<p>Experience is the best teacher, but in cybersecurity, it often comes at a cost. Just ask anyone — from a CISO to a Tier 1 analyst — who has lived through a major breach.</p>
<p>In Florida, however, thousands of public-sector employees can get realistic, hands-on <a href=”https://www.techtarget.com/searchsecurity/definition/incident-response”>incident response</a> experience for free through a state-funded cyber range. Cyber ranges mirror users’ IT environments and deliver dynamic threat simulations that replicate the pressure, chaos and variability of real-life incidents in a safe and controlled setting.</p>
<p>”The best way to prepare is to practice, much like pilots,” said Bruce Caulkins, director of cyber solutions and technology at Cyber Florida, the state cybersecurity center that runs the range. “They spend hours in the flight simulator going through all the things that can go wrong and practicing what they would do before they actually fly the plane.”</p>
<section class=”section main-article-chapter” data-menu-title=”The challenge: Provide realistic incident response training for the public sector”>
<h2 class=”section-title”><i class=”icon” data-icon=”1″></i>The challenge: Provide realistic incident response training for the public sector</h2>
<blockquote class=”main-article-pullquote”>
<div class=”main-article-pullquote-inner”>
<figure>
[Pilots] spend hours in the flight simulator going through all the things that can go wrong and practicing what they would do before they actually fly the plane.
</figure>
<figcaption>
<strong>Bruce Caulkins, Director of cyber solutions and technology, Cyber Florida</strong>
</figcaption>
<i class=”icon” data-icon=”z”></i>
</div>
</blockquote>
<p>In 2021, Cyber Florida sought ways to nudge the state’s public-sector organizations from compliance-driven cybersecurity toward proactive <a href=”https://www.techtarget.com/searchsecurity/tip/CISOs-guide-to-demonstrating-cyber-resilience”>cyber-resilience</a> and cyber-readiness.</p>
<p>”Resilience means being able to do the tasks and functions that you need to do in a cyber environment that might be degraded, disrupted, you name it,” Caulkins said.</p>
<p>Unimpressed with basic sandbox options, Cyber Florida began entertaining the possibility of a cyber range — traditionally within the purview of national defense agencies — for state, county and municipal use. While a sandboxed environment typically offers a confined, relatively simple training ground, a cyber range aims to mirror an organization’s actual network to better simulate complex, real-world conditions.</p>
<p>Cyber Florida enlisted Caulkins — a retired U.S. Army colonel and expert in cybersecurity modeling and simulations — to conduct a feasibility study and, ultimately, to serve as the organization’s cyber range director.</p>
</section>
<section class=”section main-article-chapter” data-menu-title=”The decision: Buy or build”>
<h2 class=”section-title”><i class=”icon” data-icon=”1″></i>The decision: Buy or build</h2>
<p>Based on the feasibility study, Cyber Florida ruled out DIY and on-premises options, citing upfront hardware and software costs and ongoing operational and maintenance burdens. A third-party, cloud-based offering would let the organization play to its strengths.</p>
<p>”We looked at the things that we’re good at and the things that other people would be good at,” said Ernie Ferraresso, senior director at Cyber Florida. “We are good at knowing which organizations should be on the range and what types of scenarios and challenges they need. What we don’t have expertise in is running data centers.”</p>
<p>They vetted around a dozen cyber range vendors and eventually partnered with Boston-based <a target=”_blank” href=”https://simspace.com/wp-content/uploads/2025/11/OnePager-Overview.pdf” rel=”noopener”>SimSpace</a>. Ferraresso and Caulkins worried that Cyber Florida might get lost in the shuffle at a larger provider, and they were impressed by SimSpace’s responsiveness, flexibility and grasp of the public-sector mission.</p>
</section>
<section class=”section main-article-chapter” data-menu-title=”The results: Live-fire exercises and adapting to emerging threats”>
<h2 class=”section-title”><i class=”icon” data-icon=”1″></i>The results: Live-fire exercises and adapting to emerging threats</h2>
<p>Florida’s state cyber range went live in early 2023, with both on-demand modules for individual users and scheduled, live-fire team training events that present small groups of tech practitioners with realistic incident response and <a href=”https://www.techtarg
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
Read the original article: