Measuring decisions under pressure: speed, confidence and alignment in a cyber exercise

Why measure an exercise at all?

Without measures, every exercise is judged by how it felt. The executive who enjoyed it calls it a success; the one who was embarrassed calls it unrealistic. Measures turn the conversation from impressions to evidence, and let you show improvement from one exercise to the next.

What can be measured reliably?

• Decision time: from the first signal that a decision is needed to the decision itself, in scenario time.
• Escalation time: from detection to the crisis team being convened.
• Participation: who contributed to each decision and who was silent.
• Confidence: how sure each participant says they are, captured with a quick poll.
• Alignment: whether different roles, for example legal and communications, would have chosen the same option.
• Objective completion: met, partly met or not met against each written objective.

What do platforms measure for you?

Measurement is where platforms differ most. iluminr's August 2026 update describes behavioural evidence (decision velocity, confidence and alignment) and live QR polling, with benchmarking by department, region and role. Immersive Labs describes decision-level measurement, a Resilience Score and benchmarks across teams and cohorts. Cyberbit's Crisis Sim 360 uses a shared dashboard that scores the impact of decisions on continuity, reputation and response. TryHackMe describes audit-ready reports with performance insights.

What cannot be measured easily?

Whether a decision was right. In a real incident the right call depends on facts the exercise only approximates and on risk appetite that differs between organisations. A platform can score a decision against a predefined answer, which is useful for procedural steps, but for executive calls the scoring rule is itself a judgement. Treat automated scores of decision quality as a prompt for discussion, not a verdict.

How do benchmarks help, and when do they mislead?

Comparing a team with itself over time is the most reliable benchmark: did escalation get faster after the fix? Comparing departments or regions inside one organisation is useful when they face the same scenario. Comparing with other organisations is the weakest, because scenarios, participants and stakes differ. If a vendor offers an external benchmark, ask how many organisations it covers, whether they ran the same scenario, and how the score is calculated before you show it to a board.

How do you capture measures without slowing the exercise?

Decide the measures before the exercise and give each observer two or three to track, not all of them. Use a simple log with scenario time, decision, owner and a note. Polls should take seconds, not minutes: one question, one tap. If a platform records timings for you, check before the session what it captures and what it misses, so observers can cover the gaps, usually the conversations that happen outside the tool.

A minimum measurement set

1. Time to convene the crisis team.
2. Time to each of the two or three key decisions.
3. Objectives met, partly met or not met.
4. One confidence poll at the end.
5. The same measures, the same way, every time.