Introduction
Most organizations discover their incident response plan doesn't work during an actual breach — not a drill. Roles blur, escalation paths disappear, and the plan written 18 months ago no longer reflects how the business operates.
According to IBM's 2023 Cost of a Data Breach Report, organizations with high levels of IR planning and testing identified and contained breaches 54 days faster than those without — and saved an average of $1.49 million per incident.
Skipping exercises has predictable consequences: plans go stale, role clarity erodes, escalation paths break down, and boards are left without defensible evidence of preparedness — a gap the SEC and other regulators are increasingly scrutinizing.
This article covers:
- Why exercising is an ongoing discipline, not a one-time event
- The four main exercise types and when to use each
- Warning signs that readiness is degrading
- How to build a cadence that keeps boards informed and programs inspectable
TL;DR
- An incident response plan only has value if the team has rehearsed it — exercises are what keep readiness current.
- Four exercise types serve distinct purposes: tabletop discussions, post-incident reviews, functional drills, and red team simulations — each suited to different goals and audiences.
- Warning signs include outdated scenarios, role confusion, recurring gaps across exercises, and long stretches without any drills.
- A tiered cadence from quarterly tabletops to annual red team engagements gives boards visible proof of program health.
- Every exercise ends with a documented after-action report, assigned remediation owners, and a follow-up date.
Why Keeping Incident Response Exercises Active Matters
Incident response capability degrades on its own. Staff turns over, systems change, threat actors evolve. A plan written before a cloud migration or an acquisition may describe an organization that no longer exists.
That gap between a documented plan and a tested one is exactly where regulators are now looking.
The Regulatory Expectation Has Changed
Documenting a plan is no longer sufficient evidence of preparedness. Regulators want proof that organizations actually test it:
- DORA (Article 11) requires financial entities to test ICT business continuity and response plans at least annually, with advanced threat-led penetration testing required at least every three years for selected entities.
- HIPAA (45 CFR 164.308) requires covered entities to implement procedures for periodic testing and revision of contingency plans.
- NYDFS (23 NYCRR 500.16) requires annual testing of incident response and business continuity plans with all staff and management critical to the response.
- SEC cybersecurity disclosure rules require registrants to describe their processes for managing material cyber risks and disclose board oversight — which creates implicit pressure to demonstrate tested, not just documented, capabilities.
The NACD's 2026 cyber incident response guidance puts it plainly: boards should ask whether realistic tabletop exercises have been conducted in the last 12 months. That question is now on the governance checklist.
The Gap Between Paper and Performance
What exercises actually surface is the distance between documented procedure and real behavior under pressure. That gap shows up most visibly in three places:
- Decision rights — who can authorize isolating a system, and who actually makes that call at 2 a.m.
- Escalation thresholds — what triggers notification to legal, communications, regulators, or the board
- Cross-functional coordination — how IT, legal, communications, HR, and executive leadership operate together under stress
IT teams often know their playbooks cold. Legal and communications teams frequently haven't practiced theirs at all. That misalignment only becomes visible under pressure — and an exercise is far cheaper than a real incident for finding it.
Types of Incident Response Exercises
Exercises exist on a spectrum from low-cost discussion sessions to full adversary simulations. The right approach depends on where the team is in its readiness journey and what specific capability needs validation.
Tabletop Exercises
Tabletops are discussion-based sessions where stakeholders walk through a simulated scenario to test decision-making, communication, and role clarity — with no real resources deployed. NIST SP 800-84 defines them as sessions where personnel meet to discuss roles and responses to an emergency scenario, making them the most accessible starting point for organizations of any size.
What makes a tabletop effective:
- A realistic, industry-relevant scenario (ransomware with partial backups, cloud identity compromise, third-party outage, social engineering targeting executives)
- Cross-functional participation — CISO, CIO, Legal, Communications, HR, and executive leadership, not just IT
- A facilitator who probes decisions and surfaces assumptions rather than narrating a script
- Injects that add new complications mid-session (a data theft claim surfaces, backup systems fail, media calls)
- A clear output: a gap analysis with assigned owners and deadlines
Tyson Martin's tabletop format runs 60 minutes: context and scenario framing, a decision-making walkthrough, two to three injects, and a gap analysis that assigns who fixes what by when. The session is a decision drill, not a technical exercise, with a focus on shutdown calls, statement timing, and notification decisions.
Every exercise ends with a short action list. Without that accountability structure, the session produces awareness — not improvement.
