Join our Community for Cyber Incident Simulation and Response Professionals

Business Case for Fully Immersive Simulations

1. Preparedness Matters

It’s impossible to pinpoint when the next crisis might hit or what form it’ll take. If organizations could predict or anticipate the timing and nature of cyberattacks then prevention would be easy. Likewise, if they’d previously experienced a disruption of this nature, then they’d know exactly how to respond. The problem is that any cyberattacks will inevitably have succeeded in evading all your cybersecurity prevention and detection measures.

"Invest in preparedness, not in prediction..."
- Risk management guru, Nassim Taleb.

people sitting down near table with assorted laptop computers

2. Testing is Mandatory

Any organization that holds the personal information of even one EU citizen is subject to GDPR, which mandates not only data protection and cybersecurity, but also the regular assessment and testing of systems and processes. If an incident occurs, you will need to show the regulator that you acted reasonably and responsibly.

“If you did not test your backups and/or incident response plan regularly, then you’ll need to explain why.”

closeup photo of turned-on blue and white laptop computer

3. There is no substitute for fully immersive simulations

Tabletop exercises or power point-based training and inadequate as they do not provide a true test of situational awareness or the ability to collaborate and execute under pressure.

“While you could learn to drive from a manual, the driving test has both a theory and a practical test, because until you actually hit the road and have to deal with other road users, you won’t be able to build up the road sense that is essential.”

4. Your reputation is on the line

While cybersecurity and privacy are sometimes seen as just an IT or compliance issue, when you have a cyber incident it is most definitely a business issue – one that not only impacts the whole organisation, but its reputation as well.

“It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently.”
- Warren Buffett

5. Enhance your ability to obtain insurance

It is growing increasingly difficult to obtain cyber insurance. Many policies are now conditional on having an adequate level of cyber hygiene and training. Being able to demonstrate that you have the highest level of protection and preparedness can also help reduce your cyber insurance premiums.

“In the past 3 years, cyber insurance claims have increased by an order of 100% and payouts a total of 200%. Currently only about 30% of policies pay out though.”

6. Senior Management Participation is Essential

It is essential that your senior management not only buy into the need for fully immersive simulations, but that they actively participate as well. Otherwise, it is like putting on a broadway show but only having the understudies attend all of the rehearsals. When it comes to opening night the main cast won’t know their lines.

“Shareholder derivative actions against CISOs, CEOs and other board members, holding them personally liable, are becoming increasingly common.”