CRISIS TERMS
Crisis simulation and tabletop exercise glossary
36 TERMS
THE SHORT ANSWER
Thirty-six terms that come up when planning, buying and running cyber crisis exercises, each defined in one to three sentences. Where a term comes from a standard or regulator, the source is linked.
By The Exercise Desk · Crisis Simulation Ranked · Published 2026-10-11
A
Adaptive scenario
A scenario that changes in response to the decisions players make, so different choices lead to different consequences. The opposite of a scripted scenario.
After-action report
The written record of an exercise or incident: objectives, timeline, decisions, strengths, findings and actions with owners. CISA's Tabletop Exercise Packages include a template.
Source: CISA Tabletop Exercise Packages · Read 27 Sep 2026
Alignment
In exercise measurement, the extent to which different roles would choose the same option for the same decision. iluminr lists it among its behavioural evidence measures.
Source: iluminr blog: continuous capability intelligence (18 August 2026) · Read 27 Sep 2026
See also: Measuring Decisions Under Pressure: Speed, Confidence and Alignment
Asynchronous play
An exercise format in which participants work through stages at different times rather than all at once, useful for distributed teams.
Source: Reflex Security blog: Reflex Security vs Immersive Labs · Read 27 Sep 2026
See also: Running a Crisis Exercise When Key People Cannot Attend
B
Benchmarking
Comparing exercise results across teams, departments, regions or time. Comparing a team with itself over time is usually the most reliable form.
See also: Measuring Decisions Under Pressure: Speed, Confidence and Alignment
Business continuity
The capability to keep delivering critical services during and after a disruption. ISO 22301 is the international standard for business continuity management systems.
C
Crisis management team
The group of senior people who take the strategic decisions in a major incident: typically executives, legal, communications, operations and the technical lead.
Crisis simulation
An exercise in which participants act on a simulated incident as it unfolds, under time pressure and with changing information, rather than only discussing it.
See also: Discussion, Simulation and Live Exercises: The Three Formats
Cyber range
A controlled environment, real or replica, in which technical teams practise detecting and responding to attacks with real tools. It trains hands-on skills rather than executive decisions.
Source: Cyberbit homepage · Read 27 Sep 2026
D
Decision velocity
The time a person or team takes to reach a decision once one is needed. iluminr lists it as one of its behavioural evidence measures.
Source: iluminr blog: continuous capability intelligence (18 August 2026) · Read 27 Sep 2026
See also: Measuring Decisions Under Pressure: Speed, Confidence and Alignment
Discussion-based exercise
An exercise in which participants talk through how they would respond to a scenario without carrying out the actions. The classic tabletop is discussion-based.
Source: NIST SP 800-84: Guide to Test, Training, and Exercise Programs · Read 27 Sep 2026
See also: Discussion, Simulation and Live Exercises: The Three Formats
DORA
The EU Digital Operational Resilience Act, Regulation (EU) 2022/2554, which sets ICT risk and resilience requirements for financial entities. Its text says they shall review the risk scenarios affecting them regularly and at least yearly, and requires advanced threat-led penetration testing at least every three years for entities identified by competent authorities.
Source: Regulation (EU) 2022/2554 (DORA), EUR-Lex · Read 11 Oct 2026
See also: Board members in the exercise
E
Escalation matrix
A table in an incident response plan that says who must be told, and who decides, at each level of severity.
See also: How to Write Exercise Objectives That Can Be Scored
Exercise cycle
This site's six-stage view of an exercise: build, adapt, seats, run, report and map. Each platform profile shows which stages the vendor's own pages document.
See also: The exercise cycle
F
Facilitator
The person, or software, that runs an exercise: releasing injects, pacing the session and pressing participants for decisions.
Form 8-K Item 1.05
The SEC filing item for material cybersecurity incidents, generally due four business days after a public company determines that an incident is material.
Source: SEC press release 2023-139: cybersecurity disclosure rules · Read 27 Sep 2026
Functional exercise
An exercise in which participants perform their actual roles and functions in a simulated operational environment, as distinct from a discussion.
Source: NIST SP 800-84: Guide to Test, Training, and Exercise Programs · Read 27 Sep 2026
H
Hotwash
An informal debrief held immediately after an exercise ends, capturing first impressions before the formal after-action report.
I
Information environment
The simulated news, social media, email and messaging that surround players in an exercise. Conducttr and Hack The Box both simulate it.
