Your Cybersecurity Team Has a Plan. Can It Work Under Pressure?

A response plan can look excellent in a document. Roles are assigned, escalation paths are mapped and recovery procedures are neatly organised. Then a suspicious login becomes a suspected ransomware incident, the business asks whether customer data is affected and three departments need answers at once.

Suddenly, the test is less about remembering a procedure and more about knowing what to do next.

That gap between documented processes and actual performance is why cybersecurity exercises deserve a place in workforce development. They give organisations a controlled way to test how people apply their knowledge, coordinate with colleagues and make decisions when information is incomplete.

Training needs a rehearsal, not just a classroom

The European Union Agency for Cybersecurity (ENISA) published its Cybersecurity Exercise Methodology in February 2026 to help organisations plan, conduct and evaluate exercises. The guidance covers the exercise lifecycle and provides tools for identifying weaknesses and turning lessons into improvements. ENISA's methodology offers a useful starting point for organisations that want training to produce measurable operational benefits.

The approach reflects a simple reality: understanding incident response and performing it are different capabilities. A security analyst may know how to investigate an alert but struggle to prioritise competing incidents. A technical lead may identify the source of an intrusion yet fail to communicate its business impact clearly. A manager may understand the escalation policy but hesitate when containment could interrupt operations.

These are skills gaps, even when everyone has completed the required training.

What a realistic exercise should test

ENISA's Cyber Europe 2026 exercise, held on 10–11 June, simulated large-scale incidents affecting interconnected European rail and maritime transport systems. More than 5,000 participants were involved, supported by over 100 cybersecurity experts. The exercise tested technical analysis alongside information sharing and situational awareness at technical, operational and political levels. ENISA's account of Cyber Europe 2026 illustrates how incident readiness extends beyond the security team.

Organisations can apply the same principle at a smaller scale. A useful exercise should test whether people can:

• Detect and investigate: interpret alerts, correlate evidence and distinguish genuine incidents from noise.

• Prioritise and decide: assess business impact, choose containment actions and understand the trade-offs.

• Communicate clearly: deliver timely updates to IT, management, legal teams and other stakeholders.

• Recover and learn: verify restoration, document decisions and identify weaknesses in existing procedures.

The scenario should match the team's responsibilities. A SOC team might investigate a compromised account, while executives decide whether a critical service should be suspended. Communications staff may need to prepare a holding statement before every technical detail is confirmed.

The goal isn't to catch people out. It's to discover where the organisation needs better training, clearer responsibilities or more reliable processes.

Turn the debrief into a development plan

An exercise is useful only if its findings lead somewhere. After each session, record the decisions made, the time needed to reach them, information that was missing and points where responsibilities became unclear. Separate individual development needs from process failures. A person cannot follow an escalation procedure that nobody has defined.

Use those findings to assign specific learning objectives. Analysts may need more practice with log analysis and incident triage. Incident commanders may need decision-making drills. Technical teams may need to rehearse recovery while business teams practise stakeholder communication.

This is where structured education and practical exercises complement each other. ITSEC Cyber & AI Academy supports the development of cybersecurity and AI capabilities through focused learning. Organisations and aspiring professionals can explore the Academy as a starting point for building relevant skills, then use realistic exercises to test how those skills perform in practice.

Build your cybersecurity capabilities with ITSEC Cyber & AI Academy: https://www.itsec.academy/

References

1. European Union Agency for Cybersecurity (ENISA), Cybersecurity Preparedness DIY: Build Your Own Cybersecurity Exercise, 16 February 2026. Read the article

2. European Union Agency for Cybersecurity (ENISA), Cyber Europe 2026: All Eyes on the EU’s Collective Response and Resilience, 11 June 2026. Read the article