Simulating the information environment: press, social media and pressure in a cyber crisis exercise

Why does the information environment matter?

Executives rarely fail an incident on technical grounds. They struggle when information arrives faster than facts: a post on social media claiming customer data is for sale, a journalist with a deadline, a large customer threatening to leave, staff messaging each other about what they have heard. Each forces a decision about what to say, often before the incident team knows what happened.

A scenario that delivers only technical alerts lets executives wait for certainty. A scenario that surrounds them with outside noise makes them decide under the conditions they will face.

What does the information environment include?

• News: articles and calls from journalists, with deadlines.
• Social media: posts from customers, researchers and the attacker, sometimes wrong.
• Messages: email and chat from staff, customers, partners and suppliers.
• Official contact: regulators, law enforcement and insurers asking for information.
• The attacker: ransom notes, leak site posts, direct contact with executives or customers.

How do platforms simulate it?

Approaches differ. Some platforms make the information environment the centre of the product; others treat it as one kind of inject among many. Neither is wrong, but a buyer who wants executives under media pressure should check how much of it the platform generates and how much the facilitator must write.

• Conducttr is built around it: a virtual desktop gives each player a first-person view of the crisis, with simulated news, social media and messaging, and role-specific content under facilitator control.
• Hack The Box's Crisis Control delivers scenario waves with injects, emails, news and social updates.
• Reflex Security describes pressured stakeholders who push back in real time alongside an adaptive adversary.
• iluminr describes real-time injects and immersive media.
• Immersive Labs describes AI actors that players can question, which can play outside parties.

How do you write it yourself?

If your platform does not simulate outside pressure, or you run a discussion-based exercise, write it. A few rules help.

1. Make some of it wrong. Real social media is not accurate. A false claim that must be checked tests verification under pressure.
2. Give it deadlines. A journalist publishing at 5pm with or without a comment is more useful than one who waits.
3. Make it reach the wrong person. A customer emailing the chief executive directly, or a reporter calling a junior employee, tests whether information flows back to the crisis team.
4. Escalate. Start with one post, then a news story, then a regulator's call.
5. Keep it plausible. Over-the-top pressure makes the scenario easy to dismiss.

How does this connect to current threats?

Attacker behaviour shapes what outside pressure looks like. Mandiant's M-Trends 2026 reports voice phishing as the initial vector in 11% of intrusions it investigated, and prior compromise as the top ransomware vector at 30%. A scenario where the first outside signal is a customer reporting a convincing call from your help desk, or a leak site post about data stolen months ago, uses the information environment to deliver the incident itself.

What should observers watch for?

Give observers a simple sheet with these four points, and ask them to note the scenario time whenever one happens. The pattern across a session usually tells you more than any single moment.

• Who drafts the first holding statement, and how long it takes.
• Whether the team checks a claim before responding to it.
• Whether outside contacts reach the crisis team or get stuck.
• Whether what is said publicly matches what is told to regulators and customers.

How much outside pressure is enough?

Enough to force decisions, not so much that the exercise becomes a test of reading speed. A useful rule is one outside contact for every major decision point, rising towards the end as the story spreads. Watch the room: if executives stop discussing options and only react to messages, slow the feed down. If they discuss calmly for twenty minutes without interruption, add a journalist.

Remember that communications staff are players too. Give the communications lead real work to do in the exercise, drafting and approving statements, rather than asking them to describe what they would write.

Where it fits in our scoring

Simulated outside pressure counts toward scenario realism in our method. It is one of the five properties in lesson 2 of the tabletop school.