These exercises can help to build confidence in an organisation’s plan and can help to build “muscle memory” allowing a team to better ‘implant’ their plan in memory, allowing them to respond faster and more effectively if a real incident were ever to occur. Additionally, these exercises can highlight weaknesses in a given plan, for example highlighting single points of failure, critical team members, undocumented key knowledge, or ambiguity in the detail of the plan.
The scenarios can be based on a wide range of potential cybersecurity incidents, such as ransomware attacks, denial of service attacks, data breaches, or more complex attacks involving multiple aspects.