Playing rounds
An exercise has six decision rounds. After each decision, the AI works out what happens next and moves the scenario on, so no two exercises play out the same way.
What you see in each round
- Phase bar. The response phases for this type of exercise, with the current one highlighted. It also shows the turn (for example Turn 2/6), the time in the scenario and the Time since start of incident.
- Consequence of last decision. What happened because of your previous choice.
- Evidence. Some rounds include an artefact to examine, such as Open email, Open SMS, Open ransom note, Open SIEM alert, Open terminal output or Open system log.
- Situation report. The current state of the incident. Cyber exercises can also list Observed MITRE ATT&CK techniques. Some exercises list Risk indicators.
The phases depend on the exercise type:
| Type | Phases |
|---|---|
| Cyber | Identification, Containment, Eradication, Recovery, Post-Incident |
| ISO 27035 | Plan & Prepare, Detection & Reporting, Assessment & Decision, Responses, Lessons Learned |
| Crisis | Notification & Verification, Crisis Team Activation, Assessment & Strategy, Negotiation & Response, Resolution, Aftermath |
| Third-party resilience | Detection & Triage, Invocation & Continuity, Regulatory Assessment & Notification, Supplier & Stakeholder Management, Recovery & Reconciliation, Post-Incident Review |
Making a decision on Basic
Under Decision required: select team action, choose one of the lettered options. The options you do not choose are deferred, not abandoned. They wait, and the incident carries on, so the AI shows the cost of the delay.
Assigning people on Pro and Enterprise
Pro and Enterprise exercises use people as a resource. Under Decision required: assign your people:
- Check the counter, for example 3 people left of 5.
- Each option shows Needs and a number of people. Tick the options you want to start. You cannot tick an option you cannot afford.
- Some options are escalations that show Brings in extra people next turn.
- Select Commit resources.
An option is either fully resourced or not started. Anything you do not resource is deferred, not abandoned. People you leave unused are reported in the debrief but do not affect your score.
The adversary or the incident can take people away. A banner tells you how many people are taken away for the next turn, and why. If nobody is left, you see Nobody available: choose one escalation. Pick one and select Escalate. It takes effect from the next turn.
Injects on Pro and Enterprise
After turns 2 and 4, an Incoming inject may appear. This is a new development, such as a media enquiry or a regulator asking questions. Read it, then select Acknowledged, continue. It is factored into the next situation update.
Timing
There is no countdown. Take the time your team needs to discuss each decision. While the AI prepares the next round, you see Analysing threat actor response…
You are signed out after 30 minutes without a click, tap, key press or scroll, even mid-exercise. See Devices and sessions.
Leaving and resuming
Your exercise is saved after every round. To leave, select Exit.
When you next begin an exercise, you are asked Resume your exercise?
- Resume carries on where you left off.
- Start fresh abandons the earlier exercise and starts the one you just chose.
The end of the exercise
After your sixth decision you see Exercise complete. Preparing your debrief… and the debrief opens. See The debrief.