Cloud Security Cyber Range: How to Choose

Choosing a cloud security cyber range comes down to how closely it matches the environment and the team you need to prepare. A cyber range is a realistic, multi-stage scenario that a security team works end to end, and for cloud and AI work the question is whether it runs in a live cloud environment or a simulation. Pwned Labs runs its SkyFall cyber ranges in live AWS, Azure and Microsoft 365, and Google Cloud, with scenarios that target AI and LLM workloads, delivered as private exercises where red and blue teams work side by side.

What a cloud security cyber range is

A cyber range is a realistic, multi-stage environment where a security team practices attack and defense end to end, rather than working a single isolated exercise. For cloud, that means a scenario that spans identities, automation, and cloud services the way a real intrusion does, with enough length and branching that a team has to make decisions under pressure. It is broader than a hands-on lab, which teaches one technique or one short chain, and more operational than a course, which explains concepts. The point of a range is to validate capability: can this team recognise, contain, and resolve a cloud incident, or execute a cloud attack chain, when the clock is running. That is why ranges are usually run by teams and measured, not just completed.

Live cloud versus simulated environments

The first and most important choice is whether the range runs in a live cloud environment or a simulation. Cloud attacks and cloud defense both depend on behaviour that is specific to the platform: how identities and roles work, how the metadata service responds, how a managed service logs activity, and what telemetry a defender actually sees. A live cloud range reproduces all of that, so the skills and the detections a team builds transfer directly to production. A simulated or screen-based range can teach a workflow, but it cannot reproduce the real platform, so the gap between the exercise and the job stays wide. Pwned Labs SkyFall ranges run in live AWS, Azure and Microsoft 365, and Google Cloud and Google Workspace, so a team practises against the same cloud it has to defend.

Red team, blue team, or both

Cyber ranges differ in which side they train. Some are built only for defenders, some only for attackers, and the most useful for a mature team let both operate in the same scenario. A purple-team setup, where red executes a multi-stage attack path and blue investigates, contains, and restores under the same conditions, is what surfaces the gaps between how an attack actually unfolds and what the defenders can see. SkyFall ranges are designed for this: red and blue teams operate side by side with role-based access controls inside a private instance, so an organisation can rehearse the full attack and response arc together rather than in separate silos.

Cloud and AI coverage

Coverage is the next axis, because a range only prepares a team for the surface it includes. For a cloud-focused team the range should match the providers in use, whether that is AWS, Azure and Microsoft 365, Google Cloud, or a multi-cloud estate where the risk lives in the trust between accounts. Increasingly the surface also includes AI and LLM workloads, where attacks run through prompt injection, model-connected tooling, and the cloud infrastructure behind an AI application. Pwned Labs covers this spread across its SkyFall and try-out ranges: PromptStorm is an AWS breach that targets AI and LLM workloads, PhantomWave runs in Google Cloud and Google Workspace, StormShadow is a web-to-cloud breach in AWS, and the try-out ranges Mirage, Electra, and ThunderDome cover Azure and Microsoft 365, AWS, and multi-cloud respectively.

Team delivery, private instances, and measurement

A range is only useful to a team if it can be run as a team exercise and the outcome can be measured. Three things matter here. Isolation, so the exercise runs in a private instance dedicated to one team rather than a shared environment. Roles, so attackers and defenders have appropriate access and can work the same scenario at once. And measurement, so the exercise produces more than a feeling that it went well. SkyFall ranges provide private instances, role-based access for red and blue, and scoring, checkpoints, and an after-action review, so a team can track progress during the exercise and debrief concrete outcomes afterward. Custom scenarios built around a specific stack and threat model are available on request, which matters when the goal is to rehearse the organisation’s real environment rather than a generic one.

How a cyber range differs from a lab or a certification

It helps to place a range alongside the other ways a team builds cloud skill. A hands-on lab is a focused exercise that teaches one technique or a short chain, and it is ideal for individual practice and building fundamentals. A certification proves that an individual can execute to a standard. A cyber range is the team-level exercise that sits above both: it validates how a group performs together against a realistic, multi-stage scenario, under time and with a measured outcome. Most organisations use all three, with individuals building skill in labs and certifications, and the team rehearsing and measuring readiness in a range. For the individual routes, see our guides to choosing cloud security training and choosing a cloud security certification.

A realistic cloud range scenario, end to end

What separates a cyber range from a lab is that the scenario runs as a full campaign, and seeing one end to end makes the value concrete. A web-to-cloud range such as StormShadow begins with an exposed application, where the attacking team finds a flaw that lands them a foothold in the cloud account behind it. From there the chain is cloud-native: enumerate the identity the foothold carries, follow exposed artifacts and weak trust boundaries, assume roles that grant more than intended, and climb until the account is under control. A defense-focused range such as PromptStorm runs the same intrusion from the other chair: covert activity shows up as unexplained cost, unexpected log content, and access that no longer matches intended behaviour, and the responding team has to reconstruct the timeline, contain the escalation, hunt the persistence that rides on legitimate automation, and restore services without knocking over production. The most valuable ranges reproduce tradecraft that has been seen in the wild rather than invented scenarios. PromptStorm, for example, was built in collaboration with the threat researchers at Permiso Security and follows attack patterns from their documented research into real cloud and LLM abuse, which is a strong signal to look for when choosing a range. Running the whole arc, rather than a single step, is what builds the judgement a real incident demands.

