A framework for cybersecurity evaluation includes a sandboxed target, varied inputs affecting task difficulty, available tools, and a grader to assess outcomes.