Engineering cyber ranges and security testbeds: a survey of technologies, use cases, and research trends
TL;DR
The analysis indicates a functional separation in reported deployments, with TBs reported more frequently for experimentation-oriented use cases, whereas CRs are reported more frequently for training, exercises, and education.
Abstract
This survey examines how cyber ranges (CRs) and testbeds (TBs) are implemented in practice by focusing on the technologies used to realise CR/TB use cases and features. Building on a systematic literature review spanning 2020–Aug. 2025, the study includes 199 publications and consolidates extracted application areas, purposes, use cases, infrastructure types, and reported technologies into a structured data repository for analysis. The repository identifies 650 distinct technologies and maps them into a hierarchical structure of 10 technology domains and 81 technology subdomains to support consistent cross-paper comparison despite heterogeneous terminology and architectural representations. The analysis indicates a functional separation in reported deployments, with TBs reported more frequently for experimentation-oriented use cases, whereas CRs are reported more frequently for training, exercises, and education. Across application areas, the data show concentrated profiles and explicit domain/application-area gaps where no technologies are reported for specific combinations, and temporal trends indicate increasing diversification of reported use cases in 2024–2025. Based on these patterns and the discussed challenges of inconsistent terminology and categorization, the paper recommends more systematic reporting of technologies and feature implementations and the use of shared terminology with explicit mappings to reference architectures or taxonomies.