Discussion, simulation and live exercises: the three formats of a cyber crisis exercise

Why does the format matter?

Every exercise is a trade between cost and fidelity. The cheaper the format, the more often you can run it, and the less it resembles the real event. Choosing a format is choosing which part of your response you want to see under pressure: the decisions, the coordination between teams, or the technical work itself.

NIST's guide to test, training and exercise programmes, SP 800-84, published in September 2006 and still the reference most programmes cite, separates discussion-based tabletop exercises from functional exercises in which people perform their roles in a simulated operational environment. The distinction is still useful, even though software has blurred it.

What is a discussion-based tabletop?

A facilitator presents a scenario in stages and the group discusses what it would do. Nobody touches a system. The value is in hearing assumptions out loud: who decides to take a service offline, who calls the insurer, who speaks to the press. CISA's free Tabletop Exercise Packages are built for this format, with objectives, scenarios, discussion questions and an After Action Report template.

The limit is that a discussion rewards the right answer said calmly. Time pressure, conflicting information and the cost of a wrong call are mostly absent.

What is a crisis simulation?

A crisis simulation asks people to act rather than discuss. Information arrives as it would in an incident, by email, chat, news and social media, and the scenario moves on whether or not the team has decided. The better platforms change the scenario in response to each decision, so two teams that choose differently face different consequences. Reflex Security, for example, describes an adversary that adapts to every decision; Conducttr simulates the news and social media environment around the players.

This is the format most executive teams under-practise, because it needs either a skilled facilitator with a large script or software that plays the other side.

What is a live technical exercise?

Responders work on real tools or a replica environment: they investigate alerts, contain hosts and restore services. Immersive Labs' Dynamic Threat Range, which runs live attacks against a customer's own security tools, is an example. These exercises test hands-on skill and tooling, but they rarely include the people who decide what to disclose.

How do the formats fit together?

• Use discussion-based tabletops to agree roles, escalation paths and who holds which decision.
• Use crisis simulations to test those decisions under time pressure with executives and responders together.
• Use live technical exercises to test whether the technical team can do what the plan assumes.
• Link them: a technical escalation in a live exercise can become an executive decision in a simulation, which some platforms connect directly.

A programme that only runs one format will look ready in that format. The incident will not use the same one.