Putting the board in a cyber crisis exercise: what each platform documents for directors

Why is the board different from the executive team?

Executives run the incident; directors oversee it. A board does not decide which systems to isolate. It asks whether management has a plan, whether the plan has been tested, whether the right decisions reach the board fast enough, and what the organisation will say to regulators, investors and the public. A board exercise that drills into technical containment wastes directors' time and teaches them nothing they can use.

Disclosure is often the sharpest board-level question. For US public companies, the SEC rules adopted on 26 July 2023 require a material cybersecurity incident to be reported on Form 8-K Item 1.05, generally within four business days of the materiality determination. Who makes that determination, and how the board is told, is exactly what an exercise should test.

What should a board exercise look like?

• Short: 45 to 90 minutes, or a series of shorter sessions.
• Decision-focused: two or three questions that only the board can answer, such as disclosure, extortion and public statements.
• Evidence-based: a record directors can compare with the next exercise.
• Connected: the board sees how management's earlier decisions shaped the options in front of it.

What does each platform document?

We read each vendor's public pages for how they treat directors and executives. This is coverage, not quality.

• iluminr names boards, executives, crisis teams and risk functions as its audience, and describes board-ready dashboards and benchmarking by department, region and role. It scores highest on executive and board focus (9 / 10).
• Immersive Labs lists the board among the audiences for its digital tabletop exercises, and targets executives, incident leaders and cross-functional teams with Crisis Sim (8 / 10).
• Reflex Security builds for technical, legal and executive teams in one exercise; its AI agent cast includes board members, journalists, legal counsel and regulators, and AI agents can stand in for missing C-suite roles. Board dashboards are not described (8 / 10).
• Cyberbit's Crisis Sim 360 brings executive, legal, communications, risk and SOC teams into one connected exercise, where technical escalations trigger executive decisions (8 / 10).
• Hack The Box offers separate Crisis Control formats for executives and for cross-functional groups (7 / 10).
• Conducttr runs exercises for teams of any size with a simulated media environment, but it is general crisis software rather than built around a board (7 / 10).
• TryHackMe aims its tabletops at managers, practitioners and security leaders (4 / 10).

What evidence should a board ask management for?

1. How many exercises ran in the last year, at which level, on which scenarios.
2. Which objectives were met and which were not.
3. The top findings and whether they were closed.
4. How long the key decisions took, and whether that improved.
5. Which regulations or frameworks the exercises are mapped to, if any.

Platforms that record decisions and produce reports make this easier to answer. iluminr maps evidence to eleven named frameworks; Immersive Labs describes a Resilience Score and benchmarks; Reflex Security maps reports to SOC 2, ISO 27001 and DORA, and findings to MITRE ATT&CK techniques and NIST CSF functions.

How should directors take part without taking over?

Give the board its own decisions and let management handle the rest. A facilitator should stop directors from drifting into operational detail and bring them back to oversight questions: what do we need to know, by when, and what do we say. A useful rule is that the board receives information the way it would in a real incident, from the chief executive or the incident lead, not directly from the scenario.

What should the board see after the exercise?

One page: what was tested, which decisions the board made and how long they took, the three most important findings, and the actions with owners and dates. At the next meeting, the same page with progress. Directors who see findings closed between exercises learn to trust the programme; directors who see the same findings twice learn the opposite. Keep detailed technical findings in the full report for management, and make sure the board knows the full report exists and who holds it.

Where to start

If the board has never exercised, start with one 60-minute session on disclosure and extortion, run by an experienced facilitator or a platform built for executives. Use the side-by-side view to compare the platforms that score highest on executive and board focus.

BreachRx and Cytactic were added to the ranking on 2026-10-13; their profiles cover what they document for executives.