The Forrester Wave™: Cybersecurity Skills And Training Platforms, Q4 2023

Cybersecurity Skills And Training Platforms Vendor Product Comparisons 2023

Key features and pros and cons of top Cybersecurity Skills And Training Platforms products:

Cyberbit - Leaders

Pros:

Delivers a complete, cross-sector team and talent development solution
Invests significantly in innovation for its platform to anticipate threat trends that require new skills
First to create cyber ranges for cloud environments like Amazon Web Services and Microsoft Azure
Community focus brings teams across industries together for healthy competition via International Cyber League tournaments
Strategic partnerships with industry associations like FS-ISAC
Bridge Program to connect hiring managers with graduates who have verifiable, hands-on cybersecurity experience
Offers highly customized live-fire exercises where managers can observe practitioners in real time
Crisis simulation feeds live-fire exercise details from the SOC to executives for realistic collaboration and decision-making under pressure
Superior reporting and multilevel dashboards with intuitive heatmaps to track and demonstrate skill proficiency across frameworks like MITRE ATT&CK and NIST NICE

Cons:

Platform is costly for smaller enterprises or academic institutions

Hack The Box - Leaders

Pros:

Cybersecurity skills and training platform of and for its community of practitioners
Differentiated vision of creating and connecting cyber-ready humans
Availability of hours of free content from which thousands of its two million community members got their start
Ability for learners to carry over progress and rewards earned in free or individual-use licenses
Skills-based talent search to recruit emerging and experienced talent directly from its community
Gamified content for individuals and teams with a focus on healthy competition and timeliness
Practitioners can create personalized learning paths and earn skill badges or platform's own industry-recognized certifications
Cloud-security-specific labs and training content released on a weekly cadence and mapped to key security roles and frameworks
Straightforward pricing and ease of training path creation

Cons:

Incident response (IR) and crisis management exercises are still maturing
Some modules can be text heavy

Immersive Labs - Leaders

Pros:

Drives cyber resilience and readiness throughout the organization
Platform contributes to overall organizational incident readiness and resilience
Invests a significant portion of its revenue and resources to R&D efforts
Superior roadmap includes additional supply chain and AI security content and exercises, multitenancy capabilities, and live-fire exercises
In partnership with Accenture and endorsed by the White House, launched the Cyber Million initiative to fill one million early-career cybersecurity positions in the next 10 years
Delivers breadth, depth, and realism in its training and exercise content
Engaging, gamified learner experience
Dashboards and framework reporting centered on an overall resilience score
Resilience score and accompanying industry benchmark data can be used as a board-level metric
Brings cross-functional stakeholders together for highly interactive crisis simulations conducted live or asynchronously
Application security offerings and OWASP mapping

Cons:

Some frustration with lack of flexibility in Immersive Labs' licensing model

Cybrary - Contenders

Pros:

Began as free, video-based online cybersecurity training with a mission to make certification training accessible and affordable
Provides a vast catalog of free content for the greater cybersecurity community
Learners and administrators can create custom learning paths and set them as goals with start dates and deadlines
Customers can apply the goals feature to teams or custom groups
Teams can use this to assess skills for internal recruitment, hiring, and promotions
Offers training across six security domains, select content for advanced roles like incident responder, and prep materials for over 40 certifications
Affordability and licensing flexibility

Cons:

Lags in innovation
Just now developing a platform that aligns measurable cybersecurity skills with business outcomes
Hands-on labs launched only in February of this year
Roadmap includes features and capabilities that are already firmly established in other platforms
Currently offers no team training exercises or crisis simulation exercises
Reporting and dashboards focus on basics like course format type and completion
Hands-on content and gamification elements lacking

Infosec Institute - Contenders

Pros:

Acquired by global ed tech Cengage Group in 2022 with more funding and resources to expand
Supports online communities for platform learners and those preparing to take certification exams
Through broader Cengage initiative, launched Ready to Hire for Cybersecurity to bring more and diverse security talent into the pipeline
Hosts an expansive catalog of courses and labs that include vendor, certification, and domain-specific training
One of the first platforms to map learning paths to NIST NICE
Continues to enhance with cross-role skill mapping and mapping labs to MITRE ATT&CK
Curated learning paths and NIST mapping

Cons:

Vision of developing skill-verified talent isn't being backed up with innovation
Innovation is tied to the overall Cengage offering
Roadmap items like team training exercises and digital credentials and badges will only help the vendor reach parity with competitors
Doesn't include true team exercises or breach and crisis simulations
Dashboards and reporting need more work - metrics are basic and reporting data is best viewed in an exported Excel spreadsheet
Lack of insightful analytics and capabilities to increase learner adoption

Pluralsight - Strong Performers

Pros:

