What makes a cyber crisis scenario realistic, and how to tell from a demo

Why does realism matter more than polish?

People rehearse what they are shown. If the scenario is a generic ransomware story set in a company that looks nothing like yours, the team rehearses generic answers. The decisions that hurt in a real incident are specific: this payment system, this cloud account, this regulator, this customer. Realism is what makes the rehearsal transfer to the real event.

What are the five properties?

1. Your environment. The scenario names systems, suppliers and data you actually have. Reflex Security builds its scenario from open-source intelligence about the organisation and can add its telemetry; Hack The Box tailors six baseline scenarios on request.
2. A reacting opponent. The attacker, and the situation, respond to the team's choices instead of following a fixed timeline. Cyberbit's nonlinear mode changes the next step after each answer; Reflex describes an unscripted adversary.
3. Time pressure. Decisions have deadlines that move. A team given unlimited time to discuss will reach better answers than it would at three in the morning.
4. An information environment. Real incidents arrive through partial alerts, worried staff, journalists and social media. Conducttr and Hack The Box both simulate news and social updates around the players.
5. Consequences. A wrong call should make the next hour harder, not simply be noted for the report.

How can you test realism in a demo?

Ask the vendor to run the same opening twice and make a different decision the second time. If the next inject is identical, the scenario is scripted, whatever the marketing says. Ask where the scenario's details come from: a template library, your own documents, or data about your environment. Ask what happens when nobody decides at all.

Can a scenario be too realistic?

Yes, in two ways. A scenario built on a live weakness the team has not fixed yet can expose sensitive detail to a wide audience, so check who sees the scenario and the report. And a scenario so hard that the team fails in the first ten minutes teaches little; the goal is pressure, not humiliation.

Where should the threat come from?

Use current attack data rather than last year's headline. Mandiant's M-Trends 2026, for instance, reports that exploits were the most common initial infection vector for a sixth year, at 32%, and that voice phishing reached 11%. A scenario that starts with an exploited edge device or a convincing phone call to the help desk is more likely to resemble your next incident than one that starts with a mass phishing email.

Dwell time matters too. The same report puts the global median dwell time at 14 days, up from 11 the year before, which argues for scenarios where the intrusion is discovered late and the team must work out what already happened.

Realism is one criterion of seven in our scoring, weighted at 20%. The scoring page explains how we judge it from public material.