At the FutureCrime Summit 2026, a workshop titled “TTEX – Cyber Crisis Exercise: Command, Coordination and Response Drill” focused on how organisations can prepare for major cyber incidents by testing decision-making, coordination and response procedures in a simulated crisis environment.
The workshop was led by Sanskriti Grover and centred on the importance of preparedness when cyber incidents move beyond technical disruption and begin affecting organisational operations, leadership decisions and crisis management.
Cyber Crisis Response Requires More Than Technical Skills
Cyber incidents can escalate rapidly. A serious breach may begin with suspicious activity on a network but quickly develop into a wider operational problem involving disrupted services, compromised information, reputational risk and urgent decisions about containment and recovery.
The workshop theme highlighted why organisations must prepare for such situations before they occur. A cyber crisis exercise allows participants to work through a simulated incident and examine how different teams respond when information is incomplete, time is limited and the consequences of delayed decisions may increase.
Unlike purely technical exercises, crisis drills can test whether responsibilities are clearly understood across an organisation. Security teams may need to investigate the incident, leadership may have to make strategic decisions, and operational teams may be required to maintain essential services while the situation continues to develop.
Command And Coordination Become Critical During Incidents
One of the central elements of the workshop was command and coordination.
During a major cyber incident, organisations can lose valuable time if teams are uncertain about who has authority to make decisions or how critical information should move between departments. A structured crisis response therefore requires clear leadership, established communication channels and predefined responsibilities.
The TTEX Cyber Crisis Exercise, led by Sanskriti Grover, placed these organisational capabilities alongside technical response. Participants in such exercises can evaluate how quickly information reaches decision-makers, whether teams communicate effectively and whether response procedures remain practical when an incident becomes more complex. The exercise format also allows organisations to identify weaknesses without waiting for a real attack to reveal them.
Response Drills Expose Gaps Before A Real Crisis
The value of a cyber crisis exercise lies partly in what it exposes. Written incident-response plans may appear comprehensive, but their effectiveness cannot always be understood until they are tested. A simulated crisis can reveal unclear escalation procedures, communication delays, gaps in decision-making and situations where different teams interpret responsibilities differently.
These findings can then be used to strengthen procedures and improve preparedness. Response drills can also help teams become more comfortable operating under pressure. During an actual cyber incident, uncertainty can make even familiar tasks more difficult. Repeated exercises provide an opportunity to practise decisions, refine processes and build greater confidence across participating teams.
Preparedness Becomes A Measure Of Cyber Resilience
The broader message of the “i” workshop was that strong cybersecurity depends not only on preventing incidents but also on an organisation’s ability to manage them when prevention fails. Cyber resilience increasingly requires technical expertise to work alongside leadership, communication and operational coordination. By placing participants in a simulated crisis environment, the workshop demonstrated how preparedness can be tested before organisations face the pressure of a genuine cyber emergency.
As cyber threats continue to evolve, organisations will increasingly be judged not simply by whether they experience an incident, but by how effectively they command, coordinate and respond when one occurs.
