Incident Response Testing: What Exercises Reveal

by josheph bell

September 5, 2026

Every incident response exercise we run, teaches us something a client's response plan never could. Across energy, water, pharma, and manufacturing sites, once the simulated alarm goes off and a team actually has to move, the same handful of patterns keep resurfacing. This is a look at what we've learned, and why we build CIRT360 the way we do.

Not Every Team Should Get the Same Test

We didn't build two exercise formats because it looks good on a service sheet, but . We built them because teams show up at very different starting points.

A small exercise is a focused, half-day session built around a single scenario phase, for organizations that are just getting started with structured incident response testing. The aim is simple: give a team its first real experience of working through a simulated incident together, surface the early gaps, and build the confidence to go further. It works well as a first step, or as a regular check-in between more intensive exercises.

An extended exercise is a different animal: a full-day or multi-day engagement with dynamic injects that evolve over time, bringing together participants from IT and OT to legal, communications, and senior management. The scenario unfolds in phases, forcing the team to adapt, re-prioritize, and coordinate under pressure. It is the closest an organization can get to a real incident without actually having one.

The lesson: calibrating difficulty and format to where a team actually stands beats a one-size-fits-all drill. Push an unprepared team too hard, too soon, and they disengage. Under-test a mature team, and they walk away with false confidence.

What We Actually Watch For

A question we hear often: what exactly gets evaluated during a CIRT360 exercise? The honest answer is that we look at how a team actually responds, not what they know in theory. There is no written exam and no checklist to fill out. The evaluation is based entirely on what happens in the room.

Experienced facilitators track how decisions are made and by whom, how information flows between people and teams, whether roles and responsibilities hold up under pressure, and how well technical and non-technical participants coordinate. That produces a maturity score across ten capability domains, each rated 0 to 5, covering everything from initial awareness and containment through to regulatory handling, communication, and recovery. Each score reflects demonstrated capability, not self-reported confidence, and that distinction is the whole point: it surfaces gaps a team may not know it has.

We also assess the quality of key decisions made during the exercise, on ownership, rationale, risk awareness, and regulatory impact. That gives a sharper picture of how a team actually thinks under pressure, and where its decision-making habits need work.

The Gap Between How Ready Teams Feel and How Ready They Are

Alongside the facilitator's observations, every participant completes an anonymous pulse survey after the exercise, self-rating their confidence on role clarity, escalation awareness, regulatory understanding, and structured decision-making, each on a 1 to 5 scale.

Run this enough times and one pattern shows up again and again: self-assessed confidence is often high in exactly the areas where the facilitator identified real gaps. That mismatch is not a footnote. It is one of the most valuable insights an exercise produces, because it tells a leadership team something a status report never will, that the people closest to an incident may not know what they don't know.

A Case From the Field

One engagement, with a European manufacturing organization, stays with us as a good illustration of how this plays out. The exercise simulated a multi-day cyber incident that escalated from an initial network compromise into operational technology systems across multiple sites, with new developments introduced at regular intervals to force the team to re-assess and adapt.

Several strengths stood out: the team collaborated well, maintained a blame-free environment, and showed solid technical instincts in containment and evidence preservation. The gaps were equally telling. Documentation discipline was inconsistent, key stakeholders were brought into the response later than ideal, and certain ownership questions were resolved ad hoc rather than through established process.

None of that is unique to one client. These are common patterns, and exactly the kind of blind spots that only surface under realistic pressure, never in a slide deck or a policy review.

The maturity assessment confirmed a solid overall baseline, with clear strengths in situational awareness and regulatory recognition, and flagged the specific domains where targeted improvement would have the biggest impact. The self-assessment showed high confidence overall, with subtle dips exactly where the scenario pushed hardest, reinforcing that same gap between what a team feels and what it demonstrates. The result was a prioritized improvement roadmap the organization is now working through. When the next exercise runs, the updated scores will show whether it held.

Tracking Maturity Over Time

A single exercise gives a snapshot. Repeating it gives a trend line, and that is where CIRT360 earns its name. Comparing maturity scores year over year, across all ten assessment domains, is how an organization can tell the difference between a team that feels more prepared and a team that actually is.

*Illustrative example. Actual scores are based on an organization's own exercise results.*

What This Is Really About

None of this is about pass or fail. The point of testing a response capability is not to prove a team is ready. It is to find out, honestly, where it is not, while that discovery still only costs an afternoon or two, instead of days of real operational disruption.