R01 — Range Foundations

A cyber range is attack infrastructure. It contains software with known, unpatched, pre-authentication remote code execution, and every architectural decision in this volume is downstream of keeping that contained.

Decide what you are building first. "A cyber range" is four different machines depending on what you want out of it — exploit reproduction, attack path practice, detection validation, exercise delivery — and they size very differently. The purpose weighting worksheet derives your substrate bias and the reset tier you will actually live in. If reproduction dominates, this volume tells you honestly that you may not need a range yet.

Hardware, in capability thresholds rather than part numbers. RAM stops you first; disk IOPS is what quietly kills the reset loop; cores are rarely the binding constraint. Entry, Working and Facility tiers, with the three-year cost model that includes the line everyone omits — your own maintenance hours at your billing rate. On-prem versus cloud is settled with the actual reasoning: a range runs continuously, mostly idle, with large disk images, which is the worst possible cloud billing profile, and an always-on host full of exploitable services is a conversation you do not want with an abuse desk.

The three-zone isolation model — Management, Range, Observation — with deny-by-default egress, no inbound ports, and the rule that matters: the Range zone must not reach the Management zone. That is the failure people actually experience, when a popped target reaches the hypervisor API and the containment story is over. Includes the build-time egress exception handled as a time-boxed window with a documented closure step.

The reset architecture, which is where the value of a range actually lives. Not what it contains — the cost per reset. Four tiers from container teardown in seconds to template rebuild in hours, with the traps stated: snapshot with or without RAM, time skew after a long gap, snapshot drift, and the domain-revert trap that costs everyone an evening (revert a domain controller without its members and the secure channel breaks, and it looks exactly like a real finding). Plus the rule about untrusted code: if you ran a proof-of-concept you did not write and did not read, a snapshot revert is not sufficient.

Range as code — what belongs in version control and what must never be, the quarterly reproducibility test that tells you whether your repository is code or merely documentation, and the rebuild runbook nobody has ever successfully written from memory six months later.

Closes with a day-one build order that produces a working range the same day, five fill-in worksheets, and a pre-flight checklist.

Includes the Range Build Planner (XLSX, 7 tabs, 86 live formulas) — the companion calculator that catches the wrong hardware call before you buy it.