Cyber crisis exercises

Types of exercises offered

Given that no cyber crisis is ever the same, we believe that crisis exercises should reflect both your current capabilities and overall maturity.

The most initial level of exercises are facilitated walkthroughs, which guide participants through a structured discussion centered on a scenario. These are most suitable for organisations seeking to embed understanding of their existing plans.

On the next layer of complexity are tabletop exercises. These involve participants working through a mock Crisis Management Team meeting based on a scenario structured around multiple injects.

One level higher are simulation exercises, which engage multiple teams in parallel and in simulated real-time for several hours. These are intense and require significant effort from all parties. They are most suitable for organisations with a deeply entrenched and robust Crisis Management Team.

At the top of the pyramid are war games, which refine an organisation’s mature crisis response capability by exploring decision-making models in high-impact simulated scenarios. These exercises often include both strategic and technical participants, enabling cross-functional teams to test coordination, escalation, and decision-making under pressure.

Each exercise tier is aligned with industry-standard simulation practices, allowing us to support independently scoped engagements rather than proprietary formats. 

Each tier is designed with a specific audience in mind:

• Initial (Facilitated Walkthroughs) are ideal for teams new to crisis response or those who have recently updated their plans — including IT, SOC, and business continuity leads.

• Tabletop Exercises engage mid- to senior-level stakeholders across business, legal, comms, and technical functions to validate coordination and decision-making.

• Simulation Exercises involve the full Crisis Management Team and test real-time response across multiple functions under pressure. 

• War Games are designed for high-impact scenarios and include a mix of Crisis Management Team, senior leaders, technical responders, and domain experts to simulate realistic, cross-functional crisis conditions.

Methodology and approach

We approach delivering a cyber crisis exercise with a structured and comprehensive methodology, tailored to your organisation’s specific needs, maturity level, threat landscape, and business priorities. Our standardised framework ensures that each exercise is realistic, plausible, immersive, and engaging. This methodology is grounded in the experience of PwC’s leading Cyber Incident Response and Managed Cyber Defence experts, who have supported our clients in responding to and recovering from hundreds of cyber incidents. While ransomware is a common scenario, we also simulate a wide range of cyber-attack types, rehearsing against several of your most significant threats at once: to test your response capabilities across multiple dimensions.

Our methodology is divided into four stages:

• Investigate: We work with subject matter experts to define the objectives of the exercise. This includes a kick-off meeting with your team to align on goals, followed by a comprehensive capability review.
• Design: We create a realistic scenario, including a walkthrough with your team to validate the scenario and injects.
• Deliver: We facilitate and observe the exercise, typically through a half-day session with the relevant participants.
• Report: We capture lessons learned and provide actionable recommendations. This includes drafting the report, delivering it, and presenting a debrief. We can go further, and update your Crisis Management Plans based on the recommendations, if you wish. 

Additionally, the exercise is structured as an escalating global effort, divided into four phases: Crisis Discovery, Crisis Response Escalation, Complexity Escalation, and Debrief. Each phase includes targeted activities to manage a cyber-attack, rehearse decision-making, escalate crises, and address complexities.

This structured approach helps your Crisis Management Team build muscle memory, understand the benefits and limitations of your current response and recovery capabilities, and fulfil regulatory requirements.

Realistic scenarios and immersive experiences

Scenarios are most effective when participants are thoroughly immersed in them. We meticulously develop narratives based on real incidents encountered across our network to ensure they accurately reflect the techniques used by threat actors in the real world.

These narratives are enriched with the aid of injects—such as news stories, social media posts, phone calls, or voicemails—that provide participants with evolving updates. Given the intrinsic link between crises and stress, we tailor these injects to heighten realism and engagement.

Our scenarios are structured around distinct types of cyber-attacks, including but not limited to ransomware, third-party incidents, and insider threats.

Recognising the constant presence of uncertainty during crises and the need for decisive action despite it, we design each scenario to encompass multiple attack types, thereby preparing you for a range of possible situations in a single exercise.