An external advisor facilitating these sessions changes the output quality. Someone independent of the in-house security team has no stake in making the organization look prepared and can translate findings directly into board-ready governance language.
Post-Incident Reviews
Every real incident is an exercise in disguise. Structured post-incident reviews (also called after-action reviews) extract the same value as a planned exercise, and they should be mandatory, documented, and tied to plan updates.
NIST SP 800-61r3 maps post-incident improvement to lessons-learned meetings, noting that lessons should be shared as soon as identified — not delayed until recovery ends. CISA's guidance reinforces this: hold a formal, blameless retrospective covering the timeline, team performance, and policy updates required.
Skipping this step has a predictable cost: the same gaps reappear in subsequent incidents. Teams repeat the same mistakes, and the organization loses its ability to demonstrate progress to boards, auditors, and regulators who expect documented evidence of continuous improvement.
Functional Exercises
Functional exercises are scenario-driven drills where specific teams execute their actual procedures in a simulated environment. That might mean activating backup systems, running through containment playbooks, or executing breach notification protocols (not just discussing them).
They're a step up in realism from tabletops and are appropriate after tabletop exercises have validated the plan at a conceptual level. The practical question they answer is whether specific procedures actually work as written. A plan that says "activate secondary data center within four hours" needs to be tested before that claim is relied upon during a real event.
Once functional drills confirm that individual procedures hold up, the next level tests whether the entire response chain holds under realistic attack conditions.
Red Team and Full-Scale Exercises
Red team exercises are the most advanced form of readiness testing. As defined by NIST, a red team exercise is a simulated adversarial attempt to compromise organizational missions or business processes, conducted by an independent group authorized to emulate real attacker tactics against live systems and controls.
Key distinctions:
| Exercise Type | Approach | What It Tests |
|---|---|---|
| Tabletop | Discussion-based | Decision-making, communication, role clarity |
| Functional | Simulated procedures | Whether specific plans work as written |
| Red Team | Active adversary simulation | Detection, escalation, containment, recovery under realistic conditions |
| Full-Scale | Live resources and personnel | End-to-end response with external stakeholders involved |
Red team results provide the most credible assurance evidence for boards and regulators. DORA Article 26 specifically requires threat-led penetration testing at least every three years for selected financial entities. Full-scale exercises are appropriate for mature programs that have already validated fundamentals through tabletops and functional drills.
Warning Signs Your IR Team's Readiness Is Slipping
Organizations should watch for specific indicators that readiness needs attention — not just wait for the annual exercise date.
Roles and Escalation Are Becoming Unclear
If team members give different answers about who owns the escalation decision during a simulated incident, that ambiguity is a leading indicator of real-world failure. Common patterns to watch for:
- Hesitation when asked who can authorize isolating a system
- Deferral — "I thought you were handling that"
- Notification thresholds that nobody can agree on
This typically surfaces when key personnel turn over and role documentation isn't updated, or when decision rights were never formally documented to begin with. Vague severity definitions make everything feel urgent, which means nothing gets handled well.
Plans and Scenarios Are Outdated
If exercise scenarios don't reflect the organization's current technology stack, vendor relationships, or threat landscape, the exercise is validating a plan that no longer matches reality. Threat vectors to audit against include AI-enabled phishing, supply chain compromises, and cloud-specific attack paths.
Two quick checks reveal exposure fast:
- Plan currency: When was the incident response plan last updated?
- Scenario relevance: Were exercise scenarios refreshed after a cloud migration, acquisition, or major leadership change?
Any plan that hasn't been validated against current conditions should be treated as unvalidated.
The Same Gaps Keep Reappearing
When after-action reports from consecutive exercises surface the same communication breakdowns, unclear ownership, or delayed escalation paths, remediation actions from prior exercises aren't closing.
Track remediation item closure rates across exercises. This single metric tells boards more about program health than any readiness score. If items from exercise one are still open when exercise three runs, the program is producing paperwork, not improvement.
Exercises Are Infrequent or Skipped During Busy Periods
Exercise frequency is itself a readiness metric. Gaps longer than six months in any exercise tier warrant attention. When organizations defer exercises due to competing priorities, the inevitable result is an untested team facing a real incident.
Skipping board or executive participation in tabletop exercises leaves leadership without the practiced decision-making needed to act quickly and defensibly during an actual event. That creates both operational and governance risk at once.
