Inclusive Security Exercises: Testing Your Human Defenses

Security exercises, simulated incidents that test how a team actually responds, are among the most valuable, and most commonly skipped, parts of a security program. Their value increases significantly when they're designed with the full range of people who'll respond to a real incident in mind.

Why exercises reveal what plans cannot

A written incident response↗ plan describes what should happen. An exercise tests what actually happens, and the gap between the two is often larger than expected. Common discoveries during exercises include: unclear ownership of key decisions, contact information that's out of date, and assumptions about who has access to critical systems that turn out to be wrong.

Building an Incident Response Plan for Small Teams

You don't need a security team to have a plan. A simple, written incident response plan turns a chaotic security event into a manageable one.

Designing exercises inclusively

Exercises designed around a narrow set of assumptions, a single communication channel, a single working style, a single set of technical skills, often fail to reflect how a real, diverse team will actually respond. Effective exercise design considers:

• Multiple communication channels, not everyone monitors the same chat tool or checks email at the same frequency during a crisis.
• Varying technical backgrounds, an exercise scenario that only makes sense to technical staff excludes the non-technical decision-makers who'll also be involved in a real incident.
• Accessibility, exercises should be usable by participants with different needs, the same way any other critical process should be.

Starting small

You don't need an elaborate simulation to get value from exercising. A one-hour tabletop discussion, walking through "what would we actually do if X happened right now?", regularly surfaces gaps that would otherwise only be discovered during a real, high-pressure incident.

People-centred security in practice

The common thread across inclusive exercise design and people-centred security generally is the same: security that only works for one type of person, in one set of circumstances, isn't robust security, it's security that happens to work in the scenario someone imagined while designing it.

An exercise that only reflects how one type of person thinks and communicates will only prepare your organization for the incidents that unfold exactly that way.