The strangest thing about a serious cybersecurity drill is how quickly the expensive software stops being the main character. An alert fires. Someone assumes someone else owns it. A rule that worked in the demo meets the actual configuration. The incident-response plan, pristine in its PDF, discovers time. SimSpace exists to stage that awkward scene somewhere harmless. Its product is a cyber range - a working, instrumented facsimile of a customer's network where defenders can chase realistic intruders without taking payroll, power plants or patient records along for the ride.
That makes SimSpace easier to understand as a flight simulator than as an online course. A customer can model cloud systems, office networks and operational technology; connect the security tools its team already uses; generate normal user behavior and network noise; then release an emulated adversary into the copy. Red teams attack. Blue teams defend. Purple teams stop arguing about colors long enough to compare notes. The range records what happened, so a debrief can become a benchmark instead of an exchange of confident memories.
The military idea hiding in enterprise software
SimSpace was founded in 2015 by William “Hutch” Hutchison and Lee Rossey. Hutchison had been an F-15 pilot and a senior leader at U.S. Cyber Command. Rossey had led cyber systems assessment work at MIT Lincoln Laboratory. Their founding conviction was simple and unfashionable: cyber readiness should be rehearsed continuously, under realistic conditions, the way high-consequence missions are rehearsed elsewhere.
The original work served elite military and intelligence units. The commercial move was to package that practice for other organizations whose bad days are similarly expensive - government agencies, banks, retailers, universities and operators of energy, transport and industrial systems. SimSpace has named the Department of Defense's Persistent Cyber Training Environment and the Department of Homeland Security among its users, and says five of North America's 15 largest financial institutions have used the platform. Public case studies also identify Cyber Florida and the Naval Postgraduate School.
The Naval Postgraduate School example shows the point. Its exercise environment represented a power plant, down to programmable logic controllers, human-machine interfaces, workstations and networking elements. Allied teams could practice red, blue and purple operations against critical infrastructure that behaved enough like the real thing to produce useful mistakes. Nobody had to volunteer an actual turbine.
A tabletop asks what people would do. A range makes them do it - and keeps the receipts.
What breaks first
The most valuable failure is rarely cinematic. It is often a configuration, a patch, a detection rule, a handoff or a playbook step. SimSpace's platform is designed to test the whole system around the security product: background traffic, user behavior, analyst judgment and escalation. That matters because a pristine vendor lab strips away precisely the mess that causes enterprise defenses to wobble.
The product menu follows that logic. Teams use the same underlying range for live-fire training, individual skill development, detection engineering, incident-response rehearsal, malware analysis, threat research, compliance evidence and pre-purchase product evaluation. For operational technology, SimSpace and specialist partner Fortiphyd Logic developed scenarios for industrial control and SCADA environments. More recently, the company has recast the range as an “AI Proving Grounds,” where automated security agents can be attacked, manipulated and measured alongside humans before they are trusted in production.
How rehearsal changes the purchase
A normal cybersecurity sale begins with a polished demonstration and ends with a forecast: this tool should catch that attack. SimSpace changes the verb. A range can connect the proposed product to the buyer's modeled environment, run representative attacks and let the team see whether alerts arrive with the right context. That makes the range part classroom, part test bench and part unusually hostile procurement committee.
The shift matters because companies already own crowded security stacks. Another dashboard may create more duplicated engineering and more places for a configuration to drift. SimSpace's pitch is that a customer can tune what it owns, compare a candidate tool before purchase and then use the same environment to teach analysts how the chosen system behaves. The economic promise is not only “stop a breach.” It is also “buy fewer mistakes.”
This is where partners become useful rather than decorative. Technology vendors such as Cymulate and CyCognito can demonstrate or integrate their products without touching a customer's production network. Service providers and distributors can run exercises for clients. EY and the Cybersecurity Foundation used SimSpace technology in Poland's Cyber-EXE event, where financial institutions rehearsed incident response and reporting connected to Europe's DORA rules. Cyber Florida uses the platform for a statewide public-sector range. The product becomes infrastructure on which other organizations can sell training, testing or readiness programs.
It is also what changed the commercial scope of the company. The founding problem was elite team rehearsal. The platform now reaches backward into tool selection and forward into compliance evidence, stack optimization and AI governance. SimSpace did not have to abandon training to enter those budgets. It made the rehearsal more representative, measured more of what happened inside it and invited more stakeholders to use the result.
Those percentages are SimSpace's reported outcomes, not universal promises. The more grounded economic picture comes from a commissioned Forrester study based on customer interviews and a composite organization. It modeled 60 concurrent users, 300 virtual machines, two professionally assisted eight-hour events, a training and attack library, support and introductory training. The risk-adjusted subscription line came to $525,000 annually.
Across three years, the study modeled $3.9 million in benefits against $1.7 million in present-value costs - a $2.2 million net present value and 127 percent return. The caveat belongs in the same sentence as the number: this was a vendor-commissioned model, and actual fees vary by use case, concurrent users, virtual machines, deployment and services. This is enterprise infrastructure, not a $19 browser lab.
Where SimSpace fits - and where it does not
SimSpace sits between cyber training, breach-and-attack simulation and security validation. Cyberbit, RangeForce, Immersive Labs, Hack The Box and Circadence compete for readiness and skills budgets. AttackIQ, Cymulate, Picus and Pentera compete for validation budgets. SimSpace's bet is that a buyer will prefer one high-fidelity environment where people, processes, technologies and now AI agents can be tested together.
Teach and assess individuals or teams, often through labs and content libraries.
Continuously checks whether controls detect known techniques and exposures.
Tests decisions and communications through discussion, with little live infrastructure.
Recreates the environment so the team, stack, workflow and adversary can interact.
That integrated approach is also the condition for success. A customer needs a meaningful environment to model, people who will run recurring exercises and leaders willing to change configurations or procedures after the debrief. Without those, fidelity becomes expensive scenery. A small security team seeking basic awareness training, a single certification lab or cheap individual practice probably does not need a digital twin of the enterprise. Nor will a range help if the organization treats the exercise as an annual theater production and files the after-action report untouched.
The playbook worth stealing
There is a broader product lesson here, particularly for founders selling into cautious industries. SimSpace did not begin by promising to prevent every bad outcome. It sold a safe place to produce the bad outcome early, watch it carefully and improve before it counted. That turns fear into a repeatable workflow and turns an abstract claim - “we are ready” - into observable evidence.
- Model the customer's scary reality. Preserve the messy interactions, not just the feature being sold.
- Make failure safe and repeatable. The second run is where a demo becomes an operating system for improvement.
- Instrument the rehearsal. Sell the evidence, comparison and after-action decision - not merely the simulation.
- Expand from people to systems. One environment can support training, procurement, compliance and validation when the underlying model is credible.
The company's own evolution follows that pattern. It moved from specialized military exercises to a commercial Cyber Force platform, expanded through partners, added sector-specific OT content, raised $45 million from L2 Point Management in 2023 and another $39 million in combined debt and equity in 2025. In early 2026, it introduced ARIA for more automated, self-service range design and moved its global headquarters from the Boston area to Orlando, close to a deep simulation-and-training industry cluster.
The AI turn is less a pivot than a new test subject. Security agents can hallucinate, over-automate, miss context or buckle under manipulated inputs. A polished demo cannot show how an agent behaves amid millions of alerts, odd enterprise dependencies and a human analyst trying to override it. SimSpace wants the answer to emerge in rehearsal. That is the company's enduring proposition, stripped of military language and AI fashion: confidence is cheap; evidence requires somewhere safe to fail.