How to run a cyber range exercise well

A range delivers value in how it is run, not just in the scenario. It helps to start from a clear objective, what capability we are trying to validate, whether that is detection coverage for a specific attack path, the speed of containment, or a red team’s ability to reach an objective. Assign roles before the exercise so attackers and defenders know their remit, and time-box the run so decisions happen under realistic pressure. During the exercise, checkpoints keep a long scenario on track and give natural points to measure progress. The most important part comes afterward: an after-action review that turns what happened into concrete changes, new or tuned detections, updated runbooks, and a short list of gaps to close. SkyFall ranges are built around this loop, with scoring and checkpoints during the run and a structured debrief at the end, and custom scenarios can be built around a team’s own stack so the findings apply directly to production.

Who a cloud cyber range is for

Cyber ranges suit several roles, and knowing which one we are buying for narrows the choice. Red teams and penetration testers use a range to rehearse full cloud attack chains against a realistic target. Blue teams, detection engineers, and incident responders use it to practise investigation, containment, and recovery, and to validate that their detections fire on real tradecraft. Purple-team exercises, where both sides work the same scenario, surface the gaps between how an attack unfolds and what the defenders see. Security leaders use ranges to validate readiness before a real incident and to justify investment with measured outcomes. And teams onboarding into cloud security use them to build shared experience quickly. SkyFall supports the team-based uses directly, while the try-out ranges give individuals a way in.

Practice this at Pwned Labs

Pwned Labs runs its SkyFall cyber ranges as private, measured exercises in live cloud environments, and includes a set of try-out ranges with an annual subscription. The cyber ranges overview covers the full set, and a SkyFall engagement starts with a demo.

• PromptStorm: an AWS breach targeting AI and LLM workloads, where defenders trace initial access, contain escalation, hunt persistence, and restore services. It was built with the threat researchers at Permiso Security, following attack patterns from their documented research into real cloud and LLM abuse.
• PhantomWave: a Google Cloud and Google Workspace scenario that moves from web exploitation to buckets, repositories, internal apps, IAM, and CI/CD.
• StormShadow: a web-to-cloud breach in AWS that chains pivots through exposed artifacts and weak trust boundaries to account takeover.
• Mirage, Electra, and ThunderDome: try-out ranges across Azure and Microsoft 365, AWS, and multi-cloud, included with an annual subscription.
  
  

Frequently asked questions

What is the best cloud security cyber range?

It depends on the environment and the team you need to prepare. For live cloud attack and defense exercises with measured outcomes, including AI and LLM scenarios, the Pwned Labs SkyFall ranges (PromptStorm, PhantomWave, and StormShadow) run in live AWS, Azure, and Google Cloud. Platforms focused on simulated SOC and IT scenarios suit teams whose priority is general incident response rather than live cloud.

What is the difference between a cyber range and a hands-on lab?

A hands-on lab teaches one technique or a short chain and is ideal for individual practice. A cyber range is a longer, multi-stage scenario that a team works end to end, usually with scoring and an after-action review, to validate how the team performs under realistic conditions. Pwned Labs offers both.

Can red and blue teams train in the same cloud cyber range?

Yes. In Pwned Labs SkyFall ranges, red and blue teams operate side by side with role-based access controls inside a private instance, so an organisation can rehearse the full attack and response arc together rather than in separate exercises.

Does a cloud cyber range cover AI and LLM attacks?

Some do. The Pwned Labs PromptStorm range is an AWS breach that targets AI and LLM workloads, where defenders trace the intrusion, contain escalation, and remove covert activity. Coverage of AI workloads is still uncommon across cyber range platforms, so it is worth checking for explicitly.

How are cloud cyber range exercises measured?

Good ranges produce more than a sense that the exercise went well. Pwned Labs SkyFall ranges include scoring, checkpoints, and an after-action review, so a team can track progress during the exercise and debrief concrete gaps and outcomes afterward.

How do we get access to a cloud security cyber range?

Pwned Labs delivers SkyFall ranges as private engagements for a team, arranged through a demo request, and includes the try-out ranges Mirage, Electra, and ThunderDome with an annual subscription.

Is a cloud cyber range only for large enterprises?

No. Pwned Labs delivers SkyFall ranges as private engagements for teams, but annual subscribers can run the try-out ranges Mirage, Electra, and ThunderDome individually or in small teams, so smaller teams and individuals have an entry point without a private engagement.

How often should a team run a cyber range exercise?

Regularly enough that readiness stays current, commonly on a quarterly cadence and after major changes to the environment or team. The value compounds when the after-action findings from each run feed new detections and updated runbooks before the next one.