What Is a Cyber Incident Exercise?
A Cyber Incident Exercise rehearses how your organisation would respond to a cyber incident. Rather than simply reviewing your incident response plan, we bring your team into a boardroom setting and observe how they use the plan, make decisions, communicate, and work together as a scenario develops.
The exercise gives you an opportunity to identify issues in your response, understand how people perform their roles, and see where improvements may be needed.
A current Cyber Incident Response Plan is required for the exercise.
The Exercises We Deliver
Tabletop Exercise (TTX)
A facilitated discussion-based exercise were participants work through a significant cyber incident and respond to a series of escalations. This format is particularly useful for testing decision-making, roles and responsibilities, crisis communications, and governance.
Live Play Exercise
A more practical exercise where participants carry out actions as they would during an incident. This type of exercise can be used when you want to test response in more detail, including how teams communicate, escalate, and carry out responsibilities during an incident.
Exercise Audiences
Board Level
Focuses on leadership decisions, governance, risk, communications, and oversight during an incident.
Managerial Level
Focuses on co-ordination, escalation, decision making, and the management of the response across relevant teams.
Operational Level
Focuses on how the staff responsible for the core response carry out their roles and work together during the response. Focuses on the technical response, triage, eradication, recovery, and escalations.
How It Works
Before the Exercise
We will work with you to understand your organisation, your response plan, and what you want the exercise to test. We’ll agree the exercise format, participants, objectives, and scope before the session takes place.
The Exercise
We facilitate the exercise and introduce the incident scenario and escalations as the incident unfolds. Participants respond using their existing roles, responsibilities, and processes. We observe how the organisation responds and record relevant findings.
Hotwash
At the end of the exercise, we’ll hold a hotwash with the participants. This provides an opportunity to discuss what happened while it’s still fresh, capture observations, and discuss the main lessons identified during the session.
Observation Report
Following the exercise, we’ll provide an Observation Report setting out the key findings and areas for improvement identified during the session. This gives you a clear record of what was discussed, what was observed, who attended, and provides a basis for making changes to your incident response plan.
Book a Cyber Incident Exercise
Tell us about your organisation and we’ll explain how we’d design the scenario.