Source: Conducttr homepage · Read 27 Sep 2026
See also: Simulating the information environment
Inject
A piece of new information released into an exercise, such as an alert, an email, a call from a journalist or a regulator's question, to move the scenario on or force a decision.
L
Live-fire exercise
A technical exercise in which real attack techniques are run against real or replica systems while defenders respond.
Source: Immersive Labs: cybersecurity technical exercises · Read 27 Sep 2026
See also: Discussion, Simulation and Live Exercises: The Three Formats
M
Master scenario events list (MSEL)
The timed list of every inject in an exercise, with who receives it and the expected response. Conducttr's LISA assistant is described as a text-to-MEL chatbot.
Source: Conducttr homepage · Read 27 Sep 2026
Materiality determination
A public company's decision on whether a cybersecurity incident is material, which starts the four-business-day clock for SEC Form 8-K Item 1.05.
Source: SEC press release 2023-139: cybersecurity disclosure rules · Read 27 Sep 2026
Microsimulation
A very short exercise, a few minutes for one person, used to keep decisions and thresholds fresh between longer sessions. iluminr describes 3–5 minute microsimulations.
Source: iluminr homepage · Read 27 Sep 2026
See also: How Often to Exercise: Annual Tabletops, Quarterly Simulations and Microsimulations
MITRE ATT&CK
A globally accessible knowledge base of adversary tactics and techniques based on real-world observations. Some platforms map exercise findings to ATT&CK techniques; Reflex Security says it maps after-action findings to ATT&CK techniques and NIST CSF functions.
Source: MITRE ATT&CK · Read 11 Oct 2026
N
NIS2
The EU directive (EU) 2022/2555 on a high common level of cybersecurity. It requires an early warning of a significant incident without undue delay and in any event within 24 hours, and policies and procedures to assess the effectiveness of cybersecurity risk-management measures.
Source: Directive (EU) 2022/2555 (NIS2), EUR-Lex · Read 11 Oct 2026
Nonlinear exercise
An exercise in which each answer changes what comes next, so teams can follow different paths. Cyberbit offers linear and nonlinear modes in Crisis Sim 360.
Source: Cyberbit: Crisis Sim 360 · Read 27 Sep 2026
O
Observer
A person who watches an exercise without playing, recording decisions, timings and whether objectives were met.
See also: How to Write Exercise Objectives That Can Be Scored
Operational resilience
The ability of an organisation to keep delivering important services through disruption. Several regulators, including in the UK and Australia, set operational resilience rules for financial firms.
P
Playbook
A documented procedure for a specific type of incident, such as ransomware or data theft. Some platforms build scenarios around the customer's playbooks.
Source: TryHackMe: tabletop exercises · Read 27 Sep 2026
R
Red team
A group that plays the attacker to test defences. In a crisis simulation the adversary may be played by people, a script or software.
S
Scripted scenario
A scenario whose injects arrive in a fixed order at fixed times regardless of what players decide.
Stand-in
A person, or a simulated participant, who takes the role of someone absent from an exercise. Reflex Security describes AI agents that can fill absent seats.
Source: Reflex Security blog: Reflex Security vs Immersive Labs · Read 27 Sep 2026
See also: Running a Crisis Exercise When Key People Cannot Attend
T
Tabletop exercise
A discussion-based exercise in which a group talks through its response to a scenario presented in stages by a facilitator.
Source: CISA Tabletop Exercise Packages · Read 27 Sep 2026
See also: Discussion, Simulation and Live Exercises: The Three Formats
Tabletop Exercise Package (CTEP)
CISA's free, ready-made exercise kits: over 100 packages with objectives, scenarios, discussion questions, a slide deck, a feedback form and an After Action Report template.
Source: CISA Tabletop Exercise Packages · Read 27 Sep 2026
See also: Free baselines and paid platforms
Telemetry
Data from an organisation's own systems and security tools. Reflex Security says its scenarios can be enriched with customer telemetry.
Source: Reflex Security blog: Reflex Security vs Immersive Labs · Read 27 Sep 2026
Frequently asked questions
What is the difference between a tabletop exercise and a crisis simulation?
A tabletop exercise is discussion-based: the group talks through what it would do. A crisis simulation asks people to act as the incident unfolds, with time pressure and information that changes. See lesson 1.
What is an inject?
A piece of new information released into an exercise, such as an alert or a journalist's call, to move the scenario on or force a decision.