Strategic cybersecurity exercises build on the “not if, but when” principle: sooner or later, cyber incidents hit every organisation, sector or country. An exercise simulates a crisis with its consequences, with unexpected turns, trade-offs and disagreements. The value lies in what the decisions reveal: what each choice costs, what it rules out, and how differently people decide.
A realistic threat scenario runs through decision-points, each of which has its own considerations and consequences.
Incomplete information, scenario twists and legitimate disagreements showcase the inherent uncertainty in cyber crises.
Strategic cyber readiness is achieved through understanding of mutual expectations, procedures and risk thresholds.
Leaders must recognise their responsibility and liability for cybersecurity decision-making, and not delegate it down the chain.
Executives require an executive approach and questions relevant to them: policies, procedures, risks, communication strategies and decision-making implications of responding to cyber incidents and crises.
PowerPoint still rules the boardroom: a few voices dominate, outliers go unheard and a massive amount of information is lost.
Collecting the inputs and decisions of all participants allows outliers and out-of-the-box solutions to be identified through a rich and diverse dataset.
Exercises have become repetitive and mundane, delivered in the same format and always from point zero, with little flexibility in layout and setup.
Executives are already under plenty of stress. Exercises should be enjoyable and engaging as artificially increasing stress levels does not yield optimal results.
Digesting complex technical concepts at the executive level means solving the “interface problem” that often exists between technical specialists and executives.
The cornerstone of the exercise is key analytical questions about decision-making processes, addressed from the perspective of a strategic decision-maker.
Cyber crises are inherently uncertain and can create the illusion of being in control, with scenario twists around the corner.
The proprietary methodology, using decision-making dilemmas, ensures the smooth flow of the exercise. Disagreements are allowed.
In complex situations there is not necessarily a single right answer. Participants should understand the effect of their decisions when choosing between options.
Unlike fire-drill-style exercises, modelling hypothetical situations allows participants to choose between different scenario options with cascading outcomes.
Exercises are planned through a three-step process and designed with a proprietary framework of six core components.
The foundation of a successful exercise.
Live conduct of the exercise, on-site, online or hybrid.
Results are measured, benchmarked and reported.
Purpose of the exercise broken down into specific objectives.
Boundaries, lifecycle, jurisdiction and constraints.
Entities and individuals taking part in the exercise.
Assets, scenario structure and threat modelling.
Interpretation of results in the context of the exercise.
Timing, venue, format and logistics.
Discover how RiskSight’s cyber resilience trainings increase user cyber awareness and executive cyber preparedness.
