Welcome to our quarterly platform update! This review covers every optimization the Cyberbit engineering team delivered this quarter, and why each one matters to your team. 

Heading into the end of the year, the teams are wrapping up the post-acquisition upgrades and integrations to focus on what lies ahead in cyber readiness. Look out for major platform enhancements in 2027! 

Here’s what’s new for Q3 2026. 

Out of beta: The RangeMaster Console 

We know that finding the time to exercise is one of the biggest barriers to security teams achieving optimal readiness. We decided it was time to put more control in our customers’ hands by eliminating the scheduling bottlenecks that occur when working with an outside cyber range provider. 
 
Our newly released RangeMaster Console puts everything needed to run a Team Live-Fire Exercise (LFE) in one place, making it even easier for customers to facilitate their own exercises on their own schedules, all without the need to engage a Cyberbit RangeMaster.  

The console is built around four activities to ensure clear value for the team and the people running the exercise: Observe, Track, Guide, and Debrief. 

• Observe: Manager read-only views of participant workstations now include fast switching, so they have the ability to watch without interrupting or asking for screen shares. 

• Track: Live progress tracking and a case summary from TheHive deliver data and metrics such as tactics, techniques, and procedures (TTPs), observables, and proficiency scores, so managers monitor the team throughout the exercise. 

• Guide: If the team is struggling, managers trigger hints from the same interface that they use to initiate the exercise, ensuring a streamlined experience and fewer unnecessary interruptions. 

• Review: Managers can also view historical information about what happened in the exercise. This not only allows them to review the attack flow, observables, and team progress, but it also allows them to look back at any notes and CREW framework soft skill scores they notated during the exercise. An after-action report containing the team’s observed technical skills is also provided. 

Now in beta: Agentic Mode for SOC team exercises 

Anyone in a SOC team already knows the promise and the threat AI agents pose to security. Cyberbit team exercises already challenge participants to defend against AI-based threats; now, teams also exercise with AI agents in the SOC. 

Agentic Mode, new in the Cyberbit Team Readiness Platform, enables a SOC team to investigate an indicator of compromise (IoC) within a team exercise by directing an AI agent instead of driving each integrated SOC tool by hand. In the platform, these appear as Agentic Team Exercises. 

Since this mode is currently in beta, it is only available on select exercises. Customers that would like to join our design partnership program should reach out to their Customer Success Manager. 

Agentic Mode FAQ 

How does Agentic Mode work? 

Each analyst workstation runs the Codex command-line interface (CLI) agent, connected over Model Context Protocol (MCP) to four SOC tools already on the range. Each analyst gets their own agent. The attack, objectives, and scoring are unchanged. “Mode” qualifies an existing scenario, for example, “Exercise X in Agentic Mode.” 

What tools are currently available for use with Agentic Mode?  

• Splunk: investigate in plain English while the agent writes and runs the Search Processing Language (SPL) queries 

• MISP: threat-intel correlation 

• Velociraptor: endpoint forensics 

• TheHive: the agent writes up IoCs and TTPs under the analyst’s direction 

What does the new mode assess?  

Agentic Mode focuses on the team’s supervision of the agent, not the agent’s output. Analysts direct the agent throughout the exercise. 

Why is Agentic Mode important?  

Our customers are asking for more AI content and, as AI adoption in the SOC grows, both the 2025 ISC2 Cybersecurity Workforce Study and the SANS 2025 SOC Survey point to the analyst role shifting from responder to supervisor.  

Unified reporting view 

Admins now get a single Reports view that replaces several separate pages, giving managers visibility into where participants stand without asking the Cyberbit customer success team to extract the data. This self-service reporting model better connects the admin to the data they want to build the reports they need.  

Key capabilities include: 

• A button group switches between Skills Gap Plans (the default), Training Plans, and Module Attempts. 

• The Training Plans tab shows each user’s plan with team, content, learning status (Not started, In progress, Overdue, Completed), progress, due date, and time spent versus expected duration. 

• The Module Attempts tab provides session-level detail per user, including scores, time spent, and hint and solution use.  

• Each tab features customizable columns, sorting and filtering across all results, and CSV or JSON exports that match the applied filters.  

That’s all for now! Come back next quarter for yet another packed Cyberbit Readiness platform update.