Cybersecurity research testbeds and cyber ranges share many technologies and challenges, but often operate in separate worlds. How can these infrastructures work together to advance both scientific research and practical cybersecurity training?

That question brought members of the SPHERE team together with colleagues from across the international cybersecurity community at Dagstuhl Seminar 26422: Cyber Security Experimentation Beyond Exercises and Cyber Ranges, held October 11–16, 2026, at Schloss Dagstuhl in Wadern, Germany.

Schloss Dagstuhl, the Leibniz Center for Informatics, hosts prestigious, invitation-only seminars that bring together leading researchers from around the world to exchange ideas, explore emerging challenges, and foster collaboration. Unlike traditional conferences, Dagstuhl Seminars emphasize interactive discussions, brainstorming, and the development of new research directions.

Participants brought diverse perspectives on cybersecurity experimentation, research testbeds, cyber ranges, training environments, and exercises. The seminar’s goal was to identify common needs, share approaches, and explore opportunities to develop more interoperable and reusable infrastructures that support rigorous scientific research, testing, training, and exercises.

USC-ISI and SPHERE Contributions

USC-ISI Managing Director Terry Benzel served as one of the seminar’s four organizers, alongside Maria Leitner of the University of Regensburg, Olaf Maennel of the University of Adelaide, and Teodor Sommestad of the Swedish Defence Research Agency.

Terry opened the seminar with a presentation on Testbeds and Their Uses, setting the stage for discussions about the different purposes served by cybersecurity experimentation infrastructures and opportunities for greater interoperability between research testbeds and cyber ranges.

SPHERE Principal Investigator Jelena Mirkovic presented the NSF-funded SPHERE research infrastructure, highlighting its diverse physical and virtual resources for rigorous, reproducible cybersecurity experimentation. She described how SPHERE provides researchers and educators with remote access to specialized resources, including Internet of Things (IoT) devices and industrial control systems (ICS), while supporting the creation, sharing, and reuse of experimental artifacts.

SPHERE Community Outreach Director David Balenson presented Extending Research Infrastructures to Testing, Training, Exercises and CTFs, exploring opportunities for research testbeds and cybersecurity training communities to learn from one another. While research testbeds emphasize controlled, measurable, and reproducible experimentation, training environments and cyber ranges often emphasize realistic scenarios, human participation, and operational assessment.

David’s presentation raised questions about how infrastructures, scenarios, tools, datasets, and evaluation methods could be shared across these communities. It also explored whether cybersecurity exercises and capture-the-flag (CTF) competitions could serve as reusable research benchmarks, and how to address challenges involving portability, reproducibility, security, and privacy.

Exploring Shared Challenges and Opportunities

Throughout the week, participants engaged in presentations, demonstrations, world cafés, and breakout discussions organized around three major themes:

• Scientific rigor: How can cybersecurity experimentation infrastructures better support controlled experiments, meaningful measurements, and reproducible results?
• FAIR principles: How can infrastructures and their associated artifacts become more Findable, Accessible, Interoperable, and Reusable?
• Artificial intelligence: How might AI transform the development, operation, and use of cybersecurity experimentation infrastructures?

The FAIR discussions were particularly relevant to SPHERE’s mission of enabling researchers to build on one another’s work. Participants explored challenges such as discovering suitable experimental resources and artifacts, describing scenarios and configurations, sharing tools and datasets, and making experiments portable across different infrastructures.

A recurring theme was the potential for research and training communities to benefit from one another’s experience, combining scientific rigor and reproducibility with realistic scenarios and human-centered evaluation.

Building Connections Beyond the Meeting Room

 

 

 

 

 

 

 

 

An important part of the Dagstuhl experience is the opportunity for informal interaction. The seminar’s residential setting encouraged conversations beyond the scheduled sessions, allowing participants to exchange perspectives, develop ideas, and establish connections with colleagues from different research communities.

These interactions extended beyond the meeting rooms, including a group hike to nearby castle ruins and Dagstuhl Ghost Hunt. Such activities are part of what makes Dagstuhl Seminars distinctive, providing opportunities to continue scientific discussions and build relationships in a relaxed setting.

SPHERE’s participation reflects its broader commitment to engaging with the cybersecurity research community, understanding emerging needs, and exploring collaborations that expand the impact of shared research infrastructure.

The seminar highlighted promising opportunities to bring research testbeds, cyber ranges, and training environments closer together. Building on these discussions, SPHERE looks forward to working with researchers, educators, and practitioners to identify and develop capabilities that will enable its infrastructure to better support cybersecurity testing, training, exercises, and CTFs, while continuing to advance rigorous, reproducible research.

Learn more about Dagstuhl Seminar 26422.