Building a Sustainable Exercise Cadence
No single exercise type is sufficient. Readiness is maintained through a tiered calendar that combines lower-cost, higher-frequency exercises with less frequent but more rigorous simulations.
Recommended Cadence by Tier
| Frequency | Exercise Type | Purpose |
|---|---|---|
| Quarterly | Tabletop exercises on current threat scenarios | Maintain decision-making muscle memory; rotate scenarios each quarter |
| Annually | Functional exercise or red team engagement | Validate specific procedures or full detection/response chain |
| After significant incidents or major organizational changes | Post-incident review and plan update | Extract lessons, update plan, close gaps while context is fresh |
| Every two to three years (or per regulatory requirement) | Full-scale exercise with external stakeholders | Most rigorous validation; appropriate for mature programs |
Adjust for Your Risk Profile
The baseline above applies to most organizations. Certain factors warrant a higher cadence:
- Regulated industries with active examination cycles (financial services, healthcare)
- Organizations handling high volumes of sensitive data (PHI, PII, payment data)
- Periods of elevated change — cloud migrations, M&A integration, leadership transitions
- Recent incidents or near-misses that exposed untested gaps
A healthcare organization with significant PHI exposure, or a retailer running tabletops around peak season scenarios, may need quarterly tabletops supplemented with mid-year functional drills.
Make the Calendar a Governance Artifact
The exercise calendar should be reviewed and approved at the board or audit committee level, with formal approval on record. That creates an inspectable artifact that regulators, auditors, and insurers can examine — and it signals that incident readiness is a governance priority, not an IT scheduling task.
That's where translation matters. Tyson Martin's board advisory work converts exercise outcomes into language directors can act on: an incident readiness scorecard based on tested behaviors, after-action reports that move from lessons to operating changes, and a decision rights map that clarifies cyber escalation paths.
The output is a 10-slide readout plus a two-page action plan, with each top risk assigned to one accountable leader rather than a committee. Directors leave with clear decisions, not a technical report that generates follow-up questions.
Conclusion
Organizations would never rely on a fire extinguisher that hasn't been inspected. Relying on an incident response plan that has never been tested under pressure carries the same risk — with larger consequences.
Exercises are not a compliance checkbox. They're the mechanism through which teams build muscle memory, decision rights clarity, and cross-functional coordination that real incidents demand. Without them, plans go stale, roles blur, and boards have nothing to show auditors or regulators when they ask.
Boards that want genuine confidence in cyber readiness need a structured, documented exercise program built on four elements:
- Realistic scenarios tied to the organization's actual threat profile
- Cross-functional participation beyond the security team
- Independent facilitation that surfaces honest gaps
- A cadence that produces visible governance artifacts
An after-action report with assigned owners and a follow-up date is the artifact that turns an exercise into accountability.
Frequently Asked Questions
How often should incident response exercises be conducted?
A tiered approach works best: quarterly tabletop exercises focused on current threat scenarios, at least one functional or red team exercise annually, and a post-incident review after every significant event. Organizations in regulated industries or undergoing major changes should adjust upward from that baseline.
Who should participate in an incident response exercise?
Cross-functional participation is essential — IT security, legal, communications, HR, and executive leadership. Board or audit committee involvement in at least annual tabletop exercises is now governance best practice, not just operational oversight.
What is the difference between a tabletop exercise and a red team exercise?
Tabletops are discussion-based: participants walk through a scenario to test decision-making and communication, without deploying real resources. Red team exercises are active adversary simulations — higher cost, more rigorous, and the most credible assurance evidence for boards and regulators — that test whether the organization can actually detect, escalate, and contain a realistic intrusion.
How do you measure whether an incident response exercise was effective?
Key indicators include escalation accuracy during the simulation, quality of decisions made under pressure, number of new gaps identified, and — most telling — the rate at which remediation items from the prior exercise were closed before this one ran.
What should happen after an incident response exercise is completed?
A structured after-action report should document gaps, lessons learned, and remediation actions with assigned owners and deadlines — shared with executive leadership and the board as evidence of program health, and tracked until every item closes.
Can a small or mid-sized organization run meaningful incident response exercises?
Tabletop exercises are low-cost and low-disruption by design. A focused 60-minute tabletop on a single realistic scenario — ransomware, social engineering targeting executives, a vendor outage — provides immediate, actionable value at any organizational size and is a sound starting point before investing in more complex exercise types.
