The first hour

A leadership team that hesitates for four hours over who is allowed to shut down a production system will still get through it. They will just pay for those four hours in lost revenue, in a press cycle they did not control, and in a lingering sense that they got lucky.

That last part matters more than it sounds. Confidence built on luck does not transfer to the next incident, and the people in the room know it. So the question is not whether the organisation survives. It is how long it takes to get going, what the delay costs, and whether anyone would do it better a second time.

Resilience is the ability to get going effectively, and the confidence that comes from having done it before.

How a test actually unfolds

We bring a leadership team into a room and present a scenario. No technical prerequisites, no preparation, no reading material sent out in advance. Then we let it develop.

The first twenty minutes are usually calm and slightly amused. People are polite, they take turns, someone makes a joke about the coffee. Then the scenario starts pushing. A journalist calls. A customer-facing system stops responding. Someone asks whether this is a reportable incident, and nobody in the room is sure. A second system goes quiet and it is not immediately clear whether that is related or coincidental. Phones and email are part of the incident, so the usual way of reaching each other does not work.

This is the point where the room changes, and it is the point of the whole exercise. What surfaces is almost never a missing plan. The plan usually exists and is usually fine. What surfaces is that nobody has used it under pressure.

Three things come up again and again. Decision authority is unclear, so a decision that should take two minutes takes forty while people work out who owns it. Communication is treated as something that happens after the technical response, when in practice the first external statement is needed long before anyone knows what actually happened. And information flow breaks down, because the people with the facts and the people with the mandate are not in the same conversation.

None of this is a failure of competence. These are capable people. It is a failure of rehearsal.

The end of a good session

By the last hour something has shifted. The group starts naming decisions instead of discussing them. Somebody says "I will take that, and I will tell you in fifteen minutes." The room gets quieter and moves faster. That is what we are looking for, and it is why these sessions end well. Not because the scenario was easy, but because the group found the shape of their own response and can now recognise it again.

The output is a short list of things to fix. Usually five or six items, most of them small, and often not the ones anyone expected walking in.

Where this sits in the wider picture

We think of security work as a journey with four stages. Understand your exposure. Validate your defences. Reduce your risk. Build lasting resilience.

A crisis exercise sits mainly in the second stage, validation, because it tests something you already believe to be in place. But its real value shows up in the fourth. Technical controls reduce the probability of an incident. They do not reduce the confusion when one happens anyway. Only practice does that, and practice is the part organisations most often skip, because it is the only part that requires the leadership team to give up a full day and be visibly uncertain in front of each other.

That discomfort is the product. There is no version of this that works without it.

Something to try

You do not need us to start. At your next leadership meeting, ask three questions and see how quickly the room agrees on the answers.

• Who is allowed to shut down a business-critical system, and does that person know it?
• Who speaks publicly in the first hour, and what are they permitted to say before the facts are confirmed?
• How do we reach each other if email and phones are part of the problem?

If the answers come quickly and match, you are in better shape than most. If they do not, you have just found your first five items.