercise.
Where we are stronger
Repeat exercising, evidence, and follow-through. The exercise record is captured as it happens, the after-action review is ready at ENDEX, and open items from the last exercise come back as injects in the next one.
Where we are thinner
We are not a full-service consultancy or an enterprise suite. Honest limits:
- No SOC 2 or ISO/IEC 27001 certification today — our control mappings are a self-assessment.
- No multi-factor authentication or single sign-on yet.
- A smaller scenario library than a full consultancy engagement.
- No operations-based or full-scale exercise capability: this is a discussion-based tabletop platform.