Made a smart move in acquiring A Cloud Guru to build out its cloud infrastructure and security content
Supports vision of advancing the world's technology workforce
Holds an annual, general conference to bring leaders and learners together
Content author body of subject matter experts that taps into the broader security community to gauge relevance
Offers a wide range of security training content, including preparation exercises for over 15 cybersecurity certifications as well as application security and GenAI for offensive and defensive security
Administrators can organize content into intuitive channels by role and priority
Uses Skill IQ assessments as measures of initial proficiency and to track skill improvement over time with role mapping to NIST NICE
Dashboards and reporting include platform benchmarks for SkilI IQ assessments
Certification learning paths

Cons:

Innovation beyond A Cloud Guru acquisition is not specific to cybersecurity
Roadmap items are overly focused on the overall training platform
All content is designed and delivered for individual practitioners - teams can go through exercises together but not in a shared environment
Only loose mapping to MITRE ATT&CK
Want more GRC content

RangeForce - Strong Performers

Pros:

Founders saw the value of interactive team training while building the cyber range for NATO's Cooperative Cyber Defense Center of Excellence
Design of training content and facilitated team exercises help organizations get battle ready for current and emerging threats
Employs internal hackathons and an engineering-led Innovation Squad to further develop the platform
Defense Readiness Index (DRI) levels reflect a team's ability to defend against threats
Organizations can set a defense readiness target, build and roll out readiness plans and team exercises, and monitor progress against specific threats
Provides custom post-exercise reports highlighting team technical, process, and collaborative strengths, gaps, and training recommendations
Content maps to the MITRE ATT&CK and D3FEND frameworks as well as NIST NICE
Offers its own skills-focused recruitment and hiring capability
Use the DRI to communicate value to management
Customer focus

Cons:

Timing on roadmap improvements is unclear
Offers a rotating catalog of free training modules, but the platform has not generated, nor has RangeForce supported, a strong practitioner community to date
Accessibility of the platform is still a work in progress
Content lags in freshness

SimSpace - Strong Performers

Pros:

Used by large financial institutions, governments, and critical infrastructure providers for highly realistic simulations of nearly any cyber environment
Often used for exercises designed to measure collaboration between government agencies and private sector enterprises
Extensive partner program that includes deep technology alliances
Comprehensive catalog of security tools for use within the platform allows customers to compare vendors and optimize their security tech stacks
Offers granular training and curriculum management as well as professional services for further customization
Attack simulation exercises leverage bots that act as automated red teams to mimic advanced persistent threat (APT) tactics
Bots also used to generate realistic network traffic and user behavior for added realism during simulations
Team exercises measure a defensive success rate to track detection and response time improvement over time and against peers
Reporting is designed for use with boards, cyber insurance carriers and the self-insurance process

Cons:

Vendor lacks gamification and other elements to drive learner adoption
Planned improvements are unclear
Any semblance of a practitioner community beyond blog posts, webinars, and the occasional comic strip, is missing
Pricing information is missing
Declined to participate in the full Forrester Wave evaluation process

TryHackMe - Contenders

Pros:

Legacy provider of free offensive security training content
Wants to continue its quest to help individuals break into cybersecurity by making upskilling interactive and fun
Has the lowest price point of all evaluated platforms and offers easily transferable licenses
Supports a community of two million users
Administrators can upload their own virtual machines and create custom labs as well as custom learning paths
Can assign training to individuals or teams and send content to external candidates to verify skills during the hiring process
Learner dashboards include skills gap spider charts and offer more valuable insight than those for administrators
Team exercises include capture-the-flag challenges and a competitive hacking game named King of the Hill

Cons:

Innovation stalled after expanding content to defensive security
Platform lags competitors in rolling out now essential upskilling content for cloud security and DevSecOps
Holding off the development of upskilling for generative AI use cases until adoption crosses the chasm
Lacks security technology partnerships that would increase the realism of hands-on individual and team training activities
Administrator dashboards largely focused on basic metrics like usage and completion
Offers loose security framework mapping and no breach and crisis simulation capabilities
Declined to participate in the full Forrester Wave evaluation process

FAQs

Q: Which vendors are Leaders in 2023?

A: Cyberbit, Hack The Box, Immersive Labs

Q: What does "Leader" mean in Forrester Wave terms?

A: Leaders in the Forrester Wave evaluation are vendors that have the strongest current offerings and strategies in the market. They demonstrate superior performance across the evaluation criteria, with particular strength in areas that matter most to customers. Leaders typically show strong vision and execution, invest significantly in innovation, and have proven track records with enterprise customers. In this Cybersecurity Skills and Training Platforms evaluation, Leaders deliver comprehensive solutions that address current and emerging threats with timely, hands-on training content, cover skills beyond SOC operations, and provide valuable, actionable feedback through superior reporting and dashboards.

Q: How do I interpret a Forrester Wave?

A: https://www.forrester.com/policies/forrester-wave-methodology/

Report:

Top Vendor Products for Cybersecurity Skills And Training Platforms in 2023

Cybersecurity Skills And Training Platforms Vendor Product Comparisons 2023

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

FAQs

Q: Which vendors are Leaders in 2023?

Q: What does "Leader" mean in Forrester Wave terms?

Q: How do I interpret a Forrester Wave?

Reference