What a cyber exercise after-action report should contain

Why do so many after-action reports go unread?

Because they arrive weeks later, run to dozens of pages and list observations without owners. By the time the report is circulated, the people who were in the room have moved on, and the findings read like opinions. A report is only as useful as the fixes it produces.

What sections should it have?

1. Scope and objectives: what the exercise set out to test, and the objectives marked met, partly met or not met.
2. Participants: roles present, absent and stood in for.
3. Timeline: the key injects and decisions with scenario time stamps.
4. Decisions: for each major decision, who made it, on what information, how long it took and what assumption it rested on.
5. Strengths: what worked and should be kept. Teams need to know this as much as they need the gaps.
6. Findings: each gap stated as a fact, linked to the moment it appeared, with its impact.
7. Actions: a short list of fixes, each with one owner and a date.
8. Evidence annex: notes, chat logs or recordings that support the findings, kept with appropriate access controls.

Who writes it, and how fast?

Aim to circulate a draft within a few days, while memories are fresh. Several platforms now produce the record automatically: Reflex Security says its after-action report is generated when the session ends, every finding traces to the exact moment in the simulation it came from, and findings are mapped to MITRE ATT&CK techniques and NIST CSF functions with timestamps, transcript quotes and logged console queries; Hack The Box ends Crisis Control with a "Golden Report", a roadmap and technical annexes; Immersive Labs announced enhanced after-action reporting for Crisis Simulation in March 2026. CISA's free packages include an After Action Report template for teams that write their own.

What makes a finding useful?

• It is specific: "the escalation matrix lists a deputy who left in June", not "escalation needs work".
• It is evidenced: it points to a time stamp or a quote from the session.
• It has impact: it says what the gap would cost in a real incident.
• It is fixable: someone can own it and close it by a date.

What should the report avoid?

• Blaming individuals: findings describe gaps in plans, information and authority, not people.
• Long narrative: a timeline table says more in less space.
• Untracked recommendations: anything without an owner and a date belongs in an appendix, not in the actions list.
• Sensitive detail in the summary: keep specific weaknesses in the full report with restricted access.

Who should read it?

Two versions help. The full report goes to the exercise owner and the people responsible for fixes. A one-page summary goes to the executive team and, where relevant, the board or risk committee: objectives, the three most important findings, actions and dates. If a regulator or auditor may ask for evidence of exercising, keep the full report and the action tracker together, with dates.