Cyber crisis exercise
A simulated attack, as a tabletop or live exercise, that tests the decisions of management and teams before an incident, which insurers regard as an indicator of controlled severity.
A cyber crisis exercise confronts an organization with a fictitious attack scenario to test its ability to decide and coordinate. In its most common form, the tabletop exercise, executives and relevant managers react to information injected as the scenario unfolds, without touching systems: should the network be cut, the authorities alerted, the ransom paid, the public told, and who decides? Heavier forms simulate the attack on systems or involve several organizations, even several countries. The exercise reveals what no technical audit shows: phone numbers that are out of date, the continuity plan stored on the encrypted server, the decision nobody feels entitled to take, unawareness of the complaint or notification deadline. For the insurer, it is an indicator of future severity, because the first hours of an incident determine a large part of its cost. Applications ask for the date of the last exercise and management's participation, and several regulations now make it an obligation, notably for financial entities subject to the digital operational resilience regulation.
The European Union Agency for Cybersecurity has organized the Cyber Europe exercise every two years since 2010, bringing together hundreds of organizations from dozens of countries around a sector scenario: healthcare in 2022, energy in 2024.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.