CYBER EXERCISES / CHOOSING THE TEST
Test a question.
Then improve the answer.
Different exercises produce different evidence. Choose the one that fits the decision.
An exercise is useful when it answers a consequential question before an incident does. Can a team authorise a shutdown, verify a recovery, or contact a supplier when its usual systems are unavailable?
Several forms of testing are often grouped under breach and attack simulation. Distinguishing them makes it easier to buy the right exercise and judge what its results actually prove.
THE EXECUTIVE BRIEF
The decisions that matter.
- Match the exercise method to the question you need answered.
- Agree authority, safety limits, and evidence before testing starts.
- Budget for the improvements and retest, as well as the exercise itself.
CHOOSE THE METHOD
These activities answer different questions.
AN EXERCISE BUYER’S DESK
Start with the evidence you want.
DISCUSSION
Tabletop exercise
Explore decisions, responsibilities, information gaps, and coordination through a facilitated scenario.
OPERATIONAL REHEARSAL
Functional cyber exercise
Have teams carry out their response roles during a simulated cyber incident, testing coordination, communications, escalation, and decision-making without a full live deployment.
CONTROLLED TEST
Technical simulation
Evaluate defined defensive behaviour in an authorised environment with explicit safety limits.
ADVERSARY VIEW
Red team
Assess agreed objectives through a scoped adversarial engagement; establish rules, escalation, and stop conditions.
CyberSolace comparison. These are distinct methods, not a maturity ladder or interchangeable product labels.
A tabletop can expose confusion about who approves an exceptional payment or communicates with customers. It cannot prove that backups restore within a time limit. A successful technical test can demonstrate a control without showing that senior decision-makers can manage an extended interruption.
A functional exercise goes beyond discussing what the team would do: participants perform their assigned response roles as the scenario unfolds. Facilitators introduce events and requests that prompt decisions, handovers, communications, and escalation. Technical effects and outside organisations can be simulated. It tests how the response operates; actual system recovery still needs separate evidence unless it is performed within the agreed exercise scope.
The term breach and attack simulation is also used for automated technical validation. Ask a supplier precisely what will run, where it will run, what success means, and what is excluded. Do not assume a familiar label describes the same service.
DESIGN THE ENGAGEMENT
Define a useful boundary before adding realism.
Choose a service and a plausible consequence. Agree the questions, participants, starting assumptions, and evidence to record. Include the business owner and functions needed for the decision, such as operations, finance, communications, legal, or HR.
For live technical work, obtain the necessary permissions and coordinate with relevant providers. Set permitted techniques, environments, access, testing windows, data handling, emergency contacts, and a route to stop the exercise. “Benign” intent is not a substitute for a safe operating arrangement.
The NCSC’s exercise-creation guidance supports a structured approach. Its Exercise in a Box provides free scenarios and materials for organisations starting with a facilitated rehearsal. A generic pack can be useful without pretending to validate a particular production architecture.
MAKE THE RESULT USEFUL
Record what happened and what remains assumed.
Give the observer a simple evidence record: the decision requested, information available, responsible role, action taken, and unresolved uncertainty. Capture a reason for each important delay rather than turning the exercise into a speed contest.
- A gap identified: the team cannot reach the provider without the unavailable email account.
- An action agreed: establish and verify an alternative contact route with a named owner.
- Evidence of improvement: a later exercise demonstrates contact and the required authority without that account.
This connection between finding and recheck is more valuable than an impressive scenario title. Keep the report clear about whether a capability was discussed, simulated, or actually demonstrated.
CONTINUE THE PROGRAMME
Use rehearsal to improve capability without manufacturing assurance.
Exercises can build familiarity, surface dependencies, and improve coordination. They do not guarantee that every future incident will be controlled, nor does attendance alone establish regulatory compliance.
Prioritise the improvements that affect important services. Link them to budgets and decision-makers, and repeat the relevant part of the exercise when something changes. Test an updated contact route or restoration step instead of rerunning the entire scenario automatically.
Keep difficulty proportionate to the team and purpose. Too little challenge hides uncertainty; excessive complexity can consume the session without producing a decision anyone can act on.
A PRACTICAL NEXT STEP
Scope the question before commissioning the exercise.
CyberSolace offers an initial scoping conversation to identify useful objectives, participants, and the appropriate form of cyber-incident exercise.
SOURCES & EDITORIAL REVIEW
Historical findings and incident accounts are dated in the text. Illustrative review prompts are CyberSolace commentary. Editorial review: 20 October 2026.