Incident Arena: Adding a New Dimension to the Tabletop Exercise
Key Takeaway: Incident Arena is our new crisis simulation solution for executive and leadership teams. It keeps everything that makes a facilitated tabletop valuable, the discussion, the debate and the debrief, and adds what paper can’t: a clock that keeps running, consequences the room can see, a budget that won’t stretch to everything, and a record of every decision. We look forward to bringing it to our clients.
In our May bulletin we wrote about cyber simulations and tabletop exercises, and about the growing demand from experienced clients for exercises that feel closer to a real incident: more pressure, less certainty and more at stake in each decision. Incident Arena is our answer to that demand. It does not replace the facilitated tabletop. It gives it a new dimension.
One shared screen, one collective decision
Incident Arena is run by an Incident Response Solutions facilitator, in the room, on one shared screen. The team works through a realistic cyber incident as it unfolds. At each inject, a new development in the incident, the team reads the situation, discusses its options and agrees one answer from four plausible choices before the timer runs out. Each inject shows which role leads the discussion, so the right voices are heard at the right time. The facilitator can pause the clock at any point to draw out a conversation, and the team can record the reasoning behind each decision.
If the clock runs out, that has consequences too. As in a real incident, not deciding is itself a decision.
Consequences you can see
The defining feature of Incident Arena is five live health dials: operational resilience, data protection, financial health, reputation and regulatory compliance. After every decision the dials move, with the reason for each change. A well-judged containment decision may protect operations but cost money; a delayed notification may save time today and damage regulatory standing tomorrow. If a dial reaches zero, play can stop, just as a real crisis can overwhelm an organisation. In a traditional tabletop, the impact of a decision lives in the discussion and in the facilitator’s notes. In Incident Arena the whole room sees it the moment it happens. That changes the conversation. Trade-offs become concrete, quieter participants have something specific to respond to, and the link between a decision and its organisational impact becomes hard to ignore.
Real trade-offs, real constraints
Between injects the team can spend a limited response budget on specialist support such as digital forensics, legal and privacy advice, crisis communications or an incident response surge team. Some support takes time to arrive, so timing matters as much as choice. A cyber insurance policy can pay back part of what it covers, as it would in practice. The budget never stretches to everything, which forces exactly the conversations organisations need to have before an incident, not during one: what do we need first, who authorises the spend, and what are we prepared to go without?
Scenarios that fit the room
The first edition of Incident Arena includes ten scenarios reflecting the attacks New Zealand organisations face, including ransomware, business email compromise, cloud account takeover, data theft and extortion, supplier compromise, a malicious insider, an attack on operational technology, and AI impersonation and social engineering. Each can be played by a full incident response team or focused for a technology and cyber team, a communications team or the board, and some have versions tailored to particular industries. We set the severity, the starting health of the organisation, the time allowed for each decision and the roles in the room, so the exercise matches the maturity and make-up of the team.
Built for the debrief, and for doing it again
At the end, the results show where each dial started and finished, every decision and its impact, and what was bought. Your facilitator leads the debrief and exports a report covering the decisions, their impact, the budget and insurance, and recommended next steps, and each team receives a certificate of completion. Because every session is recorded in the same way, Incident Arena is well suited to the repeat programmes we advocated in May. Run the same scenario a year later and compare. Is the team deciding faster? Are the dials ending higher? Are the same gaps appearing? That gives boards and executives a tangible view of how their crisis decision-making is maturing over time.
Private by design
Incident Arena runs entirely offline on our own device, with no need for an internet connection, cloud services or accounts, and session records stay with us. The health dials are an exercise device to drive discussion, not predictions of loss or findings of legal compliance.
Tabletop exercises remain one of the most effective ways to build cyber resilience, and the facilitated discussion will always be at their heart. Incident Arena adds time pressure, visible consequences and genuine trade-offs to that discussion, and leaves a record the organisation can build on. We are excited to begin delivering Incident Arena to our clients and look forward to running it with your team. To find out more, or to discuss how Incident Arena could fit your next simulation exercise, contact us at support@incidentresponse.co.nz. You can also watch our launch video here.
About the Bulletin:
The NZ Incident Response Bulletin is a monthly high-level executive summary containing some of the most important news articles that have been published on Forensic and Cyber Security matters during the last month. Also included are articles written by Incident Response Solutions, covering topical matters. Each article contains a brief summary and if possible, includes a linked reference on the web for detailed information. The purpose of this resource is to assist Executives in keeping up to date from a high-level perspective with a sample of the latest Forensic and Cyber Security news.
To subscribe or to submit a contribution for an upcoming Bulletin, please either visit https://incidentresponse.co.nz/bulletin or send an email to bulletin@incidentresponse.co.nz with the subject line either “Subscribe”, “Unsubscribe”, or if you think there is something worth reporting, “Contribution”, along with the Webpage or URL in the contents. Access our Privacy Policy.
This Bulletin is prepared for general guidance and does not constitute formal advice. This information should not be relied on without obtaining specific formal advice. We do not make any representation as to the accuracy or completeness of the information contained within this Bulletin. Incident Response Solutions Limited does not accept any liability, responsibility or duty of care for any consequences of you or anyone else acting, or refraining to act, when relying on the information contained in this Bulletin or for any decision based on it.
