How to run a cyber attack crisis exercise your board will learn from

Most organisations now accept that a serious cyber incident is a question of when rather than if. Far fewer have tested how their leadership team would actually respond. A well designed cyber attack crisis exercise closes that gap, but only if it is built to test decisions rather than technical recovery alone.

Start with the decisions, not the malware

The technical team will rehearse containment and restoration elsewhere. A crisis exercise for senior leaders should focus on the decisions only they can make. Whether to take systems offline and accept the disruption. What to tell customers, staff and regulators, and when. How to respond to a ransom demand. Who speaks for the organisation. Scoping the exercise around these decisions keeps it relevant to the people in the room.

Make the scenario plausible for your organisation

Generic scenarios produce generic learning. The scenario should reflect your systems, your suppliers and the services your customers depend on most. Research at the start of the design process, including conversations with IT, legal, communications and operations leads, is what turns a stock ransomware story into a realistic test of your own weak points.

Build pressure from more than one direction

Real cyber crises arrive through several channels at once. Media enquiries, social media speculation, worried staff, regulators asking questions and an attacker pressing for payment. An exercise that only presents information on slides misses this. Our Crisis Room exercise environment lets teams receive news, social posts, emails and messages from the threat actor as events unfold, so the pressure feels closer to the real thing.

Allow time to prepare it properly

A meaningful exercise usually takes between four and eight weeks to prepare. That covers scoping, research, writing the scenario, and a review and rehearsal before the day itself. Rushing this stage is the most common reason exercises feel artificial. You can see each stage in our guide to crisis management exercising.

Capture what happened, then act on it

The value of an exercise lies in what changes afterwards. A short hot debrief on the day captures first impressions while they are fresh. A written report, which we provide within ten working days, should record the decisions taken, the gaps found and clear recommendations with owners. Without that, the same weaknesses resurface at the next exercise or, worse, in a real incident.

Common mistakes to avoid

Inviting too many observers who change how people behave. Letting the technical team dominate a leadership exercise. Choosing a scenario so extreme that participants disengage. Treating the exercise as a pass or fail test rather than a safe place to learn. Each of these reduces the honesty of the discussion, which is what makes an exercise worth running.

Building the capability

For leaders who want to develop their own crisis skills, the Certified Crisis Management Professional (CCMP®) is endorsed at QLS Level 5 and studied by distance learning. If you would like an exercise written around your organisation, our team designs and facilitates crisis management exercises for boards and executive teams across the UK.