Tactical, Operational and Strategic cyber exercises that put your people, plans and decisions to work before an incident does. Built around your organisation, with UK Armed Forces exercise experience translated into practical business resilience.
A plan that has never been exercised still rests on assumptions. We create a controlled space to challenge those assumptions, practise coordination and make decisions with incomplete information.
Your objectives, critical services, people and dependencies shape the exercise. The audience and level of challenge are agreed before delivery.
Carefully paced developments keep the discussion focused on decisions, responsibilities and communication. Constructive challenge gives every relevant role a voice.
Review what happened, what worked and where the response needs attention. Capture observations against the agreed objectives, supported by an exercise scorecard.
Leave with prioritised improvements to roles, plans, coordination and recovery arrangements. Agree where ownership and follow through are needed.
Every exercise includes bespoke scenario design, facilitation, a debrief, an After Action Report, recommendations and a scorecard. We agree objectives, participants, duration, boundaries and a tailored quote upfront. Tabletop exercises are discussion based simulations: they do not attack live systems, certify readiness or guarantee the outcome of a real incident.
Three distinct levels of decision making. Choose the people and responsibilities you need to rehearse, from the actions of one team to the judgement of your leadership.
Rehearse how one team, function or playbook works under focused pressure. Build confidence in the actions, ownership and escalation that make the first response effective.
Rehearse how the organisation works together. Bring functions into the same developing incident and explore the handovers, dependencies and continuity decisions between them.
Rehearse how leaders steer the business through a crisis. Explore authority, stakeholder pressure and recovery priorities when information is incomplete and decisions have wider consequences.
Bespoke scenario design. Experienced facilitation. Debrief. After Action Report. Recommendations and a scorecard.
Start at the level that meets your needs, or link Tactical, Operational and Strategic exercises over six to twelve months. Address the lessons between sessions and carry them into the next level. We agree the programme and a tailored proposal around your objectives.
Review plans, playbooks, roles and contacts before the exercise.
Include suppliers or other stakeholders where their participation is agreed.
Use targeted education to address knowledge or confidence gaps.
Scope a more complex wargame or multi day exercise where needed.
Our approach draws on extensive hours planning, participating in and delivering UK Armed Forces exercises: training for battle, rehearsing decisions and learning before the stakes are real.
That experience extends to delivering exercises for third sector organisations in Scotland, and crisis scenarios for Government and executive audiences. We adapt the method to your people, your organisation and the decisions you need to rehearse.
A clear aim keeps decisions focused when information is incomplete.
SMEAC briefing principles turn a complex situation into context, priorities and clear responsibilities.
Observe, orient, decide and act as the situation develops. Revisit assumptions as new information arrives.
An honest debrief turns what happened into recommendations and a stronger next iteration.
Explore an illustrative exercise sequence. Your scenario, pace and discussion are designed around your own objectives, plans and participants.
A critical service becomes unavailable. The cause is not yet clear and colleagues are asking what they should do.
Roles, escalation routes and a shared situation picture.
The IT team reports signs of ransomware. Customer services cannot access records and a key supplier is also affected.
Coordination, continuity arrangements and competing priorities.
Customers want an update. Recovery options remain uncertain and leaders must agree priorities while the facts continue to change.
Leadership judgement, communication and recovery priorities.
The exercise ends. Participants compare their decisions, the assumptions they made and the arrangements they relied on.
Observations, recommendations and priorities for your After Action Report.
The aim is to reveal assumptions, strengthen coordination and capture useful lessons. This preview is an illustration of facilitation, not a live exercise or an assessment.
A disciplined sequence from agreed objectives to lessons your organisation can act on.
Design the challenge. Rehearse the response. Carry the learning forward.
Agree what you need to rehearse, the right participants, the level of exercise and the arrangements or plans to explore.
Build the scenario and its developments, agree exercise boundaries and brief participants so everyone understands the purpose.
Facilitate the unfolding incident, challenge assumptions and capture decisions, coordination and observations against your objectives.
Review the experience together, deliver the After Action Report and scorecard, and identify practical priorities for improvement.
Address the findings, update the arrangements and return with a clearer objective for the next rehearsal.
Practical answers about this service, its scope and the next step.
Explore all our answersA tabletop exercise is a facilitated simulation that tests how people, plans and decisions respond to an incident. Participants discuss the scenario and make decisions without attacking or disrupting live systems.
A Tactical Skirmish focuses on one team, process or playbook, typically for up to two hours. An Operational Cross Functional exercise explores coordination, escalation and continuity across business functions, typically over three to four hours. A Strategic Executive Crisis exercise focuses on leadership judgement, stakeholders, reputation and recovery priorities, typically over three to four hours. We agree the duration and challenge around your objectives.
We agree a tailored proposal based on the objectives, audience, scenario complexity, preparation, duration and delivery requirements. It sets out what is included, your responsibilities and any separately scoped support. Additional work is agreed before it starts.
Every exercise includes bespoke scenario design, facilitation, a debrief, an After Action Report, recommendations and a scorecard. The emphasis is on identifying lessons and practical improvements.
Scenarios can include ransomware, business email compromise, a data breach, payment fraud, a critical outage, a supply chain incident or privileged account compromise. We choose a scenario around your objectives and participants.
No. It is not an exam. Success means challenged assumptions, better questions, clearer responsibilities and useful actions to improve readiness.
Our experience includes extensive time planning, participating in and delivering UK Armed Forces exercises to prepare people for battle and decisions under pressure. It also includes delivering exercises to third sector organisations in Scotland and crisis scenarios for Government and executive audiences. We translate that experience into proportionate, accessible facilitation for your organisation.
Exercises are most useful when participants have plans, responsibilities and escalation arrangements to rehearse. We review what is available during scoping. If those arrangements need to be created or refreshed first, a separately scoped readiness review or Incident Readiness engagement can help you prepare.
Yes. Exercises can progress across Tactical, Operational and Strategic levels over six to twelve months, with lessons addressed between sessions. Suppliers, partners or other stakeholders can join where their participation and confidentiality arrangements are agreed. More complex wargaming or multi day exercises are scoped separately.
The After Action Report, recommendations and scorecard help you prioritise improvements. Your team can act on them, or you can arrange separate support to refresh response plans, deliver education, implement fixes through Security Foundations or maintain a programme within a Cyber Resilience Partnership.
Start with a free discovery call. Tell us what matters to your business and where you need help. We’ll listen, explore your priorities and help you find a practical way forward.
