Modern testbeds for the experimental analysis of critical infrastructures either totally ignore the human factor or incorporate real human-machine interfaces (HMIs) and software that require the presence of human operators during an experiment. Although experimentation with humans in the loop can provide invaluable experimental data about human decision making and reactions, it is infeasible to conduct a systematic exploration of the vast parameter space of possible human operator decisions, reasoning and actions. This paper argues that testbeds should incorporate simulated human decision making capabilities in order to engage humans in the loop, especially because humans play crucial roles in cyber security experiments involving critical infrastructures. An extension of a previously developed experimentation framework is also described; the extension provides generic “human decision” units that enable the integration of human operator and HMI models. The utility of the approach is demonstrated by assessing the impact of human operator reactions during an attack on a cyber-physical infrastructure incorporating the IEEE 30-bus power grid model.