Why run a cyber incident simulation?
If your organisation was under cyber-attack, how would you respond? With well in excess of 100 cyber incident simulations delivered, we help executive and technical teams prepare for, respond to and recover from a crisis.
A cyber incident simulation evaluates your organisation’s level of preparedness both from an executive and technical perspective. The key outcome of a cyber incident simulation, or tabletop exercise as it is often referred to, is that your organisation will have greater confidence to prepare, respond and recover in a crisis. By conducting a simulation, you will:
- establish your current state of readiness
- gain a better understanding of the cyber risks you face
- practice your decision making in a safe environment
- identify areas for improvement.
We combine our experience in responding to actual cyber incidents, along with realistic and engaging tools, to help make your simulation real.
Simulation Delivery Types
Choose from our delivery options to match your organisation’s current maturity and requirements.
| Delivery Type | Positioning | Description | Facilitation Level | Typical Use Case | Core Deliverables |
|---|---|---|---|---|---|
| Incident Response Workshop | Capability-building workshop | Facilitator-led training and structured discussion, applied to realistic scenarios, to build practical incident response capability. Modules can cover ransomware, cyber insurance, forensics, legal and privacy, and crisis communications. | High – facilitator teaches and guides | Early maturity organisations, newly formed response teams, executive or management groups needing practical incident response training and alignment | Agenda and facilitation plan, tailored training content, scenario prompts, participant materials, facilitator notes, summary of discussion outcomes, and recommended next steps |
| Guided Tabletop Exercise (TTX) | Structured validation exercise | A discussion-based exercise in which participants work through a pre-agreed scenario, testing roles, escalation, communications and key decisions against your incident response plan. | High – facilitator steers the discussion | Organisations wanting to validate plans, decision-making, coordination, and response processes without running a real-time simulation | Scenario pack, inject deck, facilitator guide, participant brief, observation notes, hot wash output, and after-action report with findings and recommendations |
| Immersive / Live-Play Simulation | High-realism operational exercise | A close-to-real-time exercise in which participants respond to a controlled flow of information, testing operational coordination and executive decision-making under pressure. | Low – facilitator observes and evaluates | Mature organisations seeking realistic validation of plans, operational response, and leadership performance under pressure | Full scenario pack, real-time injects, simulated artefacts and communications, control materials, participant briefings, observation framework, hot wash, and comprehensive after-action report |
| Incident Arena (Gamification) | Gamified executive crisis simulation | A gamified crisis simulation on one shared screen. Your executive team makes timed, collective decisions while five live health dials show the impact on the organisation. | High – facilitator runs the game and leads the debrief | Executive and leadership teams wanting an engaging, repeatable way to practise crisis decision-making and set a baseline they can track across repeat sessions | Scenario and situation report, live health-dial scoring, facilitated debrief, and a facilitator-prepared report covering your team’s score, strengths and gaps, and recommended actions |
Introducing Incident Arena
We are excited to introduce Incident Arena, our new gamification offering designed to bring an engaging, interactive edge to your incident response testing. Your executive team works through a scenario together on one shared screen, making timed, collective decisions while five health dials track the impact on the organisation. It runs entirely offline, with no internet connection or cloud services required.
How a round works. Each inject brings a new development in the incident and names the role that leads the discussion. The team talks through its options and agrees one answer before the timer runs out, and the facilitator can pause the clock at any time. The five health dials then show the impact of that decision, with the reason for each change, and the team can record its reasoning before moving on.
The health dials are an exercise device to drive discussion, not predictions of loss or findings of legal compliance.
Find out more about Incident Arena in our introduction video here.
How does a simulation work?
Working with your key sponsors, we expertly design a set of cyber incident scenarios that your organisation is most likely to face, and build the exercise around the delivery type you choose. In an immersive simulation, participants can join at varying stages throughout the exercise to apply their subject matter expertise. Our approach involves:
- Planning – we agree objectives, scope, participants and the delivery type that best suits you.
- Stakeholder input – our forensic and cyber experts meet with your key stakeholders, including IT, to make the scenario realistic.
- Scenario development – we prepare the exercise materials, such as the situation manual, injects and example reports and, depending on the delivery type, social media statements, video footage and phone calls.
- Delivery – an expert facilitator from Incident Response Solutions runs the exercise with all participants.
- Feedback and reporting – we gather feedback and, where appropriate, recommend improvements to your incident response procedures.
- Improvement plan – a final session with key stakeholders to step through the findings and agree next steps.
Participants typically include executives, general counsel, marketing, strategy, IT management, information security, human resources and risk management professionals. Exercises can run at your premises or at a selected location by prior arrangement.
Why Incident Response Solutions?
The core of our business is to provide the confidence you need to prepare for, respond to and recover from incidents, to a forensic standard: the highest level of proof. We strive to make you look good, even in times of crisis.
We have extensive experience responding to real cyber incidents, and that experience shapes every simulation we run, so your exercise will be realistic and relevant. We help you uplift your capability, reduce your risk and become better prepared to respond to actual events.
What next?
Start by asking yourself the following questions … and then get in contact with us.
- What is our current level of maturity within the incident response lifecycle?
- Do we have an up to date Incident Response Plan?
- Have we recently tested our Incident Response Plan?
- Have we conducted a post-incident review of any previous incidents, applied lessons learned and made improvements to our plan?
To find out more, call 0800 WITNESS (0800 948 637), email support@incidentresponse.co.nz or send us an enquiry. We would be delighted to help.
