Incident Arena is our gamified cyber crisis simulation for executive and leadership teams. Your team gathers around one shared screen and works through a realistic incident together, making timed, collective decisions while five live health dials show the impact of each call on the organisation. An expert facilitator from Incident Response Solutions runs the game and leads the debrief.
It is one of four cyber incident simulation delivery types we offer, and the one to choose when you want an engaging, repeatable way to practise crisis decision-making and set a baseline you can track across repeat sessions.
Why gamify a cyber incident simulation?
Traditional tabletop exercises rely on discussion alone, and it is easy for a few voices to dominate while the rest of the room observes. Incident Arena changes the dynamic. A visible countdown, a named lead role for each decision and dials that move in response to what the team decides keep every participant engaged and accountable. The result is a session that feels closer to the pressure of a real incident, while remaining a safe environment in which to practise.
- Engaging – timed rounds and live scoring hold attention for the full session.
- Collective – the team must agree one answer, surfacing differences in judgement before a real crisis does.
- Measurable – your score and the health-dial trend give a baseline to compare against in future sessions.
- Repeatable – run it again with a new scenario, a new team or after changes to your incident response plan.
How a round works
The scenario unfolds through a series of injects. Each inject brings a new development in the incident and names the role that leads the discussion, whether that is the Chief Executive, General Counsel, IT Manager or Communications lead. The team talks through its options and agrees one answer before the timer runs out. The facilitator can pause the clock at any time to explore a point or draw out a quieter participant.
Once the answer is locked in, the five health dials move to show the impact of that decision on the organisation, with the reason for each change explained on screen. The team can record its reasoning before moving on to the next inject, which becomes a valuable record for the debrief and the final report.
The health dials are an exercise device to drive discussion. They are not predictions of loss or findings of legal compliance.
Runs on a local computer, entirely offline
Incident Arena is a self-contained application that runs on a local computer connected to a single shared screen or projector. It needs no internet connection and no cloud services, so it can be run in any boardroom, including environments where network access is restricted. Nothing about your scenario, your team’s decisions or your results leaves the room unless you choose to share it.
What you receive
- Scenario and situation report – a realistic cyber incident scenario designed with your key sponsors around the threats your organisation is most likely to face.
- Live health-dial scoring – the impact of each decision shown as it happens, with the reasoning behind every change.
- Facilitated debrief – an expert facilitator walks the team back through the key decisions, what went well and where the discussion stalled.
- Facilitator-prepared report – covering your team’s score, strengths and gaps, and recommended actions to improve your incident response capability.
Who it is for
Incident Arena is designed for executive and leadership teams: boards, chief executives, general counsel, chief information and security officers, communications, people and risk leaders. It suits organisations that have an incident response plan and want to test the decision-making behind it, as well as those running their first exercise and looking for a format that will hold the room’s attention. For technical response teams, or for organisations seeking a high-realism operational exercise, see our other simulation delivery types.
How we deliver it
- Planning – we agree objectives, participants, session length and the type of incident to simulate.
- Stakeholder input – our forensic and cyber experts meet with your key stakeholders, including IT, so the scenario reflects your systems, your sector and your real exposure.
- Scenario build – we prepare the injects, decision options and health-dial logic for your scenario.
- Delivery – a facilitator from Incident Response Solutions runs the session at your premises or an agreed location, typically in a half-day block.
- Debrief and report – we lead the debrief on the day and follow up with the written report and recommended actions.
What next?
If your executive team has not tested its crisis decision-making recently, or your last tabletop exercise struggled to hold the room, Incident Arena is a good place to start. To find out more or to book a session, call 0800 WITNESS (0800 948 637), email support@incidentresponse.co.nz or send us an enquiry. We would be delighted to help.
